Slides: Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic

Source Video

Why MCP and ChatGPT Apps Use Double Iframes — Frédéric Barthelet, Alpic

Relationship To World's Fair 2026

These slides are extracted from a public AI Engineer YouTube video connected to World's Fair 2026. Speaker-matched clips are supporting context unless later confirmed as exact session recordings; official livestream recordings are day-level/event-level source material.

Related Scheduled Sessions

No individual scheduled session mapping has been assigned yet; treat this as an event livestream deck.

Extracted Slides

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.98
Text source: agent_vision.

Slide text:

What are MCP & ChatGPT Apps?

Discoverability in-chat and in stores on ChatGPT and Claude

Interactive UI inside AI chats

Liad and Ido experimenting with MCP-UI

Initially released on ChatGPT as OpenAI's Apps SDK

Standardized as MCP first official extension

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.97
Text source: advanced OCR rapidocr-live/bright-screen/opencv-adaptive.
OCR decision: ready — diagram slide with small text and schematic labels

Slide text:

1 Howitworks

Host MCP Server

tools'lt

Hhhonoatuw' pm soos

AIE Views render in response to tool calls resouroes'reud toolsiall

HTML documents live in resources Yew HTML with _oeeL ut ( Csp pernksors

Views can be cached ahead of time Createve nth frme? Yew'h the chat

Feadt ( content + meta.ul.url

O Hast. MCP Server

Al Engineer

EUROPE

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.97
Text source: advanced OCR rapidocr-live/border-trim/contrast.
OCR decision: ready — dense code and CSP table text are better suited to OCR

Slide text:

Before AI Apps - the host page

ohatgpt.com default-src Content-Security-Policy Directive sanpea pamoiv

AIE Trene-grcaoitstrie.ci youruoe.com style-gro script-src connect-sro 1ngrs1blobt solfunsofe-Inline nonce--httos://chutgpt.coo s1t.opeai.ocmwno.//.chatopt script-src src default- inline nane none -U self unsafe-eval' https: str:ct-dynan1c unsafe

style-src self unsaie-inline nonce-

src connect- sel! nt:ps:?55:

img-src selt' data::0010

frame-src self' none blob:

ginetr Engineering the future of Al

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.98
Text source: agent_vision.

Slide text:

Rendering external HTML?

Use iframes

The <iframe> HTML element represents a nested browsing context, embedding another HTML page into the current one.

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.96
Text source: advanced OCR rapidocr-live/border-trim/contrast.
OCR decision: ready — code/diagram slide with small text and snippet details

Slide text:

Whatif-srcdoc?

chatgpt.com Content-Security-Policy

script-arenonce--1httpa://*.chatgpt.com

fre-arcseif*.stripe.con..youtube.coo

AIE

<body> itroo srcdoc-".>

cdiv>Your App /div>

</body"

× inherits parent csP without script nonce, all view scripts blocked

ginoer Engineering the future of Al

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.97
Text source: advanced OCR rapidocr-live/bright-screen/contrast.
OCR decision: ready — Dense code-like slide with small text and cropped elements; OCR will be more reliable.

Slide text:

pp- specific subdomain with cs The solution - double iframe

chatgpt.con Content-Security-Policy

scriot-src.nonce--https://*,chsrgpt.com

AIE ★ ★ frase-aro'self.stripe.com-youtube.com eeb-snndbox.oniuserconteot

body>

aroshttps://sbo123.web-sundbox.ooiusercontent.con

neta http-equiva'Content-Security-Policy'content-'connect-src'ey-service

<scripr>initieiizeipp()s/acript>

srcdoc*"'sandboxe'ellok-scriptsellom-snne-origin'>

<AID/>.dOY.JnOX<ATp>

</body>

gineer AI Engineer EUROPE

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.99
Text source: advanced OCR rapidocr-live/bright-screen/contrast.
OCR decision: ready — Dense table slide with small text; OCR is appropriate.

Slide text:

app depends on You must declare all domains your

AIE _metaui.csp feld CSP directive(s) Unlocks

connectDorains conneci-src fetch, XHR, WebSocket

resourcedonains script-src <tvlc-src font-src 1ng-src ncdia-src External scripts,styles,fonts,images

fracDonains frane-src Nested iframes(maps,video)

baseUriDorains basc-ur1 Custom base URIs

gineer Engineering the future of Al

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.96
Text source: agent_vision.

Slide text:

Build MCP Apps with Skybridge

Open-source framework for building MCP Apps

End-to-end typesafety

Modern development environment

Unified APIs for host cross-compatibility

Recreated text/layout view: open HTML recreation
AI slide classifier: content_slide confidence 0.94
Text source: advanced OCR rapidocr-live/full.
OCR decision: ready — UI screenshot with small embedded text; OCR is likely the best extraction path.

Slide text:

Skybridge alale-l-aov0.0.1 Leare reast eree

Toots 1-teet magic-s-ball ette DcatL Tost

magic-8-bat1 Fer rerte-ttLing ee seeking 335434

question

AIE

AIEngineer

EUROPE

Hidden Non-Slide Evidence

`slide-001.jpg` — speaker_stage confidence 0.99; camera shot of speaker on stage with only a partial projected slide visible
`slide-007.jpg` — speaker_stage confidence 0.99; speaker on stage with partial projected slide; not a readable presentation slide

Classification audit: raw/sources/slide-ai-classification/slides/c-2eEv2ou7Y/audit.json

Slide-Derived Subjects To Review

Subject extraction uses video title, related session titles/descriptions, transcript context, and OCR text when available. OCR is best-effort and should be reviewed against the embedded slide images.