diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index da5e377b59c..c8ff4249f47 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -3,7 +3,14 @@
   "image": "mcr.microsoft.com/devcontainers/go:1-bookworm",
   "customizations": {
     "vscode": {
-      "extensions": ["golang.go", "GitHub.copilot-chat", "GitHub.copilot", "github.vscode-github-actions", "astro-build.astro-vscode", "DavidAnson.vscode-markdownlint"]
+      "extensions": [
+        "golang.go",
+        "GitHub.copilot-chat",
+        "GitHub.copilot",
+        "github.vscode-github-actions",
+        "astro-build.astro-vscode",
+        "DavidAnson.vscode-markdownlint"
+      ]
     },
     "codespaces": {
       "repositories": {
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index c26e3987640..e12a752d75e 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -393,8 +393,8 @@ jobs:
           PORT=3000
           
           # Set outputs for next steps
-          echo "safe_inputs_api_key=${API_KEY}" >> $GITHUB_OUTPUT
-          echo "safe_inputs_port=${PORT}" >> $GITHUB_OUTPUT
+          echo "safe_inputs_api_key=${API_KEY}" >> "$GITHUB_OUTPUT"
+          echo "safe_inputs_port=${PORT}" >> "$GITHUB_OUTPUT"
           
           echo "Safe Inputs MCP server will run on port ${PORT}"
           
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 2ba65675b95..879094b0eaf 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -840,8 +840,8 @@ jobs:
           PORT=3000
           
           # Set outputs for next steps
-          echo "safe_inputs_api_key=${API_KEY}" >> $GITHUB_OUTPUT
-          echo "safe_inputs_port=${PORT}" >> $GITHUB_OUTPUT
+          echo "safe_inputs_api_key=${API_KEY}" >> "$GITHUB_OUTPUT"
+          echo "safe_inputs_port=${PORT}" >> "$GITHUB_OUTPUT"
           
           echo "Safe Inputs MCP server will run on port ${PORT}"
           
diff --git a/.github/workflows/smoke-copilot-no-firewall.lock.yml b/.github/workflows/smoke-copilot-no-firewall.lock.yml
index e20c049f7af..b923258e4c9 100644
--- a/.github/workflows/smoke-copilot-no-firewall.lock.yml
+++ b/.github/workflows/smoke-copilot-no-firewall.lock.yml
@@ -478,8 +478,8 @@ jobs:
           PORT=3000
           
           # Set outputs for next steps
-          echo "safe_inputs_api_key=${API_KEY}" >> $GITHUB_OUTPUT
-          echo "safe_inputs_port=${PORT}" >> $GITHUB_OUTPUT
+          echo "safe_inputs_api_key=${API_KEY}" >> "$GITHUB_OUTPUT"
+          echo "safe_inputs_port=${PORT}" >> "$GITHUB_OUTPUT"
           
           echo "Safe Inputs MCP server will run on port ${PORT}"
           
diff --git a/.github/workflows/smoke-copilot-playwright.lock.yml b/.github/workflows/smoke-copilot-playwright.lock.yml
index ea970ec6805..09075886624 100644
--- a/.github/workflows/smoke-copilot-playwright.lock.yml
+++ b/.github/workflows/smoke-copilot-playwright.lock.yml
@@ -571,8 +571,8 @@ jobs:
           PORT=3000
           
           # Set outputs for next steps
-          echo "safe_inputs_api_key=${API_KEY}" >> $GITHUB_OUTPUT
-          echo "safe_inputs_port=${PORT}" >> $GITHUB_OUTPUT
+          echo "safe_inputs_api_key=${API_KEY}" >> "$GITHUB_OUTPUT"
+          echo "safe_inputs_port=${PORT}" >> "$GITHUB_OUTPUT"
           
           echo "Safe Inputs MCP server will run on port ${PORT}"
           
diff --git a/.github/workflows/smoke-copilot-safe-inputs.lock.yml b/.github/workflows/smoke-copilot-safe-inputs.lock.yml
index ca4237218d6..a74f1735e89 100644
--- a/.github/workflows/smoke-copilot-safe-inputs.lock.yml
+++ b/.github/workflows/smoke-copilot-safe-inputs.lock.yml
@@ -440,8 +440,8 @@ jobs:
           PORT=3000
           
           # Set outputs for next steps
-          echo "safe_inputs_api_key=${API_KEY}" >> $GITHUB_OUTPUT
-          echo "safe_inputs_port=${PORT}" >> $GITHUB_OUTPUT
+          echo "safe_inputs_api_key=${API_KEY}" >> "$GITHUB_OUTPUT"
+          echo "safe_inputs_port=${PORT}" >> "$GITHUB_OUTPUT"
           
           echo "Safe Inputs MCP server will run on port ${PORT}"
           
diff --git a/pkg/workflow/mcp_servers.go b/pkg/workflow/mcp_servers.go
index 3641ca5c498..f3e5e63893a 100644
--- a/pkg/workflow/mcp_servers.go
+++ b/pkg/workflow/mcp_servers.go
@@ -290,8 +290,8 @@ func (c *Compiler) generateMCPSetup(yaml *strings.Builder, tools map[string]any,
 		yaml.WriteString("          PORT=3000\n")
 		yaml.WriteString("          \n")
 		yaml.WriteString("          # Set outputs for next steps\n")
-		yaml.WriteString("          echo \"safe_inputs_api_key=${API_KEY}\" >> $GITHUB_OUTPUT\n")
-		yaml.WriteString("          echo \"safe_inputs_port=${PORT}\" >> $GITHUB_OUTPUT\n")
+		yaml.WriteString("          echo \"safe_inputs_api_key=${API_KEY}\" >> \"$GITHUB_OUTPUT\"\n")
+		yaml.WriteString("          echo \"safe_inputs_port=${PORT}\" >> \"$GITHUB_OUTPUT\"\n")
 		yaml.WriteString("          \n")
 		yaml.WriteString("          echo \"Safe Inputs MCP server will run on port ${PORT}\"\n")
 		yaml.WriteString("          \n")