Tool names easily exceed Claude Code's 64-character limit due to MD5 hash appending (#3528937) · Issues · project / mcp

Tool names easily exceed Claude Code's 64-character limit due to MD5 hash appending

>>> [!note] Migrated issue   Reported by: [askibinski](https://www.drupal.org/user/248999) >>> <h3 id="summary-problem-motivation">Problem/Motivation</h3> Not exactly a bug per se, but still annoying developement experience. But also I'm questioning the way that security is implemented here, however I parked those remarks in a comment here: <a href="https://git.drupalcode.org/project/mcp/-/work_items/3526963" class="drupalorg-gitlab-link">https://git.drupalcode.org/project/mcp/-/work_items/3526963</a>. Claude Code enforces a 64-character limit for MCP tool names, but the current MCP module's tool naming scheme can easily exceed this limit when combined with Claude Code's prefixing system. The issue occurs because: 1. The MCP module appends a 32-character MD5 hash to tool names in `src/Plugin/McpJsonRpc/ToolsList.php` at line 38: ```php name: $instance->getPluginId() . '_' . md5($tool->name), ``` 2. Claude Code adds its own prefix: `mcp__<server-name>__<tool-name>` 3. The combined length often exceeds Claude Code's 64-character limit</tool-name></server-name> This results in API errors like: <pre>API Error: 400 {"type":"error","error":{"type":"invalid_request_error","message":"tools.15.custom.name: String should have at most 64 characters"}}</pre>The docs currently state about the tool id: <blockquote>Tool IDs When the MCP module exposes tools to clients, it prefixes the tool name with the plugin ID and uses MD5 hash for security. In your executeTool() method, compare the incoming ID with the MD5 hash of your tool name.</blockquote> The MD5 hash generation happens in the `ToolsList::execute()` method where all available plugins are processed and their tool names are transformed using: <div class="codeblock"> <pre><?php $prefixizedTools = array_map(   fn($tool) => new Tool(     name: $instance->getPluginId() . '_' . md5($tool->name),     description: "Original name: $tool->name, Description: $tool->description",     inputSchema: $tool->inputSchema,   ),   $instanceTools ); ?></pre></div> The tool->name should already be unique but is set in code and can also be long. <h3 id="summary-steps-reproduce">Steps to reproduce</h3> 1. Create an MCP plugin with a plugin ID longer than ~20 characters 2. Add the MCP server to Claude Code CLI: `claude mcp add myserver -- /path/to/mcp-server-drupal --drupal-url=<a href="http://example.com">http://example.com</a>` 3. Try to use Claude Code 4. Observe the 64-character limit error The character budget breakdown: - `mcp__` = 5 characters (Claude Code prefix) - `<server-name>__` = variable (typically 7-15 characters) - ` <plugin-id>_` = variable (plugin ID + underscore) - `<md5-hash>` = 32 characters (always)</md5-hash></plugin-id></server-name> This leaves very little room for meaningful plugin IDs when using Claude Code. <h3 id="summary-proposed-resolution">Proposed resolution</h3> **Option 1: Shorten the hash** Replace the full 32-character MD5 hash with a shorter hash to provide more room for plugin IDs: <div class="codeblock"> <pre><?php name: $instance->getPluginId() . '_' . substr(md5($tool->name), 0, 8), ?></pre></div> This reduces the hash from 32 to 8 characters, providing 24 more characters for plugin IDs while maintaining reasonable collision resistance. **Option 2: Documentation improvement** At minimum, documenting the character limit constraint in the module documentation and provide guidelines for plugin ID naming. <h3 id="summary-remaining-tasks">Remaining tasks</h3> - [ ] Decide on the preferred solution approach - [ ] Implement the chosen solution - [ ] Update documentation with character limit guidance - [ ] Add tests to verify tool name length constraints - [ ] Consider backward compatibility if changing hash length <h3 id="summary-ui-changes">User interface changes</h3> None required. <h3 id="summary-api-changes">API changes</h3> If implementing Option 1: Tool names will have shorter hashes, but this should be backward compatible as tool names are internal identifiers which do not change. <h3 id="summary-data-model-changes">Data model changes</h3> None required. > Related issue: [Issue #3539318](https://www.drupal.org/node/3539318)

issue