anthropics / anthropics/claude-code

PII filter incorrectly sanitizes Figma node IDs in MCP tool responses

Abierto
#91,537 0 comentarios 0 reacciones 0 asignados Ver en GitHub
area:mcp area:security bug
Lenguaje dominante
Python
Estrellas
145k
Forks
23.1k
Métricas de merge de PR
Métricas de PR pendientes

Descripción

## Bug Description

The system-level PII (phone number) filter is incorrectly sanitizing Figma node IDs returned from Atlassian/Jira MCP tool responses. Figma node IDs use a `XXXX-XXXXX` numeric format (e.g., `2006-14129`) which matches phone number patterns, causing them to be replaced with `PHONE_X` placeholders.

## Impact

This completely blocks design-to-code workflows where Jira tickets contain Figma URLs with node IDs. The node IDs are essential for navigating to specific design frames (e.g., VQA documentation, component specs).

## Reproduction

1. Have a Jira ticket with a Figma URL containing a node-id parameter (e.g., `?node-id=2006-14129`)
2. Use any Atlassian MCP tool to read the ticket (`getJiraIssue`, `fetch`, `searchJiraIssuesUsingJql`, `search`, etc.)
3. The node-id value is replaced with `PHONE_X` in the response

## Workarounds Attempted (All Failed)

- `getJiraIssue` with markdown format
- `getJiraIssue` with ADF format
- `getTeamworkGraphContext` (ExternalDesign filter + unfiltered)
- `getJiraIssueRemoteIssueLinks`
- `fetch` with ARI
- `searchJiraIssuesUsingJql`
- Rovo `search`

All return sanitized `PHONE_X` values because the filter operates on all tool output text regardless of the tool or format.

## Workaround That Works

Reading the same URLs from source code files (e.g., Figma Code Connect `.figma.tsx` files) is NOT affected, since the PII filter apparently does not apply to file reads. Short node IDs like `2-62` also survive the filter — only longer numeric patterns trigger it.

## Expected Behavior

Figma node IDs in URLs should not be treated as phone numbers. The filter should be context-aware enough to recognize URL query parameters (especially `node-id=`) as non-PII data.

## Environment

- Claude Code CLI
- Atlassian MCP plugin
- Figma MCP plugin

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Línea de trabajo

Reproduce the issue with getJiraIssue or fetch using a Jira ticket containing ?node-id=2006-14129, and compare the response with a source-code read of a .figma.tsx file. Trace the system-level PII filter and verify that Figma node IDs remain unchanged while phone-number sanitization still works across Atlassian MCP tool responses.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
python
Área
cli, security
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Activo
Claridad
Bastante claro
Aptitud para principiantes
55/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.