mcpproxy: credential scrubber redacts SonarQube metric keys in proxied tool results #77
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Results from the proxied SonarQube MCP server come back with legitimate fields replaced by REDACTED. sonar_get_project_quality_gate_status returns conditions whose metricKey is shown as REDACTED for all three entries, the values being new_coverage, new_duplicated_lines_density and new_violations, while the thresholds and actual values pass through. The scrub step in internal/mcpproxy/scrub.go applies executor.Scrub with the server's resolved env to every text content block. Something in that pass matches those metric names, either a generic key-like pattern or the env-value matcher against a short value. Investigate which pattern fires, add a regression test with the real response shape, and narrow the pattern so ordinary identifiers survive while configured secret values and token-shaped strings are still removed. Related to the SonarQube cleanup in #73 since the triage reads these results.