Skip to content

Commit d67877d

Browse files
claudeclaude
committed
docs(claude-code-web): the GitHub MCP mangles issue and PR text it returns
A tag-shaped token is deleted from any description or comment the MCP reads back — `<n>`, `<branch>`, `<sha>` — while a lone bracket returns as an entity and an allow-listed HTML tag survives. Worse, a token naming an HTML raw-text element (`<title>`, `<style>`) discards the entire remainder of the body, silently. Inline code, fenced blocks and table cells are mangled alike, so writing the text differently does not avoid it. The content on GitHub is intact: it renders correctly, arrives whole in a webhook payload, and comes back unaltered through get_file_contents. That matters more than the mangling itself, because the failure mode is an agent "correcting" a description that was never broken, or reading a truncated response as a truncated body. Verified against a description and comments posted from a session and a control comment typed by hand in the browser: both read back mangled, both render correctly. Reported upstream as github/github-mcp-server#2202 and deliberate per #3106, so the note says to expect it rather than re-derive it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015eAnpTMAAcbzVY6dQfr6JZ
1 parent 52a5266 commit d67877d

4 files changed

Lines changed: 19 additions & 4 deletions

File tree

‎.claude-plugin/marketplace.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
"name": "claude-code-web",
3434
"source": "./plugins/claude-code-web",
3535
"description": "Working preferences and hard constraints for Claude Code Web — the egress proxy and CA bundle, GitHub-via-MCP, containers that reboot around every turn while their disk persists, repo scoping and add_repo's cross-owner rule, project config in a multi-repo session, why repo-adopted plugins never load, why user-scope ones lag the marketplace and how a session updates them for its own next turn, and delegating unrunnable steps to CI. Environment-agnostic.",
36-
"version": "0.8.0"
36+
"version": "0.9.0"
3737
},
3838
{
3939
"name": "personal-cloud-environment",

‎plugins/claude-code-web/.claude-plugin/plugin.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "claude-code-web",
33
"description": "Working preferences and hard constraints for Claude Code Web — the browser/cloud sandbox — so a session works with its egress, tooling, repo-scoping, and CI-delegation realities instead of fighting them. Environment-agnostic; what any one environment is configured with belongs in a companion skill.",
4-
"version": "0.8.0",
4+
"version": "0.9.0",
55
"author": {
66
"name": "flungo"
77
}

‎plugins/claude-code-web/skills/cloud-sessions/SKILL.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ When you hit a fresh, reusable gotcha about the web environment, record it where
3838

3939
## The reference files
4040

41-
- **`references/egress-and-tooling.md`** — the egress proxy and its CA bundle, which registries and GitHub hosts work, why GitHub goes through the MCP rather than `gh`, how to run Terraform in a session, and why `sleep` is blocked.
42-
Read it before installing a tool, fetching a URL, hitting the GitHub API, or running Terraform.
41+
- **`references/egress-and-tooling.md`** — the egress proxy and its CA bundle, which registries and GitHub hosts work, why GitHub goes through the MCP rather than `gh`, what that MCP silently mangles when it reads issue and pull request text, how to run Terraform in a session, and why `sleep` is blocked.
42+
Read it before installing a tool, fetching a URL, hitting the GitHub API, acting on a description or comment it returned, or running Terraform.
4343
- **`references/sessions.md`** — the session shape: containers that reboot around every turn while their disk persists, repo scoping and what `add_repo` will and won't do, project config in a multi-repo session, why a repo's own plugins never load and how the user-scope ones arrive, why their versions lag the marketplace and how a session updates them for its own next turn, MCP servers that connect late, system-prompt restrictions on spawning subagents, and setting environment variables or secrets.
4444
Read it before adding a repo, relying on project config, setting an env var, dispatching a subagent, or acting on a plugin that looks stale.
4545
- **`references/ci-iteration.md`** — the pattern for anything the sandbox can't run: push the branch and iterate against CI, provision tokens first, and probe whether a restriction has lifted.

‎plugins/claude-code-web/skills/cloud-sessions/references/egress-and-tooling.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,21 @@ Re-probed 2026-07-29 for the download shapes: `/releases/download/…` → `200`
3333

3434
- **Use the GitHub MCP (`mcp__github__*`) for anything API-shaped** — PRs, issues, review threads, checks, workflow runs and dispatch.
3535
There is no `gh` CLI in web sessions, and `api.github.com` returns `403` through the proxy.
36+
- **What that MCP hands back for issue and pull request *text* is sanitised, and lossy.**
37+
A tag-shaped token is deleted outright — `<n>`, `<branch>` and `<sha>` all vanish — while a lone or unmatched bracket returns as `&lt;`/`&gt;` and an allow-listed HTML tag such as `<b>` survives intact.
38+
Markdown offers no protection: inline code, fenced and indented code blocks, and table cells are all mangled alike, so the pass runs over raw text before anything parses it.
39+
Worst of it, a token naming an HTML raw-text element — `<title>` and `<style>` both do it — **truncates the whole remainder of the body**, silently and with no error, wherever it appears.
40+
One incidental mention in a preamble is enough to discard everything after it.
41+
*Verified 2026-08-22 against a description and comments posted from a session, plus a control comment typed by hand in the browser — all read back mangled, all render correctly on the page.*
42+
- **The text on GitHub is fine; only this read path is not.**
43+
The same content renders correctly on the page, arrives intact in a webhook payload, and comes back unaltered through `get_file_contents` — so never rewrite a description or comment because an MCP read looks mangled or cut short.
44+
Check the rendered page with `WebFetch` first, and treat an apparently truncated body as unread rather than incomplete.
45+
The same loss applies to code quoted in a comment, so generics (`Vec<T>`, `List<String>`) can disappear from something you are reviewing.
46+
The one real exception: a tag-shaped token written as **bare prose**, outside backticks, is stored but does not render, because GitHub drops unknown tags at display time — which is the ordinary reason to put a placeholder in backticks, and nothing to do with the MCP.
47+
- **It is deliberate upstream, and known to be lossy.**
48+
The sanitising is applied on purpose to untrusted response fields — issue comments, pull request bodies, reviews, releases, commit messages — with a stated goal of preserving "source-code and file-content fidelity" ([github/github-mcp-server#3106](https://github.com/github/github-mcp-server/issues/3106)), which for body text it does not achieve.
49+
The symptom is reported in [github/github-mcp-server#2202](https://github.com/github/github-mcp-server/issues/2202), open since March 2026 and scoped narrower than what is described above — `issue_read` and fenced code blocks alone.
50+
So expect it to persist, and don't re-derive it as a local quirk.
3651
- **`git` over `github.com` works** for repositories in the session's scope (clone, fetch, push).
3752
- **Read public files with `WebFetch` against `raw.githubusercontent.com`** (`https://raw.githubusercontent.com/<owner>/<repo>/<branch>/<path>`) — this works unauthenticated, even for repositories outside the session's scope.
3853
- **Source archives for an out-of-scope repo are blocked; published release assets are not**.

0 commit comments

Comments
 (0)