[BUG] Linear MCP save_comment / save_issue: Cloudflare WAF on anthropic.com 403s payloads containing technical-markdown patterns (post-2026-05-04 ruleset)

## TL;DR

Calls to `mcp__claude_ai_Linear__save_comment` and `mcp__claude_ai_Linear__save_issue` are intermittently returning Cloudflare 403 "Sorry, you have been blocked" HTML pages when the markdown payload contains common technical patterns: shell template expansions (`$VAR` / `${VAR}`), nested-parens function calls, file paths with colons, etc.

The error HTML page identifies `anthropic.com` as the blocked domain, so the WAF lives on Anthropic's MCP managed-connector ingress — Linear's own MCP server (`mcp.linear.app`) never sees the request. Frequency rose sharply starting ~2 weeks ago, coinciding with the Cloudflare WAF Managed Ruleset 2026-05-04 release that expanded command-injection / RCE / SQLi coverage.

## Reproduction

Inside any Claude Code or claude.ai session with the Linear connector enabled, call `mcp__claude_ai_Linear__save_comment` against any issue you own with a body that mixes the trigger patterns. Minimal payload that reproduces:

```json
{
"issueId": "",
"body": "Test: `make build` runs `--build-arg BASE_IMAGE=$BASE_IMAGE_NAME:$BASE_IMAGE_TAG` and `Function(runtime=Runtime.PYTHON_3_12, code=Code.from_asset(.../log_export))`."
}
```

**Expected:** comment is created on the Linear issue.

**Actual:** the tool returns a string that begins with `Streamable HTTP error: ...Attention Required! | Cloudflare...Sorry, you have been blocked...You are unable to access anthropic.com...Cloudflare Ray ID: `. Different Cloudflare Ray IDs per attempt confirm this is content-matched, not IP rate-limiting.

I hit this 6+ times today (2026-05-25) inside a single review session against one Linear ticket. Each blocked attempt was a different markdown payload with different size; the consistent factor was a mix of `$VAR` template expansions and Python/CDK function-call syntax in the same comment.

## What I verified

1. **Strip the `$VAR` template expansions OR the nested-parens function calls** from the same comment and it goes through. The smallest comment that fails contains both patterns together.
2. **Payload size is not the trigger** — a 3.6KB comment with similar topic but no `$VAR` / `Function(...)` patterns landed; later 1.5KB rewordings that kept those patterns were still rejected. Cloudflare 403s come back fast (<1s), not at any reasonable size threshold.
3. **Linear's API and rate limits are not involved** — the blocked endpoint named in the HTML is `anthropic.com`. Linear receives no traffic for the blocked attempts.
4. **OAuth / "Block AI training bots" is not the cause** — those failure modes (tracked in #49, #80, #75, #63, #76) return different error shapes and target different endpoints. This one is the OWASP-style "Sorry, you have been blocked" page, returned mid-call on a fully-authenticated connector.
5. **Cloudflare changelog corroborates the timing.** The 2026-05-04 WAF Managed Ruleset release () added ~20 new rules including 9 command-injection (generic + sleep-based), 3 bash-bypass / RCE, 3 SQL DROP-statement, and 3 XSS object-tag detections (the last promoted from Log → Block).

The new generic command-injection and bash-bypass regexes match exactly the patterns AI-generated technical markdown routinely contains. Tool-input POST bodies for `save_comment` / `save_issue` are user-facing markdown that, in any code-heavy ticket, naturally includes those patterns.

## Adjacent issues

I checked open Cloudflare-flavoured issues in this repo before filing: #350 (recent, but it's about server reachability post Connections-migration, distinct cause); #80, #75, #63, #49, #76 (older, all OAuth / inbound-bot-block, distinct error shape). The content-based POST-body false-positive pattern doesn't appear to be filed yet. cc anyone tracking #350 — adjacent symptoms, different root cause.

## Suggested fix

Cloudflare documents the pattern: a [WAF Exception / Skip rule](https://developers.cloudflare.com/waf/managed-rules/) scoped to the URI path that receives MCP tool-call POST bodies. Options, in increasing specificity:

1. **Skip the Cloudflare Managed Ruleset entirely** for the URI path that handles MCP tool-input POST bodies. The body is generated by Anthropic-controlled infrastructure proxying through to a vetted MCP server — it is not the kind of untrusted user input the Managed Ruleset is designed for.
2. **Move only the new 2026-05-04 command-injection / RCE / SQLi rules to Log mode** for that URI path. Keeps the rest of the ruleset (XSS, true SQLi in URIs, etc.) active.
3. **Route MCP tool-call traffic through a dedicated subdomain** with a tuned ruleset. Highest isolation, biggest delta to configure.

Option 1 or 2 should be a small Cloudflare dashboard change and would eliminate this entire failure class without weakening the WAF for general anthropic.com traffic.

## Workaround currently in use

Until this is fixed, users hitting this can:
- Rewrite comment bodies to avoid `$VAR` templates, nested-parens function calls in the same block, and chained `path:line` references on a single line.
- Save large drafts to a local file and paste into Linear via the UI manually.
- Treat HTML responses from MCP tools beginning with `...Attention Required! | Cloudflare` as content-matched WAF rejection (NOT transient) — don't retry verbatim, reword first.

I'm baking these into team agent-context files so the workaround is automatic across future sessions, but that's a band-aid — the proper fix is the WAF exception above.

## Environment

- Claude Code CLI on macOS (Darwin 25.3.0)
- claude.ai Linear connector via the `mcp__claude_ai_Linear__*` tool namespace (Anthropic's managed integration, not a self-hosted MCP server)
- Encountered repeatedly during routine ticket-review sessions over the past ~2 weeks
- Cloudflare Ray IDs from today's failures available on request

## Why this matters

`save_comment` / `save_issue` are the canonical Linear MCP write tools, and they're the entry points for using Claude to draft thorough ticket reviews, design docs, and specs. Once Claude reaches a certain quality bar on long-form ticket markdown, every one of those write-backs hits this WAF. The workarounds achievable on the user side make Claude produce worse-formatted markdown to dodge a WAF rule — wrong direction. The proper fix lives entirely on the Cloudflare config side.