The Wire · Showcase
CLAUDE CODE ACTION PARSER MISALIGNMENT SILENTLY BREAKS TOOL GRANTS
By RepoJournal · Filed · About Anthropic
Two independent parsers in claude-code-action disagree on how to read tool flags, causing MCP servers to install correctly while the tools actually granted to Claude collapse to useless barewords.
The parser that decides which GitHub MCP servers to install [1] uses hand-rolled regex, while the parser that builds the tools actually granted to Claude [2] uses shell-quote's full shell tokenizer. They diverge on two input patterns: multiple values after a single flag and unquoted Bash pattern rules like `Bash(gh:*)` [1]. The shell-quote parser treats unquoted parentheses as control operators and barewords with `*` as glob operations, then strips all non-string objects, collapsing `--allowedTools View,Bash(gh:*),Bash(cat:*)` silently to bare `Bash` [2]. This means users who follow the documentation and omit quotes get the wrong tools, while the installation logs look fine. Both issues are patched in PRs 1373 and 1350 [3][4], with the base-action sync following in claude-code-base-action [5]. Meanwhile, claude-plugins-community shipped automated SHA-freshness automation [6][7][8] to keep pinned sources from drifting, and claude-plugins-official continues rolling validated SHAs for hyperframes, neon, sumup, carta-crm, and qdrant-skills [9][10][11][12][13].
Action items
- → Review and merge PR 1373 and PR 1350 to align the two parsers before next deploy anthropics/claude-code-action [immediate]
- → Pull the parser fix from base-action sync into any dependent workflows anthropics/claude-code-base-action [immediate]
- → Review the five plugin SHA bumps in official marketplace (all pre-validated) anthropics/claude-plugins-official [plan]
References
- [1] fix(mcp): align allowed-tools parser with SDK option parser ↗ anthropics/claude-code-action
- [2] fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash ↗ anthropics/claude-code-action
- [3] fix(mcp): align allowed-tools parser with SDK option parser (#1373) anthropics/claude-code-action
- [4] fix(parse-sdk-options): prevent shell-quote from collapsing unquoted Bash(X:*) rules to bare Bash (#1350) anthropics/claude-code-action
- [5] Sync from claude-code-action base-action@a5e5d3b anthropics/claude-code-base-action
- [6] Automated SHA-freshness: in-repo bump + validate-gated auto-revert ↗ anthropics/claude-plugins-community
- [7] chore: bump community plugin SHAs to current upstream HEAD ↗ anthropics/claude-plugins-community
- [8] Automated SHA-freshness: in-repo bump + validate-gated workflows (#70) anthropics/claude-plugins-community
- [9] bump(hyperframes): fbc3cdf2 → a241f259 ↗ anthropics/claude-plugins-official
- [10] bump(neon): 03fbe572 → 7c3839a1 ↗ anthropics/claude-plugins-official
- [11] bump(sumup): 5b9b2d72 → b69ff6f5 ↗ anthropics/claude-plugins-official
- [12] bump(carta-crm): fd503bbc → 9de95825 ↗ anthropics/claude-plugins-official
- [13] bump(qdrant-skills): 0814a087 → 80f1980d ↗ anthropics/claude-plugins-official
FAQ
- What changed in Anthropic on June 14, 2026?
- Two independent parsers in claude-code-action disagree on how to read tool flags, causing MCP servers to install correctly while the tools actually granted to Claude collapse to useless barewords.
- What should Anthropic teams do about it?
- Review and merge PR 1373 and PR 1350 to align the two parsers before next deploy • Pull the parser fix from base-action sync into any dependent workflows • Review the five plugin SHA bumps in official marketplace (all pre-validated)
- Which Anthropic repositories shipped on June 14, 2026?
- anthropics/claude-code-action, anthropics/claude-code-base-action, anthropics/claude-plugins-community, anthropics/claude-plugins-official