diff --git a/src/gateway/mcp-app-sandbox-http.ts b/src/gateway/mcp-app-sandbox-http.ts
index 015c34be0464..95ea9249dc50 100644
--- a/src/gateway/mcp-app-sandbox-http.ts
+++ b/src/gateway/mcp-app-sandbox-http.ts
@@ -30,9 +30,13 @@ function handleMcpAppSandboxHttpRequest(req: IncomingMessage, res: ServerRespons
     return;
   }
 
+  const encodedCsp = url.searchParams.get("csp");
   let csp;
   try {
-    csp = decodeMcpAppSandboxCsp(url.searchParams.get("csp"));
+    csp = decodeMcpAppSandboxCsp(encodedCsp);
+    if (encodedCsp !== null && !csp) {
+      throw new Error("invalid MCP App sandbox policy");
+    }
   } catch {
     res.statusCode = 400;
     res.setHeader("Content-Type", "text/plain; charset=utf-8");