Rohit Ghumare d184d3e13b fix(phase-13/14): address CodeRabbit major findings ...

Pin postMessage targetOrigin to the peer's exact origin on both sides of the
host/iframe channel and validate event.origin on receive. The wildcard "*"
leaked tool calls and resource reads to any embedder.

2026-04-24 21:37:53 +01:00

..

assets

feat(phase-13/14): MCP Apps and ui:// interactive resources

2026-04-24 12:35:09 +01:00

code

feat(phase-13/14): MCP Apps and ui:// interactive resources

2026-04-24 12:35:09 +01:00

docs

fix(phase-13/14): address CodeRabbit major findings

2026-04-24 21:37:53 +01:00

notebook

feat(phase-13/14): MCP Apps and ui:// interactive resources

2026-04-24 12:35:09 +01:00

outputs

feat(phase-13/14): MCP Apps and ui:// interactive resources

2026-04-24 12:35:09 +01:00