Skip to content

Sanitize sensitive data in all log outputs #878

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lpcox merged 2 commits into from
Feb 10, 2026
Merged

Sanitize sensitive data in all log outputs #878

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
99643d3
Initial plan
Claude Feb 10, 2026
1a0a549
Sanitize all log outputs to prevent auth token exposure
Claude Feb 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 1 addition & 5 deletions internal/launcher/log_helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,11 +54,7 @@ func (l *Launcher) logEnvPassthrough(args []string) {
if !strings.Contains(nextArg, "=") {
// This is a passthrough variable, check if it exists in our environment
if val := os.Getenv(nextArg); val != "" {
displayVal := val
if len(val) > 10 {
displayVal = val[:10] + "..."
}
log.Printf("[LAUNCHER] ✓ Env passthrough: %s=%s (from MCPG process)", nextArg, displayVal)
log.Printf("[LAUNCHER] ✓ Env passthrough: %s=%s (from MCPG process)", nextArg, sanitize.TruncateSecret(val))
} else {
log.Printf("[LAUNCHER] ✗ WARNING: Env passthrough for %s requested but NOT FOUND in MCPG process", nextArg)
}
Expand Down
10 changes: 6 additions & 4 deletions internal/mcp/connection.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -212,8 +212,9 @@ func NewConnection(ctx context.Context, serverID, command string, args []string,
scanner := bufio.NewScanner(stderrPipeReader)
for scanner.Scan() {
line := scanner.Text()
logger.LogInfoWithServer(serverID, "backend", "[stderr] %s", line)
logConn.Printf("[%s stderr] %s", serverID, line)
sanitizedLine := sanitize.SanitizeString(line)
logger.LogInfoWithServer(serverID, "backend", "[stderr] %s", sanitizedLine)
logConn.Printf("[%s stderr] %s", serverID, sanitizedLine)
}
}()

Expand All @@ -239,9 +240,10 @@ func NewConnection(ctx context.Context, serverID, command string, args []string,
// Log captured stderr output from the container/process
stderrOutput := strings.TrimSpace(stderrBuf.String())
if stderrOutput != "" {
logger.LogErrorMd("backend", "MCP backend stderr output:\n%s", stderrOutput)
sanitizedStderr := sanitize.SanitizeString(stderrOutput)
logger.LogErrorMd("backend", "MCP backend stderr output:\n%s", sanitizedStderr)
log.Printf(" 📋 Container/Process stderr output:")
for _, line := range strings.Split(stderrOutput, "\n") {
for _, line := range strings.Split(sanitizedStderr, "\n") {
log.Printf(" %s", line)
}
}
Expand Down
10 changes: 7 additions & 3 deletions internal/server/http_helpers.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (

"github.com/github/gh-aw-mcpg/internal/auth"
"github.com/github/gh-aw-mcpg/internal/logger"
"github.com/github/gh-aw-mcpg/internal/logger/sanitize"
"github.com/github/gh-aw-mcpg/internal/mcp"
)

Expand Down Expand Up @@ -52,13 +53,16 @@ func logHTTPRequestBody(r *http.Request, sessionID, backendID string) {

logHelpers.Printf("Request body read: size=%d bytes, sessionID=%s, backendID=%s", len(bodyBytes), sessionID, backendID)

// Sanitize the body before logging
sanitizedBody := sanitize.SanitizeString(string(bodyBytes))

// Log with backend context if provided (routed mode)
if backendID != "" {
logger.LogDebug("client", "MCP client request body, backend=%s, body=%s", backendID, string(bodyBytes))
logger.LogDebug("client", "MCP client request body, backend=%s, body=%s", backendID, sanitizedBody)
} else {
logger.LogDebug("client", "MCP request body, session=%s, body=%s", sessionID, string(bodyBytes))
logger.LogDebug("client", "MCP request body, session=%s, body=%s", sessionID, sanitizedBody)
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The session ID is being logged without sanitization. Session IDs can be API keys or authentication tokens and should be truncated using sanitize.TruncateSecret() before logging to prevent credential exposure in log files. This is inconsistent with the session ID logging in transport.go line 91 which correctly uses sanitize.TruncateSecret(sessionID).

