Don't redact MCP tool output (trusted integrations) - #1992
Merged
Aaronontheweb merged 2 commits intoAug 18, 2026
Conversation
Aaronontheweb
force-pushed
the
fix/mcp-output-not-redacted
branch
from
August 18, 2026 18:26
ba42d3a to
bc18f28
Compare
MCP servers are trusted extensions the operator explicitly added and granted; the model only reaches them because they were configured, and every other MCP harness (Claude Code, Cursor, ...) passes their results to the model verbatim. McpToolAdapter inherited SuppressOutputRedaction=false, so SecretOutputRedactor ran on MCP output and corrupted legitimate payloads whose content looks credential-like — e.g. presigned upload URLs (X-Amz-Signature / X-Amz-Credential query params), which came back redacted and unusable. Override SuppressOutputRedaction => true on McpToolAdapter so MCP output flows to the model unmodified. Redaction stays on for genuinely-untrusted sources (shell, file reads, web fetch, background jobs). Tests: a unit test on the adapter flag, plus an end-to-end DispatchingToolExecutor test that runs a presigned URL through an MCP adapter and asserts the credential survives to the model — with a guard asserting SecretOutputRedactor would otherwise strip it.
Aaronontheweb
force-pushed
the
fix/mcp-output-not-redacted
branch
from
August 18, 2026 19:35
e4f0845 to
73a4507
Compare
Aaronontheweb
enabled auto-merge (squash)
August 18, 2026 20:08
Aaronontheweb
disabled auto-merge
August 18, 2026 20:09
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
MCP servers are trusted, user-configured integrations — the model can only call them because the operator added and granted them — and every other MCP harness (Claude Code, Cursor, …) passes their output to the model verbatim.
McpToolAdapterdidn't overrideSuppressOutputRedaction, so it inherited thefalsedefault andSecretOutputRedactorran on MCP results. That corrupts legitimate payloads whose content looks credential-like — most notably presigned upload URLs (theX-Amz-Signature/X-Amz-Credentialquery params), which came back***REDACTED***and unusable, silently breaking a standard MCP upload pattern that works in every other harness.This overrides
SuppressOutputRedaction => trueonMcpToolAdapterso MCP output flows to the model unmodified. Redaction stays fully on for genuinely-untrusted sources (shell, file reads, web fetch, background-job tails). Adds a unit test.Security posture: treats MCP servers as trusted-by-configuration (matching the ecosystem). MCP tool calls remain gated by the existing grant/approval system; only the output-redaction step changes.