{"product": "P188", "name": "MCP App cross-host sandbox verdict", "version": "1.0.0", "provider": "TextForAgents LLC", "one_liner": "The same ui:// widget runs under different rules on every host. Get the measured verdict: declared vs used vs actually enforced, per host.", "description": "MCP Apps let your server hand a host an HTML widget that renders in a sandboxed iframe \u2014 but enforcement is each host's own construction. With byte-identical widget HTML and nothing declared, one measured host blocked `data:` images while another allowed them and allowed `eval`; a domain declared for images silently became a script source on both; and two of the experiment's own load checks said 'loaded' for things the browser had blocked \u2014 only the browser's `securitypolicyviolation` events told the truth. Failures are silent: no error, a blank iframe. This service ingests your `ui://` resources and `_meta.ui`, statically extracts every domain and API the HTML actually uses, and grades per host from violation events \u2014 never load handlers \u2014 issuing RENDERS-AS-DECLARED / SILENTLY-DEGRADED (named blocked calls) / OVER-DECLARED / ENFORCEMENT-DIVERGES (the exact directive delta), naming any image domain that confers script authority, probing the widget's callable-tool surface, and printing each host's stale-HTML window. **Stated plainly: the production engine grades by CSP simulation parameterised from the measured host behaviours on file \u2014 it reproduces every measured point and labels everything beyond them harness-model / UNVERIFIABLE in each verdict; it is not a real-browser grid and is not sold as one; behaviours that emit no violation event (bridge-message drops, non-CSP permission denials) are named blind spots, graded UNVERIFIABLE, never PASS; willingness to pay is unmeasured; the CI watch is a stated allowance, never unlimited (see pricing).**", "pricing": {"verdict_usd": 0.99, "matrix_usd": 3.99, "watch_usd_per_month": 19.99, "watch_allowance": {"matrix_runs_per_month": 40, "beyond_allowance": "additional matrices meter at $3.99 and additional single-host verdicts at $0.99"}, "trial": "one free single-host verdict per operator, ever, bound to operator AND wallet"}, "how_to_start": "POST /register {operator, payer_wallet} -> api_key (shown once). Send it as Authorization: Bearer <token> or X-Api-Key. Your first single-host verdict is free (one-time trial, bound to operator AND wallet). Paid calls answer 402 with an x402 challenge; pay it and resend with the X-PAYMENT header - payment verifies through the facilitator before work and settles after.", "endpoints": {"POST /register": "self-serve registration (unauthenticated); returns your api token once", "POST /verdict": "grade one widget x host ($0.99; first single-host verdict per operator+wallet free, ever)", "POST /matrix": "grade one widget across hosts (default all 5; $3.99; watch allowance covers 40/month)", "POST /subscribe": "buy the CI watch ($19.99/mo, stated allowance of 40 matrix runs/month enforced in code)", "GET /account": "your account, trial state and watch periods (auth)", "GET /log": "your own verdict-log entries (auth)", "GET /health": "service health"}, "hosts": ["inspector", "claude", "chatgpt", "vscode", "spec"], "host_policy_versions": {"inspector": "exp187-params-v1 (CARD-187 measured, 2026-09-26)", "claude": "exp187-params-v1 (CARD-187 measured, 2026-09-26)", "chatgpt": "exp187-params-v1 (CARD-187 measured, 2026-09-26)", "vscode": "exp187-params-v1 (CARD-187 measured, 2026-09-26)", "spec": "exp187-params-v1 (CARD-187 measured, 2026-09-26)"}, "support": "support@textforagents.com"}