From aa4fc219ba83d23499d997f3761d07987e7ab81d Mon Sep 17 00:00:00 2001
From: asemabdallah <asasem547@gmail.com>
Date: Sun, 11 Oct 2026 02:28:22 +0200
Subject: [PATCH] docs(mcp): drop allow-same-origin from the iframe example

---
 apps/mcp/README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/apps/mcp/README.md b/apps/mcp/README.md
index c4a6c43..ec7da27 100644
--- a/apps/mcp/README.md
+++ b/apps/mcp/README.md
@@ -155,7 +155,10 @@ const result = await client.callTool("assemble_document", {
 });
 
 // result.content[0].text is a complete HTML document
-// Render in: <iframe sandbox="allow-scripts allow-same-origin" srcdoc={result.content[0].text} />
+// Render in: <iframe sandbox="allow-scripts" srcdoc={result.content[0].text} />
+// Do not add allow-same-origin: a srcdoc iframe shares the host page's origin,
+// so generated scripts could then read the host page and its storage. The
+// sendPrompt/openLink bridge uses postMessage and works without it.
 ```
 
 ### Resource: `skills://list`