anthropics / anthropics/claude-code

PII filter incorrectly sanitizes Figma node IDs in MCP tool responses

Aperta
#91,537 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
area:mcp area:security bug
Lingua principale
Python
Stelle
145k
Fork
23.1k
Metriche di merge delle PR
Metriche PR in attesa

Descrizione

## Bug Description

The system-level PII (phone number) filter is incorrectly sanitizing Figma node IDs returned from Atlassian/Jira MCP tool responses. Figma node IDs use a `XXXX-XXXXX` numeric format (e.g., `2006-14129`) which matches phone number patterns, causing them to be replaced with `PHONE_X` placeholders.

## Impact

This completely blocks design-to-code workflows where Jira tickets contain Figma URLs with node IDs. The node IDs are essential for navigating to specific design frames (e.g., VQA documentation, component specs).

## Reproduction

1. Have a Jira ticket with a Figma URL containing a node-id parameter (e.g., `?node-id=2006-14129`)
2. Use any Atlassian MCP tool to read the ticket (`getJiraIssue`, `fetch`, `searchJiraIssuesUsingJql`, `search`, etc.)
3. The node-id value is replaced with `PHONE_X` in the response

## Workarounds Attempted (All Failed)

- `getJiraIssue` with markdown format
- `getJiraIssue` with ADF format
- `getTeamworkGraphContext` (ExternalDesign filter + unfiltered)
- `getJiraIssueRemoteIssueLinks`
- `fetch` with ARI
- `searchJiraIssuesUsingJql`
- Rovo `search`

All return sanitized `PHONE_X` values because the filter operates on all tool output text regardless of the tool or format.

## Workaround That Works

Reading the same URLs from source code files (e.g., Figma Code Connect `.figma.tsx` files) is NOT affected, since the PII filter apparently does not apply to file reads. Short node IDs like `2-62` also survive the filter — only longer numeric patterns trigger it.

## Expected Behavior

Figma node IDs in URLs should not be treated as phone numbers. The filter should be context-aware enough to recognize URL query parameters (especially `node-id=`) as non-PII data.

## Environment

- Claude Code CLI
- Atlassian MCP plugin
- Figma MCP plugin

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Reproduce the issue with getJiraIssue or fetch using a Jira ticket containing ?node-id=2006-14129, and compare the response with a source-code read of a .figma.tsx file. Trace the system-level PII filter and verify that Figma node IDs remain unchanged while phone-number sanitization still works across Atlassian MCP tool responses.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
python
Ambito
cli, security
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Attiva
Chiarezza
Abbastanza chiara
Idoneità per principianti
55/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.