anthropics / anthropics/claude-code

PII filter incorrectly sanitizes Figma node IDs in MCP tool responses

Offen
#91,537 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
area:mcp area:security bug
Vorherrschende Sprache
Python
Sterne
145k
Forks
23.1k
PR-Merge-Kennzahlen
PR-Kennzahlen ausstehend

Beschreibung

## Bug Description

The system-level PII (phone number) filter is incorrectly sanitizing Figma node IDs returned from Atlassian/Jira MCP tool responses. Figma node IDs use a `XXXX-XXXXX` numeric format (e.g., `2006-14129`) which matches phone number patterns, causing them to be replaced with `PHONE_X` placeholders.

## Impact

This completely blocks design-to-code workflows where Jira tickets contain Figma URLs with node IDs. The node IDs are essential for navigating to specific design frames (e.g., VQA documentation, component specs).

## Reproduction

1. Have a Jira ticket with a Figma URL containing a node-id parameter (e.g., `?node-id=2006-14129`)
2. Use any Atlassian MCP tool to read the ticket (`getJiraIssue`, `fetch`, `searchJiraIssuesUsingJql`, `search`, etc.)
3. The node-id value is replaced with `PHONE_X` in the response

## Workarounds Attempted (All Failed)

- `getJiraIssue` with markdown format
- `getJiraIssue` with ADF format
- `getTeamworkGraphContext` (ExternalDesign filter + unfiltered)
- `getJiraIssueRemoteIssueLinks`
- `fetch` with ARI
- `searchJiraIssuesUsingJql`
- Rovo `search`

All return sanitized `PHONE_X` values because the filter operates on all tool output text regardless of the tool or format.

## Workaround That Works

Reading the same URLs from source code files (e.g., Figma Code Connect `.figma.tsx` files) is NOT affected, since the PII filter apparently does not apply to file reads. Short node IDs like `2-62` also survive the filter — only longer numeric patterns trigger it.

## Expected Behavior

Figma node IDs in URLs should not be treated as phone numbers. The filter should be context-aware enough to recognize URL query parameters (especially `node-id=`) as non-PII data.

## Environment

- Claude Code CLI
- Atlassian MCP plugin
- Figma MCP plugin

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Rechercherichtung

Reproduce the issue with getJiraIssue or fetch using a Jira ticket containing ?node-id=2006-14129, and compare the response with a source-code read of a .figma.tsx file. Trace the system-level PII filter and verify that Figma node IDs remain unchanged while phone-number sanitization still works across Atlassian MCP tool responses.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
python
Bereich
cli, security
Issue-Typ
Bug
Schwierigkeit
4/5
Geschätzter Aufwand
3-5 Tage
Aktivitätsstatus
Aktiv
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
55/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.