anthropics / anthropics/claude-code

[BUG] Valid MCP tool silently dropped: API schema validation rejects property names containing `[]`

未关闭
#92,648 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
area:mcp bug platform:linux platform:vscode
主要语言
Python
星标
145k
派生
23.1k
PR 合并指标
PR 指标待抓取

描述

### Preflight Checklist

- [x] I have searched [existing issues](https://github.com/anthropics/claude-code/issues?q=is%3Aissue%20state%3Aopen%20label%3Abug) and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code

### What's Wrong?

## Summary

A tool from a spec-compliant MCP server is silently discarded at session start because its
input schema contains a property named `uids[]`. Tool schemas are validated against
`^[a-zA-Z0-9_.-]{1,64}$` for property keys, and the square brackets fail that pattern.

`uids[]` is a legal property name in JSON Schema — the spec places no constraints on the keys
of `properties` — and the MCP specification defines `inputSchema` as a JSON Schema object.
So the server is valid on both counts; the rejection comes from a stricter constraint layered
on top by the API. The result is that a working MCP server loses functionality with no
actionable error surfaced to the user.

## Environment

- Claude Code: 2.1.263 (VS Code extension)
- Platform: Linux 7.0.12-linuxkit (devcontainer), Node v24.19.0
- MCP server: `pushpad-mcp@0.1.1` (stdio, `npx -y pushpad-mcp`)
- Affected tool: `subscriptions_list`

## Reproduction

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

## Expected

`subscriptions_list` is available, like the server's other 18 tools.

## Actual

The tool is excluded before the model ever sees it. The only trace is an internal note:

```
- "subscriptions_list" (MCP server "pushpad"): "property key uids[] does not match /^[a-zA-Z0-9_.-]{1,64}$/"
```

## Root cause

`pushpad-mcp` is a generic OpenAPI-to-MCP bridge; it fetches `https://pushpad.xyz/openapi.yaml`
at startup and derives tools from it. The spec declares:

```yaml
uids:
in: query
name: uids[]
style: form
explode: true
schema:
type: array
items:
type: string
```

This is valid OpenAPI 3 and the standard way to express a repeated bracketed query parameter
(`?uids[]=a&uids[]=b`), the convention used by Rails, PHP, and many other backends. The bridge
maps the query-parameter name directly to a JSON Schema property name, yielding `uids[]`.

`subscriptions_list` is the only one of the spec's 19 operations that references a bracketed
parameter, which is exactly why it is the only tool dropped — the failure is entirely attributable
to the character class, not to anything else about the server.

## Impact

- Any OpenAPI-derived MCP server exposing bracket-style array query params loses those tools.
This is a widespread convention, so the blast radius is larger than one server.
- The failure is silent from the user's perspective. Nothing appears in the UI: the tool simply
does not exist, and the model can only report it as missing after the fact.
- There is no user-side remedy. Fixing it requires changing the upstream API's parameter naming
or patching the bridge — neither is available to someone who just installed the server.

## Suggested resolutions

Any one of these would resolve it:

1. **Relax the property-key pattern** to accept the characters JSON Schema permits, or at minimum
`[` and `]`. (**recommended**)
2. **Sanitize on the client side.** Rewrite non-conforming keys to a safe alias when registering
the tool, and map them back when invoking it. This keeps the constraint intact while preserving
compatibility with compliant servers.

### What Should Happen?

API schema validation should allow property names containing `[]`

### Error Messages/Logs

```shell

```

### Steps to Reproduce

1. Configure the MCP server in `.mcp.json`:

```json
{
"mcpServers": {
"pushpad": {
"type": "stdio",
"command": "npx",
"args": ["-y", "pushpad-mcp"],
"env": { "PUSHPAD_TOKEN": "" }
}
}
}
```

2. Start a session and ask the model to list subscriptions for a project.

### Claude Model

None

### Is this a regression?

I don't know

### Last Working Version

_No response_

### Claude Code Version

2.1.263 (VS Code extension)

### Platform

Anthropic API

### Operating System

Other Linux

### Terminal/Shell

VS Code integrated terminal

### Additional Information

_No response_

贡献指南

这个仓库没有索引到贡献指南

调研方向

Use the .mcp.json reproduction and trace API schema validation for the MCP inputSchema of subscriptions_list. Compare the property-name rule with the OpenAPI-derived uids[] parameter; done means the tool remains available and invocable, with coverage for bracketed property names and no regression in existing tool validation.

由索引模型根据 Issue 内容生成。

评估

技术栈
node.js, openapi
领域
api, backend-api-design
Issue 类型
缺陷
难度
4/5
预计耗时
3-5 天
活跃度
活跃
描述清晰度
基本清楚
新手友好度
42/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。