anthropics / anthropics/claude-code

[BUG] Valid MCP tool silently dropped: API schema validation rejects property names containing `[]`

オープン
#92,648 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
area:mcp bug platform:linux platform:vscode
主要言語
Python
スター
145k
フォーク
23.1k
PR マージ指標
PR 指標を取得中

説明

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

## Summary

A tool from a spec-compliant MCP server is silently discarded at session start because its
input schema contains a property named `uids[]`. Tool schemas are validated against
`^[a-zA-Z0-9_.-]{1,64}$` for property keys, and the square brackets fail that pattern.

`uids[]` is a legal property name in JSON Schema — the spec places no constraints on the keys
of `properties` — and the MCP specification defines `inputSchema` as a JSON Schema object.
So the server is valid on both counts; the rejection comes from a stricter constraint layered
on top by the API. The result is that a working MCP server loses functionality with no
actionable error surfaced to the user.

## Environment

- Claude Code: 2.1.263 (VS Code extension)
- Platform: Linux 7.0.12-linuxkit (devcontainer), Node v24.19.0
- MCP server: `pushpad-mcp@0.1.1` (stdio, `npx -y pushpad-mcp`)
- Affected tool: `subscriptions_list`

## Reproduction

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

## Expected

`subscriptions_list` is available, like the server's other 18 tools.

## Actual

The tool is excluded before the model ever sees it. The only trace is an internal note:

```
- "subscriptions_list" (MCP server "pushpad"): "property key uids[] does not match /^[a-zA-Z0-9_.-]{1,64}$/"
```

## Root cause

`pushpad-mcp` is a generic OpenAPI-to-MCP bridge; it fetches `https://pushpad.xyz/openapi.yaml`
at startup and derives tools from it. The spec declares:

```yaml
uids:
in: query
name: uids[]
style: form
explode: true
schema:
type: array
items:
type: string
```

This is valid OpenAPI 3 and the standard way to express a repeated bracketed query parameter
(`?uids[]=a&uids[]=b`), the convention used by Rails, PHP, and many other backends. The bridge
maps the query-parameter name directly to a JSON Schema property name, yielding `uids[]`.

`subscriptions_list` is the only one of the spec's 19 operations that references a bracketed
parameter, which is exactly why it is the only tool dropped — the failure is entirely attributable
to the character class, not to anything else about the server.

## Impact

- Any OpenAPI-derived MCP server exposing bracket-style array query params loses those tools.
This is a widespread convention, so the blast radius is larger than one server.
- The failure is silent from the user's perspective. Nothing appears in the UI: the tool simply
does not exist, and the model can only report it as missing after the fact.
- There is no user-side remedy. Fixing it requires changing the upstream API's parameter naming
or patching the bridge — neither is available to someone who just installed the server.

## Suggested resolutions

Any one of these would resolve it:

1. **Relax the property-key pattern** to accept the characters JSON Schema permits, or at minimum
`[` and `]`. (**recommended**)
2. **Sanitize on the client side.** Rewrite non-conforming keys to a safe alias when registering
the tool, and map them back when invoking it. This keeps the constraint intact while preserving
compatibility with compliant servers.

### What Should Happen?

API schema validation should allow property names containing `[]`

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.263 (VS Code extension)

### Platform

Anthropic API

### Operating System

Other Linux

### Terminal/Shell

VS Code integrated terminal

### Additional Information

_No response_

コントリビューションガイド

このリポジトリのコントリビューションガイドは索引されていません

調査の方向性

Use the .mcp.json reproduction and trace API schema validation for the MCP inputSchema of subscriptions_list. Compare the property-name rule with the OpenAPI-derived uids[] parameter; done means the tool remains available and invocable, with coverage for bracketed property names and no regression in existing tool validation.

索引モデルが issue の本文から書いたものです。

評価

技術スタック
node.js, openapi
領域
api, backend-api-design
issue の種類
バグ
難易度
4/5
見積もり時間
3〜5日
活発さ
活発
明瞭さ
おおむね明確
初心者へのやさしさ
42/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。