While building the first MCP-UI client at Postman, the author hit a wall with Content Security Policy (CSP). Production hosts block third-party content, making arbitrary app loading impossible. The solution was a double iframe architecture to allow untrusted apps without compromising host security.

The same challenge resurfaced with the ChatGPT Apps SDK. With no public documentation, the author reverse-engineered its setup and found a familiar sandbox proxy iframe pattern. This allowed rendering ChatGPT apps inside Postman, solving developer experience gaps like ngrok tunnels and caching issues.

This technique is now formalized in the MCP Apps spec. The specification mandates separate origins for host and sandbox, a proxy enforcing CSP from UI metadata, and metadata fields like `connectDomains` to build dynamic security headers. The double iframe remains the standard for secure embedded UI.