fix(attachments): strip MIME parameters

internal/mcpserver/server_test.go

@@ -131,3 +131,8 @@ func TestWorkspaceInfoDoesNotEchoToken(t *testing.T) {
 	require.NotContains(t, text.Text, "X-API-Key")
 	require.Contains(t, text.Text, "ws")
 }
+
+func TestAttachmentMimeTypeStripsParameters(t *testing.T) {
+	require.Equal(t, "text/plain", attachmentMimeType("notes.txt"))
+	require.Equal(t, "application/octet-stream", attachmentMimeType("archive.unknownext"))
+}

internal/mcpserver/tools_attachments.go

@@ -135,10 +135,7 @@ func (s *Server) handleAttachmentUpload(ctx context.Context, req mcp.CallToolReq
 	}
 	size := info.Size()
 
-	mimeType := mime.TypeByExtension(filepath.Ext(path))
-	if mimeType == "" {
-		mimeType = "application/octet-stream"
-	}
+	mimeType := attachmentMimeType(path)
 
 	init, err := s.client.InitAttachmentUpload(ctx, projectID, issueID, displayName, &mimeType, &size)
 	if err != nil {
@@ -149,7 +146,7 @@ func (s *Server) handleAttachmentUpload(ctx context.Context, req mcp.CallToolReq
 		return mcp.NewToolResultErrorFromErr("init payload", err), nil
 	}
 
-	f, err := os.Open(path) //nolint:gosec // path is supplied by an MCP caller with file-system trust.
+	f, err := os.Open(path) // #nosec G304 -- path is supplied by an MCP caller with file-system trust.
 	if err != nil {
 		return mcp.NewToolResultErrorf("open file: %v", err), nil
 	}
@@ -227,6 +224,18 @@ func (s *Server) handleAttachmentRead(ctx context.Context, req mcp.CallToolReque
 	return asTextResult(out)
 }
 
+func attachmentMimeType(path string) string {
+	mimeType := mime.TypeByExtension(filepath.Ext(path))
+	if mimeType == "" {
+		return "application/octet-stream"
+	}
+	mediaType, _, err := mime.ParseMediaType(mimeType)
+	if err != nil || mediaType == "" {
+		return mimeType
+	}
+	return mediaType
+}
+
 func parseInitPayload(init map[string]any) (assetID, uploadURL string, fields map[string]string, err error) {
 	if v, ok := init["id"].(string); ok && v != "" {
 		assetID = v