From 35e51a50c1142666504aede78b6a69164531f443 Mon Sep 17 00:00:00 2001
From: Pavel Gorgulov <devcrocod@gmail.com>
Date: Mon, 3 Nov 2025 12:17:39 +0100
Subject: [PATCH] Fix security for logging in server (#360)

* Fix debug logging in the `createMessage` method to include message
count, `maxTokens`, `temperature`, and presence of a system prompt;
* Fix debug logging in the `createElicitation` method to show message
length and schema property count
* Added trace logging

## Motivation and Context
The full message was printed in the debug logs, which could contain
confidential information

## Breaking Changes
None

## Types of changes
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update

## Checklist
- [x] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [x] My code follows the repository's style guidelines
- [x] New and existing tests pass locally
- [x] I have added appropriate error handling
- [x] I have added or updated documentation as needed
---
 .../kotlin/sdk/server/ServerSession.kt         | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/kotlin-sdk-server/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/ServerSession.kt b/kotlin-sdk-server/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/ServerSession.kt
index 18cbf08..20524ad 100644
--- a/kotlin-sdk-server/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/ServerSession.kt
+++ b/kotlin-sdk-server/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/server/ServerSession.kt
@@ -107,7 +107,7 @@ public open class ServerSession(
      * @return The result of the ping request.
      * @throws IllegalStateException If for some reason the method is not supported or the connection is closed.
      */
-    public suspend fun ping(): EmptyRequestResult = request<EmptyRequestResult>(PingRequest())
+    public suspend fun ping(): EmptyRequestResult = request(PingRequest())
 
     /**
      * Creates a message using the server's sampling capability.
@@ -121,8 +121,12 @@ public open class ServerSession(
         params: CreateMessageRequest,
         options: RequestOptions? = null,
     ): CreateMessageResult {
-        logger.debug { "Creating message with params: $params" }
-        return request<CreateMessageResult>(params, options)
+        logger.debug {
+            "Creating message with ${params.messages.size} messages, maxTokens=${params.maxTokens}, " +
+                "temperature=${params.temperature}, systemPrompt=${if (params.systemPrompt != null) "present" else "absent"}"
+        }
+        logger.trace { "Full createMessage params: $params" }
+        return request(params, options)
     }
 
     /**
@@ -138,7 +142,7 @@ public open class ServerSession(
         options: RequestOptions? = null,
     ): ListRootsResult {
         logger.debug { "Listing roots with params: $params" }
-        return request<ListRootsResult>(ListRootsRequest(params), options)
+        return request(ListRootsRequest(params), options)
     }
 
     public suspend fun createElicitation(
@@ -146,7 +150,11 @@ public open class ServerSession(
         requestedSchema: RequestedSchema,
         options: RequestOptions? = null,
     ): CreateElicitationResult {
-        logger.debug { "Creating elicitation with message: $message" }
+        logger.debug {
+            "Creating elicitation with message length=${message.length}, " +
+                "schema properties count=${requestedSchema.properties.size}"
+        }
+        logger.trace { "Full elicitation message: $message, requestedSchema: $requestedSchema" }
         return request(CreateElicitationRequest(message, requestedSchema), options)
     }