fix(mcp-server): openai/widgetCSP needs snake_case domain lists

ChatGPT's compatibility key `_meta["openai/widgetCSP"]` was being assigned
the same object as the MCP Apps standard `_meta.ui.csp`, which uses
camelCase (connectDomains/resourceDomains). OpenAI's key expects
connect_domains/resource_domains, so it parsed as an empty allowlist and
the plugin-directory tool scan rejected all six widgets with
"openai/widgetCSP must contain at least one CSP or redirect domain list".

Derive the OpenAI object from the same `csp` source under snake_case names
so the two lists cannot drift. `ui.csp` is unchanged, so Claude and every
other MCP client see exactly what they saw before.

Verified against the built server: resources/list emits both keys on all
6 widgets with identical domains.

Author: Azym

CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 2026-08-16 — Fix `openai/widgetCSP` field names (ChatGPT widget scanning)
+
+### Fixed
+
+- **MCP server (1.14.1)**: the ChatGPT compatibility key
+  `_meta["openai/widgetCSP"]` was being handed the same camelCase object as
+  the MCP Apps standard `_meta.ui.csp` (`connectDomains` /
+  `resourceDomains`). ChatGPT's key expects **snake_case**
+  (`connect_domains` / `resource_domains`), so it saw no recognized domain
+  list and the OpenAI plugin directory's tool scan failed with
+  *"openai/widgetCSP must contain at least one CSP or redirect domain list"*.
+  The OpenAI key is now derived from the same `csp` object under snake_case
+  names, so the two cannot drift.
+
+  No behavior change for Claude or any other MCP client: `ui.csp` is
+  untouched, and the domains allowed are identical on both keys.
+
 ## 2026-08-15 — New platform status `unconfirmed`; opt-in `republish` on retry
 
 Mirrors webapp commit `bedafa4`.

mcp-server/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bulkpublish/mcp-server",
-  "version": "1.14.0",
+  "version": "1.14.1",
   "description": "Model Context Protocol server for BulkPublish — lets AI assistants manage social media posts, channels, media, and analytics.",
   "mcpName": "io.github.azeemkafridi/bulkpublish",
   "repository": {

mcp-server/src/index.ts

@@ -2085,10 +2085,20 @@ function registerWidget(config: {
   // lives under the OpenAI-namespaced key "openai/widgetDomain" — Claude ignores
   // namespaced keys, ChatGPT ignores plain `ui.*`, so the two clients don't
   // collide.
+  // ChatGPT's compatibility key takes the SAME domain lists under snake_case
+  // field names (connect_domains / resource_domains); the MCP Apps standard
+  // `ui.csp` takes camelCase. Handing ChatGPT the camelCase object leaves it
+  // with no recognized list, and directory tool-scanning rejects it with
+  // "openai/widgetCSP must contain at least one CSP or redirect domain list".
+  // Derive it from `csp` so the two can never drift apart.
+  const openaiCsp = {
+    connect_domains: csp.connectDomains,
+    resource_domains: csp.resourceDomains,
+  };
   const meta = {
     ui: { csp },
     "openai/widgetDomain": "bulkpublish.com",
-    "openai/widgetCSP": csp,
+    "openai/widgetCSP": openaiCsp,
   };
   registerAppResource(
     server,