Skip to content

Local timeIST UTC+5:30

Contact Me
Menu
Contact Me

Selected work

Case study 03/03

WritingAll projects

A study of where the HTML shipped by an MCP App runs inside Claude.ai and what it can reach, with a probe app anyone can run again.

Role
Author
Type
Security writing
Finding
No vulnerability found
Includes
Runnable probe app

Signal path

  1. InputAI security and red teaming
  2. Hidden 01AI Security
  3. Hidden 02MCP Apps Sandbox
  4. OutputContact

  1. The question

    MCP Apps let a server ship an HTML interface that renders inside the host conversation. Before trusting that, I wanted to know where the HTML actually runs inside Claude.ai, what surrounds it, and what it is able to reach.

  2. What I built

    A small probe app and a written walkthrough of what it observed. The probe is an Express server built on the MCP SDK and the MCP Apps extension package, exposing one tool and one HTML resource. It is in the repository, so the observations can be repeated.

  3. Where it stands

    The writeup states plainly that no vulnerability was found. It is a map of the trust boundaries, not an exploit report, and it is public on GitHub together with the probe.

Method

  1. Input

    Question

    Where does the HTML of an MCP App run inside Claude.ai, and what can it reach?

    Leads to: Probe app.

  2. Process

    Probe app

    An Express server exposing one tool and one HTML resource.

    Leads to: Label.

  3. Decision

    Label

    Each finding is labelled by its evidence.

    Leads to: Verified, Inferred, Not tested.

  4. Verified

    In the browser.

    Leads to: Negative result.

  5. Inferred

    From the open source reference implementation.

    Leads to: Negative result.

  6. Not tested

    Three questions were not tested.

    Leads to: Open questions.

  7. Output

    Negative result

    No vulnerability found, and reported as that: a map of the trust boundaries.

    Leads to: On GitHub.

  8. Store

    Open questions

    Listed in their own section, not folded into the conclusions.

    Leads to: On GitHub.

  9. Output

    On GitHub

    The writeup together with the probe, so the observations can be repeated.

Lit: a finding verified in the browser

Approach

  1. Every claim carries its evidence

    Findings are labelled as verified in the browser, inferred from the open source reference implementation, or not tested. A reader can tell at a glance how much weight a sentence will bear.

  2. A negative result, reported as one

    Finding nothing is still a result. Writing it down saves the next person the same work, and keeps the conclusion from sounding bigger than it is.

  3. Open questions left open

    Three questions were not tested. They are listed in their own section as open questions, not folded into the conclusions.

Stack

  • Model Context Protocol
  • MCP Apps
  • Express
  • JavaScript

Links

Next projectcachellm