Copilot uses AI. Check for mistakes.
}
log.Printf("Request body: %s", string(bodyBytes))
log.Printf("Request body: %s", sanitizedBody)

// Restore body for subsequent reads
r.Body = io.NopCloser(bytes.NewBuffer(bodyBytes))
Expand Down
6 changes: 4 additions & 2 deletions internal/server/transport.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ import (
"time"

"github.com/github/gh-aw-mcpg/internal/logger"
"github.com/github/gh-aw-mcpg/internal/logger/sanitize"
sdk "github.com/modelcontextprotocol/go-sdk/mcp"
)

Expand Down Expand Up @@ -49,7 +50,8 @@ func withResponseLogging(handler http.Handler) http.Handler {
lw := newResponseWriter(w)
handler.ServeHTTP(lw, r)
if len(lw.Body()) > 0 {
log.Printf("[%s] %s %s - Status: %d, Response: %s", r.RemoteAddr, r.Method, r.URL.Path, lw.StatusCode(), string(lw.Body()))
sanitizedBody := sanitize.SanitizeString(string(lw.Body()))
log.Printf("[%s] %s %s - Status: %d, Response: %s", r.RemoteAddr, r.Method, r.URL.Path, lw.StatusCode(), sanitizedBody)
}
})
}
Expand Down Expand Up @@ -86,7 +88,7 @@ func CreateHTTPServerForMCP(addr string, unifiedServer *UnifiedServer, apiKey st
logger.LogInfo("client", "MCP connection established, remote=%s, method=%s, path=%s, session=%s", r.RemoteAddr, r.Method, r.URL.Path, sessionID)
log.Printf("=== NEW STREAMABLE HTTP CONNECTION ===")
log.Printf("[%s] %s %s", r.RemoteAddr, r.Method, r.URL.Path)
log.Printf("Authorization (Session ID): %s", sessionID)
log.Printf("Authorization (Session ID): %s", sanitize.TruncateSecret(sessionID))

log.Printf("DEBUG: About to check request body, Method=%s, Body!=nil: %v", r.Method, r.Body != nil)

Expand Down
10 changes: 7 additions & 3 deletions internal/server/unified.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,7 @@ import (
"github.com/github/gh-aw-mcpg/internal/guard"
"github.com/github/gh-aw-mcpg/internal/launcher"
"github.com/github/gh-aw-mcpg/internal/logger"
"github.com/github/gh-aw-mcpg/internal/logger/sanitize"
"github.com/github/gh-aw-mcpg/internal/mcp"
"github.com/github/gh-aw-mcpg/internal/middleware"
"github.com/github/gh-aw-mcpg/internal/sys"
Expand Down Expand Up @@ -326,7 +327,8 @@ func (us *UnifiedServer) registerToolsFromBackend(serverID string) error {
// Log the MCP tool call request
sessionID := us.getSessionID(ctx)
argsJSON, _ := json.Marshal(toolArgs)
logger.LogInfo("client", "MCP tool call request, session=%s, tool=%s, args=%s", sessionID, toolNameCopy, string(argsJSON))
sanitizedArgs := sanitize.SanitizeString(string(argsJSON))
logger.LogInfo("client", "MCP tool call request, session=%s, tool=%s, args=%s", sessionID, toolNameCopy, sanitizedArgs)
Copy link

Copilot AI Feb 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The session ID is being logged without sanitization. Session IDs can be API keys or authentication tokens and should be truncated using sanitize.TruncateSecret() before logging to prevent credential exposure in log files. This is inconsistent with the session ID logging in transport.go line 91 which correctly uses sanitize.TruncateSecret(sessionID).

This issue also appears in the following locations of the same file:

  • line 347
  • line 447

Copilot uses AI. Check for mistakes.

// Check session is initialized
if err := us.requireSession(ctx); err != nil {
Expand All @@ -341,7 +343,8 @@ func (us *UnifiedServer) registerToolsFromBackend(serverID string) error {
logger.LogError("client", "MCP tool call error, session=%s, tool=%s, error=%v", sessionID, toolNameCopy, err)
} else {
resultJSON, _ := json.Marshal(data)
logger.LogInfo("client", "MCP tool call response, session=%s, tool=%s, result=%s", sessionID, toolNameCopy, string(resultJSON))
sanitizedResult := sanitize.SanitizeString(string(resultJSON))
logger.LogInfo("client", "MCP tool call response, session=%s, tool=%s, result=%s", sessionID, toolNameCopy, sanitizedResult)
}

return result, data, err
Expand Down Expand Up @@ -440,7 +443,8 @@ func (us *UnifiedServer) registerSysTools() error {
}

resultJSON, _ := json.Marshal(result)
logger.LogInfo("client", "MCP session initialization complete, session=%s, result=%s", sessionID, string(resultJSON))
sanitizedResult := sanitize.SanitizeString(string(resultJSON))
logger.LogInfo("client", "MCP session initialization complete, session=%s, result=%s", sessionID, sanitizedResult)
return nil, result, nil
}

Expand Down
Loading