/chatgpt-app-builder

Content Security Policy

Views run in sandboxed iframes with strict CSP. Whitelist external domains under the tool's view.csp:

server.registerTool(
  {
    name: "search-flights",
    description: "Search flights",
    inputSchema: { ... },
    view: {
      component: "search-flights",
      description: "Flight results",
      csp: {
        connectDomains: ["https://api.example.com"],
        resourceDomains: ["https://cdn.example.com"],
        frameDomains: ["https://maps.example.com"],
        redirectDomains: ["https://checkout.example.com"],
      },
    },
  },
  async (input) => ({ ... })
);

Skybridge auto-includes the server's domain. Only add external domains.