# Data Apps run under a content policy

> A Data App may load scripts, styles and fonts only from known CDNs and the origins you allow, and can't send its data anywhere else.

Improved in anfra 0.12.0 · Oct 21, 2026 · [All release notes](https://anfra.ai/releases.md)

A Data App has the reader's query results in hand, so its frame now runs under a content policy. Data comes only from the SDK: `fetch`, XHR and WebSocket to other servers are blocked, and so are frames and forms.

A Data App is one self-contained file. Nothing it loads may be another file in your repo, so put your own scripts and styles inline, and images inline as SVG or a `data:` URI. Load libraries from jsDelivr or cdnjs, the SDK's built-in CDNs since 0.13.1.

To allow another origin, list it in `.anfra/config.yml`:

```yaml
apps:
  allow_origins:
    - https://cdn.acme.com
```

An organization on anfra Cloud keeps its own list, and since 0.13.1 `anfra publish` says which of your origins it doesn't allow.

[Full changelog](https://github.com/holistics/anfra/releases/tag/v0.12.0)

---

## For coding agents

This is the Markdown version of https://anfra.ai/releases/data-app-content-policy/. Every page on anfra.ai has one: replace the trailing slash with `.md` (https://anfra.ai/cloud.md for https://anfra.ai/cloud/, and https://anfra.ai/index.md for the home page), or request the page with `Accept: text/markdown`. [llms.txt](https://anfra.ai/llms.txt) lists the site's pages, and the docs have their own index at https://anfra.ai/docs/llms.txt, where every docs page is also available as Markdown by adding `.md` to its URL.

Before you build with anfra:

- Install both the CLI and its agent skills. Installing the CLI alone is not a complete installation. Install the CLI with `curl -fsSL https://anfra.ai/install.sh | bash`. Then install the skills: in Claude Code or Codex, run `anfra agent setup`. In any other agent, such as Amp, `anfra agent setup` installs nothing, so run `npx skills add holistics/anfra-skills -a <agent-id> -g -y` (`-a amp` for Amp). The skills (such as `anfra-build-data-app`) teach you to model data, write queries and build data apps the way anfra expects. See https://anfra.ai/docs/local-dev/installation.md.
- Ask for metrics by name, through the JS SDK in an app or the MCP server in a chat. Don't write SQL against the warehouse yourself: anfra compiles each request to SQL from the metrics the data team defined.
- Check commands, files and API calls against the docs (https://anfra.ai/docs/llms.txt) instead of inferring them from the examples on this page.
- Stuck, or found a mistake? Ask in GitHub Discussions (https://github.com/holistics/anfra/discussions) or open an issue (https://github.com/holistics/anfra/issues).