Use case: MCP servers

[kentcdodds]

I understand from the last meeting a requests for user-focused use cases was made. So here's mine.

The model context protocol allows LLM host applications to call authorized third party services to perform actions and retrieve data. The variety of use cases available here is immense, but one use case I expect users will want is the ability for the responses to be more than text. They'll want interactive, dynamic UIs to be presented based on the responses.

Imagine someone asking an LLM for directions somewhere, an MCP server could respond with a map. Or you all for reviews of a certain product and the MCP server can respond with review cards. This is the heart of my proposal to the spec: https://github.com/orgs/modelcontextprotocol/discussions/287

However, right now the best we can do is limit responses to iframes due to the untrusted nature of the code returned. I think this is a shame and limits the UX.

Being able to use a realm for this situation would increase security and improve UX.

[ptomato]

Thanks. I'm gradually building up a dossier of use cases and will include this.

[erights]

For many purposes including those here, security can be divided into integrity, availability, and confidentiality. As explained at A Taxonomy of Security Issues for understanding language-based security and modularity,

• within a so-called "agent" (thread, worker, vat) there is no way to defend the availability of any bit of code from other code in the same agent.
• confidentially defense is only possible under very restrictive assumptions that likely do not apply to your use case.
• integrity is strongly defensible down to very fine grains. It is also the concern most directly shared by conventional software engineering.

ShadowRealms indeed have avoided the broad term "security", making claims specific to "integrity", where the defensible unit is the JS realm. HardenedJS similarly is mostly about defending integrity, where the defensible unit is the "Compartment". LavaMoat uses Compartments as they were intended, where the defensible unit is an instance of a JS package. It needs that finer grain to defend against conventional library supply chain integrity attacks.

I don't know which granularity you need, but please take a look at both.

[naugtur]

Fundamental building block for Compartment is now proposed here: https://github.com/endojs/proposal-new-global

Let's continue the conversation on granularity.