anthropics / anthropics/claude-code

[BUG] Valid MCP tool silently dropped: API schema validation rejects property names containing `[]`

Aperta
#92,648 1 commento 0 reazioni 0 assegnatari Vedi su GitHub
area:mcp bug platform:linux platform:vscode
Lingua principale
Python
Stelle
145k
Fork
23.1k
Metriche di merge delle PR
Metriche PR in attesa

Descrizione

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

## Summary

A tool from a spec-compliant MCP server is silently discarded at session start because its
input schema contains a property named `uids[]`. Tool schemas are validated against
`^[a-zA-Z0-9_.-]{1,64}$` for property keys, and the square brackets fail that pattern.

`uids[]` is a legal property name in JSON Schema — the spec places no constraints on the keys
of `properties` — and the MCP specification defines `inputSchema` as a JSON Schema object.
So the server is valid on both counts; the rejection comes from a stricter constraint layered
on top by the API. The result is that a working MCP server loses functionality with no
actionable error surfaced to the user.

## Environment

- Claude Code: 2.1.263 (VS Code extension)
- Platform: Linux 7.0.12-linuxkit (devcontainer), Node v24.19.0
- MCP server: `pushpad-mcp@0.1.1` (stdio, `npx -y pushpad-mcp`)
- Affected tool: `subscriptions_list`

## Reproduction

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

## Expected

`subscriptions_list` is available, like the server's other 18 tools.

## Actual

The tool is excluded before the model ever sees it. The only trace is an internal note:

```
- "subscriptions_list" (MCP server "pushpad"): "property key uids[] does not match /^[a-zA-Z0-9_.-]{1,64}$/"
```

## Root cause

`pushpad-mcp` is a generic OpenAPI-to-MCP bridge; it fetches `https://pushpad.xyz/openapi.yaml`
at startup and derives tools from it. The spec declares:

```yaml
uids:
in: query
name: uids[]
style: form
explode: true
schema:
type: array
items:
type: string
```

This is valid OpenAPI 3 and the standard way to express a repeated bracketed query parameter
(`?uids[]=a&uids[]=b`), the convention used by Rails, PHP, and many other backends. The bridge
maps the query-parameter name directly to a JSON Schema property name, yielding `uids[]`.

`subscriptions_list` is the only one of the spec's 19 operations that references a bracketed
parameter, which is exactly why it is the only tool dropped — the failure is entirely attributable
to the character class, not to anything else about the server.

## Impact

- Any OpenAPI-derived MCP server exposing bracket-style array query params loses those tools.
This is a widespread convention, so the blast radius is larger than one server.
- The failure is silent from the user's perspective. Nothing appears in the UI: the tool simply
does not exist, and the model can only report it as missing after the fact.
- There is no user-side remedy. Fixing it requires changing the upstream API's parameter naming
or patching the bridge — neither is available to someone who just installed the server.

## Suggested resolutions

Any one of these would resolve it:

1. **Relax the property-key pattern** to accept the characters JSON Schema permits, or at minimum
`[` and `]`. (**recommended**)
2. **Sanitize on the client side.** Rewrite non-conforming keys to a safe alias when registering
the tool, and map them back when invoking it. This keeps the constraint intact while preserving
compatibility with compliant servers.

### What Should Happen?

API schema validation should allow property names containing `[]`

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.263 (VS Code extension)

### Platform

Anthropic API

### Operating System

Other Linux

### Terminal/Shell

VS Code integrated terminal

### Additional Information

_No response_

Guida per i contributori

Nessuna guida per i contributori indicizzata per questo repository

Direzione di ricerca

Use the .mcp.json reproduction and trace API schema validation for the MCP inputSchema of subscriptions_list. Compare the property-name rule with the OpenAPI-derived uids[] parameter; done means the tool remains available and invocable, with coverage for bracketed property names and no regression in existing tool validation.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
node.js, openapi
Ambito
api, backend-api-design
Tipo di issue
Bug
Difficoltà
4/5
Tempo stimato
3-5 giorni
Stato di attività
Attiva
Chiarezza
Abbastanza chiara
Idoneità per principianti
42/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.