[BUG] claude-in-chrome Tab Context prints full URLs of every tab, leaking credentials in query strings
Preflight Checklist
- [x] I have searched existing issues and this hasn't been reported yet
- [x] This is a single bug report (please file separate reports for different bugs)
- [x] I am using the latest version of Claude Code
What's Wrong?
claude-in-chrome tool results append a "Tab Context" footer listing the full URL of every tab in the MCP tab group. When any open tab's URL carries a credential in its query string, that credential is written into the session transcript on the next tool call — even a call targeting a different tab, and without the page ever being read.
During an API-key rotation, a data provider's key detail page used the pattern https://<provider>/apikey?api_key=<32-char key>. The next javascript_tool / navigate result printed that URL in Tab Context. The freshly created key had to be treated as burned and rotated again.
What Should Happen?
Credentials in URLs should not reach the transcript through tool metadata the model did not ask for.
Error Messages/Logs
Steps to Reproduce
- Open any page whose URL contains a credential-shaped query parameter (e.g.
?api_key=TEST_PLACEHOLDER) inside the MCP tab group. - Call any claude-in-chrome tool (e.g.
javascript_tool) on another tab in the group. - The result's Tab Context footer includes the full URL with the parameter value.
Claude Model
Opus
Is this a regression?
I don't know
Last Working Version
_No response_
Claude Code Version
2.1.270 (Claude Code)
Platform
Anthropic API
Operating System
macOS
Terminal/Shell
Non-interactive/CI environment
Additional Information
Asks
- Redact credential-shaped query parameters in Tab Context (
api_key,apikey,key,token,access_token,secret,password,sig,code, …), or print origin + path only. - Limit Tab Context to the tab a tool call targets, or make the all-tabs footer opt-in.
- Document the current behavior so users know to keep credential-bearing pages out of the MCP tab group.
Workaround in use
A dedicated Chrome profile for MCP work with no provider consoles; history.replaceState to strip the query before a tool returns (only helps once the tab is known to be dirty).
Related: #79411 (revoke Claude's access to a specific tab).