anthropics / anthropics/claude-code

[BUG] Valid MCP tool silently dropped: API schema validation rejects property names containing `[]`

Abierto
#92,648 1 comentario 0 reacciones 0 asignados Ver en GitHub
area:mcp bug platform:linux platform:vscode
Lenguaje dominante
Python
Estrellas
145k
Forks
23.1k
Métricas de merge de PR
Métricas de PR pendientes

Descripción

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

## Summary

A tool from a spec-compliant MCP server is silently discarded at session start because its
input schema contains a property named `uids[]`. Tool schemas are validated against
`^[a-zA-Z0-9_.-]{1,64}$` for property keys, and the square brackets fail that pattern.

`uids[]` is a legal property name in JSON Schema — the spec places no constraints on the keys
of `properties` — and the MCP specification defines `inputSchema` as a JSON Schema object.
So the server is valid on both counts; the rejection comes from a stricter constraint layered
on top by the API. The result is that a working MCP server loses functionality with no
actionable error surfaced to the user.

## Environment

- Claude Code: 2.1.263 (VS Code extension)
- Platform: Linux 7.0.12-linuxkit (devcontainer), Node v24.19.0
- MCP server: `pushpad-mcp@0.1.1` (stdio, `npx -y pushpad-mcp`)
- Affected tool: `subscriptions_list`

## Reproduction

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

## Expected

`subscriptions_list` is available, like the server's other 18 tools.

## Actual

The tool is excluded before the model ever sees it. The only trace is an internal note:

```
- "subscriptions_list" (MCP server "pushpad"): "property key uids[] does not match /^[a-zA-Z0-9_.-]{1,64}$/"
```

## Root cause

`pushpad-mcp` is a generic OpenAPI-to-MCP bridge; it fetches `https://pushpad.xyz/openapi.yaml`
at startup and derives tools from it. The spec declares:

```yaml
uids:
in: query
name: uids[]
style: form
explode: true
schema:
type: array
items:
type: string
```

This is valid OpenAPI 3 and the standard way to express a repeated bracketed query parameter
(`?uids[]=a&uids[]=b`), the convention used by Rails, PHP, and many other backends. The bridge
maps the query-parameter name directly to a JSON Schema property name, yielding `uids[]`.

`subscriptions_list` is the only one of the spec's 19 operations that references a bracketed
parameter, which is exactly why it is the only tool dropped — the failure is entirely attributable
to the character class, not to anything else about the server.

## Impact

- Any OpenAPI-derived MCP server exposing bracket-style array query params loses those tools.
This is a widespread convention, so the blast radius is larger than one server.
- The failure is silent from the user's perspective. Nothing appears in the UI: the tool simply
does not exist, and the model can only report it as missing after the fact.
- There is no user-side remedy. Fixing it requires changing the upstream API's parameter naming
or patching the bridge — neither is available to someone who just installed the server.

## Suggested resolutions

Any one of these would resolve it:

1. **Relax the property-key pattern** to accept the characters JSON Schema permits, or at minimum
`[` and `]`. (**recommended**)
2. **Sanitize on the client side.** Rewrite non-conforming keys to a safe alias when registering
the tool, and map them back when invoking it. This keeps the constraint intact while preserving
compatibility with compliant servers.

### What Should Happen?

API schema validation should allow property names containing `[]`

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.263 (VS Code extension)

### Platform

Anthropic API

### Operating System

Other Linux

### Terminal/Shell

VS Code integrated terminal

### Additional Information

_No response_

Guía de contribución

No hay ninguna guía de contribución indexada para este repositorio

Línea de trabajo

Use the .mcp.json reproduction and trace API schema validation for the MCP inputSchema of subscriptions_list. Compare the property-name rule with the OpenAPI-derived uids[] parameter; done means the tool remains available and invocable, with coverage for bracketed property names and no regression in existing tool validation.

Escrito por el modelo de indexación a partir del texto del issue.

Evaluación

Stack tecnológico
node.js, openapi
Área
api, backend-api-design
Tipo de issue
Error
Dificultad
4/5
Tiempo estimado
3-5 días
Estado de actividad
Activo
Claridad
Bastante claro
Aptitud para principiantes
42/100

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.