From 04ea84241ce688e89053b104ebcdadc9316e656a Mon Sep 17 00:00:00 2001 From: Rommy <255708385+cosmic-fire-eng@users.noreply.github.com> Date: Fri, 19 Jun 2026 18:47:37 +0000 Subject: [PATCH] fix(stdio): redact config values in "Configuration loaded" log On stdio startup the generated bootstrap logged the full parsed config object to stderr. When a server's config schema carries credentials, those secrets are written in plaintext to every sink that captures the process stderr (systemd/journald, docker logs, log shippers). Log only the config keys, which still satisfies the "what did I parse" diagnostic this line exists for. Co-Authored-By: Claude Opus 4.8 (1M context) --- src/runtime/stdio-bootstrap.ts | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/runtime/stdio-bootstrap.ts b/src/runtime/stdio-bootstrap.ts index d2256572..8aede87e 100644 --- a/src/runtime/stdio-bootstrap.ts +++ b/src/runtime/stdio-bootstrap.ts @@ -167,7 +167,12 @@ async function startMcpServer() { typeof config === "object" && Object.keys(config as Record).length > 0 ) { - logger.info({ config }, "Configuration loaded") + // config commonly carries secrets (e.g. API keys, passwords) and this + // logger writes to stderr, so log only the keys, never the values. + logger.info( + { configKeys: Object.keys(config as Record) }, + "Configuration loaded", + ) } } catch (error) { logger.error({ error }, "Failed to start MCP server")