Fix security for logging in server (#360)

* Fix debug logging in the `createMessage` method to include message
count, `maxTokens`, `temperature`, and presence of a system prompt;
* Fix debug logging in the `createElicitation` method to show message
length and schema property count
* Added trace logging

## Motivation and Context
The full message was printed in the debug logs, which could contain
confidential information

## Breaking Changes
None

## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
This commit is contained in:
Pavel Gorgulov 2025-11-03 12:17:39 +01:00 • committed by GitHub
commit 35e51a50c1
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -107,7 +107,7 @@ public open class ServerSession(
* @return The result of the ping request.
* @throws IllegalStateException If for some reason the method is not supported or the connection is closed.
*/
public suspend fun ping(): EmptyRequestResult = request<EmptyRequestResult>(PingRequest())
public suspend fun ping(): EmptyRequestResult = request(PingRequest())
/**
* Creates a message using the server's sampling capability.
@ -121,8 +121,12 @@ public open class ServerSession(
params: CreateMessageRequest,
options: RequestOptions? = null,
): CreateMessageResult {
logger.debug { "Creating message with params: $params" }
return request<CreateMessageResult>(params, options)
logger.debug {
"Creating message with ${params.messages.size} messages, maxTokens=${params.maxTokens}, " +
"temperature=${params.temperature}, systemPrompt=${if (params.systemPrompt != null) "present" else "absent"}"
}
logger.trace { "Full createMessage params: $params" }
return request(params, options)
}
/**
@ -138,7 +142,7 @@ public open class ServerSession(
options: RequestOptions? = null,
): ListRootsResult {
logger.debug { "Listing roots with params: $params" }
return request<ListRootsResult>(ListRootsRequest(params), options)
return request(ListRootsRequest(params), options)
}
public suspend fun createElicitation(
@ -146,7 +150,11 @@ public open class ServerSession(
requestedSchema: RequestedSchema,
options: RequestOptions? = null,
): CreateElicitationResult {
logger.debug { "Creating elicitation with message: $message" }
logger.debug {
"Creating elicitation with message length=${message.length}, " +
"schema properties count=${requestedSchema.properties.size}"
}
logger.trace { "Full elicitation message: $message, requestedSchema: $requestedSchema" }
return request(CreateElicitationRequest(message, requestedSchema), options)
}