diff --git a/client/public/mcp-sandbox.html b/client/public/mcp-sandbox.html
index f2e5483dab..04264aa431 100644
--- a/client/public/mcp-sandbox.html
+++ b/client/public/mcp-sandbox.html
@@ -158,6 +158,9 @@
         ("script-src 'unsafe-inline' " + resourceDomains).trim(),
         ("style-src 'unsafe-inline' " + resourceDomains).trim(),
         "connect-src " + connectDomains,
+        // form-action does not fall back to default-src, so with allow-forms a form could post to
+        // any origin; bound it to the declared egress allowlist ('none' when none is declared).
+        "form-action " + connectDomains,
         ("img-src data: blob: " + resourceDomains).trim(),
         ("media-src " + (resourceDomains || "'none'")).trim(),
         ("font-src " + (resourceDomains || "'none'")).trim(),