You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
MCPArea: what it touches
Bug FixesKind: in v2.1.234,
Bug FixesSection of the release
What
The wrapper Claude Code builds around a resource fetched from an MCP server now escapes the server name and resource URI before putting them in the text, so a hostile name or URI cannot break out of the wrapper. The empty result case now comes from the same shared builder rather than a separate inline string.
Evidence
(No content)
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
