anthropics / anthropics/claude-code
PII filter incorrectly sanitizes Figma node IDs in MCP tool responses
- 主要语言
- Python
- 星标
- 145k
- 派生
- 23.1k
- PR 合并指标
- PR 指标待抓取
描述
## Bug Description
The system-level PII (phone number) filter is incorrectly sanitizing Figma node IDs returned from Atlassian/Jira MCP tool responses. Figma node IDs use a `XXXX-XXXXX` numeric format (e.g., `2006-14129`) which matches phone number patterns, causing them to be replaced with `PHONE_X` placeholders.
## Impact
This completely blocks design-to-code workflows where Jira tickets contain Figma URLs with node IDs. The node IDs are essential for navigating to specific design frames (e.g., VQA documentation, component specs).
## Reproduction
1. Have a Jira ticket with a Figma URL containing a node-id parameter (e.g., `?node-id=2006-14129`)
2. Use any Atlassian MCP tool to read the ticket (`getJiraIssue`, `fetch`, `searchJiraIssuesUsingJql`, `search`, etc.)
3. The node-id value is replaced with `PHONE_X` in the response
## Workarounds Attempted (All Failed)
- `getJiraIssue` with markdown format
- `getJiraIssue` with ADF format
- `getTeamworkGraphContext` (ExternalDesign filter + unfiltered)
- `getJiraIssueRemoteIssueLinks`
- `fetch` with ARI
- `searchJiraIssuesUsingJql`
- Rovo `search`
All return sanitized `PHONE_X` values because the filter operates on all tool output text regardless of the tool or format.
## Workaround That Works
Reading the same URLs from source code files (e.g., Figma Code Connect `.figma.tsx` files) is NOT affected, since the PII filter apparently does not apply to file reads. Short node IDs like `2-62` also survive the filter — only longer numeric patterns trigger it.
## Expected Behavior
Figma node IDs in URLs should not be treated as phone numbers. The filter should be context-aware enough to recognize URL query parameters (especially `node-id=`) as non-PII data.
## Environment
- Claude Code CLI
- Atlassian MCP plugin
- Figma MCP plugin
贡献指南
这个仓库没有索引到贡献指南
调研方向
Reproduce the issue with getJiraIssue or fetch using a Jira ticket containing ?node-id=2006-14129, and compare the response with a source-code read of a .figma.tsx file. Trace the system-level PII filter and verify that Figma node IDs remain unchanged while phone-number sanitization still works across Atlassian MCP tool responses.
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- cli, security
- Issue 类型
- 缺陷
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 活跃度
- 活跃
- 描述清晰度
- 基本清楚
- 新手友好度
- 55/100