Skip to content

refactor(app): remove sensitive Authorization header logging from SteamableHttp MCP server #568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

refactor(app): remove sensitive Authorization header logging from SteamableHttp MCP server #568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion python/src/autogenstudio/database/db_manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
import json
import threading
from datetime import datetime, timedelta, date
from datetime import date, datetime, timedelta
from pathlib import Path
from typing import Optional, Union

Expand Down
10 changes: 9 additions & 1 deletion python/src/kagent/tool_servers/_streamable_http_mcp_tool_server.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ def __init__(self, config: StreamableHttpMcpToolServerConfig):

async def discover_tools(self) -> list[Component]:
try:
logger.debug(f"Discovering tools from streamable http server: {self.config}")
logger.debug(f"Discovering tools from streamable http server: {self._sanitize_config(self.config)}")
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice!

While you're in this code here -- there's a similar logging statement in the _ssemcptoolserver.py and _stdiomcptoolserver.py -- can you run that through the _sanitize_config as well?

tools = await mcp_server_tools(self.config)
return tools
except Exception as e:
Expand All @@ -32,3 +32,11 @@ def _to_config(self) -> StreamableHttpMcpToolServerConfig:
@classmethod
def _from_config(cls, config: StreamableHttpMcpToolServerConfig):
return cls(config)

@staticmethod
def _sanitize_config(config: StreamableHttpServerParams) -> dict:
config_dict = config.model_dump()
headers = config_dict.get("headers")
if headers and "Authorization" in headers:
headers["Authorization"] = "***REDACTED***"
return config_dict