{"openapi": "3.0.3", "info": {"title": "MCP App cross-host sandbox verdict", "version": "1.0.0", "description": "MCP Apps let your server hand a host an HTML widget that renders in a sandboxed iframe \u2014 but enforcement is each host's own construction. With byte-identical widget HTML and nothing declared, one measured host blocked `data:` images while another allowed them and allowed `eval`; a domain declared for images silently became a script source on both; and two of the experiment's own load checks said 'loaded' for things the browser had blocked \u2014 only the browser's `securitypolicyviolation` events told the truth. Failures are silent: no error, a blank iframe. This service ingests your `ui://` resources and `_meta.ui`, statically extracts every domain and API the HTML actually uses, and grades per host from violation events \u2014 never load handlers \u2014 issuing RENDERS-AS-DECLARED / SILENTLY-DEGRADED (named blocked calls) / OVER-DECLARED / ENFORCEMENT-DIVERGES (the exact directive delta), naming any image domain that confers script authority, probing the widget's callable-tool surface, and printing each host's stale-HTML window. **Stated plainly: the production engine grades by CSP simulation parameterised from the measured host behaviours on file \u2014 it reproduces every measured point and labels everything beyond them harness-model / UNVERIFIABLE in each verdict; it is not a real-browser grid and is not sold as one; behaviours that emit no violation event (bridge-message drops, non-CSP permission denials) are named blind spots, graded UNVERIFIABLE, never PASS; willingness to pay is unmeasured; the CI watch is a stated allowance, never unlimited (see pricing).**", "contact": {"email": "support@textforagents.com"}}, "servers": [{"url": "https://textforagents.com/products/mcp-app-cross-host-sandbox-verdict"}], "paths": {"/register": {"post": {"summary": "Self-serve registration; returns an api token once"}}, "/verdict": {"post": {"summary": "Single widget x host verdict ($0.99; one free per operator+wallet ever)"}}, "/matrix": {"post": {"summary": "Full matrix, 1 widget x 5 hosts ($3.99)"}}, "/subscribe": {"post": {"summary": "CI watch ($19.99/mo, 40-matrix monthly allowance)"}}, "/account": {"get": {"summary": "Account, trial and watch state (auth)"}}, "/log": {"get": {"summary": "Own verdict-log entries (auth)"}}, "/health": {"get": {"summary": "Health"}}}}