{"version":"2.1.248","anchor":"untrusted-names-escaped-across-mcp-and-config-messages","canonical_anchor":"untrusted-names-escaped-across-mcp-and-config-messages","heading":"Untrusted names escaped across MCP and config messages","tier":"notice","area":"MCP","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/untrusted-names-escaped-across-mcp-and-config-messages","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Untrusted names escaped across MCP and config messages\n\nMCP and config error messages now escape server names and inputs before printing them.\n\n**What**\n\nMore user-facing messages now escape values before printing them: MCP reconnect notices and the managed-policy block message quote the server name through a helper, and a config parse error shows the escaped input rather than the raw token. The MCP stale-entry hint is only appended if the whole message stays within 1024 characters, otherwise the plain message is shown.\n\n**Details**\n\n- The stale advice text about `\/mcp enable` and `\/mcp disable` moved from a fixed string to a lookup.\n\n**Evidence**\n\n`Expected key=value, got`, `was disabled in another session \u2014 disable and re-enable it in \/mcp, or restart, to reconnect`\n\n- Area: MCP\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}