$ cat ARCHITECTURE.md · overview for reviewers

Your page,
in its own sandbox.

How an artifact publisher can serve untrusted, agent-written HTML safely: keep the site, the review chrome and the raw document on separate origins, and let browser isolation do the containing.

System map

System map: agent and reviewer connect to a control origin, which frames an isolated artifact origin; storage sits behind the control origin AI agentMCP client Reviewerbrowser edge · control origin /mcp · publish, update, revoke /artifact/<slug> · review page comments · access checks SQL dbmetadata object storeHTML versions artifact origin sandboxed iframeno cookiesconnect-src 'none'no same-origindata: images only scoped keyHTTPSframe-src only System map (narrow layout): agent and reviewer connect to a control origin, which frames an isolated artifact origin; storage sits behind the control origin AI agentMCP client Reviewerbrowser edge · control origin /mcp · publish, update, revoke /artifact/<slug> · review comments · access checks SQL dbmetadata object storeHTML versions artifact origin sandboxed iframeno cookiesconnect-src 'none'no same-origindata: images only scoped keyHTTPSframe-src only

Request flows

Surfaces

Site

example.com
  • Marketing, docs, sign-in
  • Workspace and keys

Control & review

app.example.com
  • Review chrome, comments, MCP
  • Strict CSP, frame-ancestors none

Artifact

artifacts.example.com
  • Raw HTML only, in a sandbox
  • No API, session or Set-Cookie

Threats & mitigations

ThreatMitigationStatus
Script reads reviewer sessionSeparate origin, sandbox without same-origin, no cookiescontained
Data exfiltration via fetchconnect-src 'none', form-action 'none'contained
Artifact comments on itselfExact same-origin Origin header; null rejectedcontained
Leaked linkRevocation at serving layer; private / allowlist modesresidual: saved copies