TLDR

IMO defaulting to allow-same-origin is fine if you host your iframe on a separate, cookieless sandbox origin. The issue is when the sandbox proxy is served from the same origin as the host app: allow-scripts + allow-same-origin lets untrusted MCP app HTML execute with host-origin privileges. This change makes sandbox.permissions actually apply, so hosts can opt into stricter isolation, e.g. allow-scripts allow-forms, without forking the client.

Summary

• Thread sandbox.permissions through AppFrame into the sandbox proxy iframe instead of always using the default sandbox attribute.
• Recreate the iframe when sandbox permissions change so browser sandbox policy updates are applied.
• Document the permissions override and production guidance for same-origin sandbox proxies.
• Remove stale merge-conflict markers in mcp-apps.md that broke docs builds.

After:

<AppRenderer
  client={client}
  toolName="my-tool"
  sandbox={{
    url: sandboxUrl,
    permissions: "allow-scripts allow-forms",
  }}
/>

Advantage: hosts can now remove allow-same-origin for same-origin sandbox proxies, so untrusted MCP app HTML can still run scripts but no longer gets the host app’s origin privileges.