Shared dependencies between UI instances

[liady]

Context

An MCP App guest UI is self contained - and is required to include all of its dependencies (running in an isolated iframe). Use cases of MCP Apps will invlove multiple UI instances from the same server - and we might run into the question of "bloated" duplicate dependencies (i.e React, component libraries, etc).

This is not a new problem and is common in all microfrontend-based environements, however here we're looking at a lot of 3rd-party iframes that will have a 3rd-party host, so many of the existing solutions won't work.
We can imagine every host would need or try to solve it somehow at some point.

Not sure if this should be a part of the spec/recommendations (module federation? sharing resources between instances somehow?) - but opening here for a discussion.

[ochafik]

An MCP App guest UI is self contained - and is required to include all of its dependencies (running in an isolated iframe).

@liady Note that apps can fetch resources from any predeclared domain (cf. _meta.ui.csp), incl unpkg.com, etc.

we might run into the question of "bloated" duplicate dependencies (i.e React, component libraries, etc).

Safari and Chrome both moved to partitioned HTTP caches to prevent privacy leaks, and I'd rather we didn't risk undoing their benefit.

The issue: if site A and site B both load cdn.jquery.com/jquery.js, site B could time how fast it loads and infer "oh, this user already visited site A."

In the MCP Apps context, sharing deps across iframes could enable similar snooping - e.g., App A detecting "this user already ran App B" by probing for shared libs in cache.

https://developer.chrome.com/blog/http-cache-partitioning
https://www.stefanjudis.com/notes/say-goodbye-to-resource-caching-across-sites-and-domains/