[nissa-seru]

No error a host's own call to agent-framework gets, whether thrown, rejected with or in an error answer's data, now carries a credential the framework replaces in its records, whoever wrote its words. A server's words are redacted where an error is built from them, then bounded, and the strings in an error answer's data are redacted. A library's error is handed on as its name and its redacted words, with a failed stdio launch's code. A failed legacy handshake's stderr tail goes to the host redacted, and the record of an answer that came after its deadline is redacted as an on-time answer's is.

Problem

A server's configuration holds credentials: a url's userinfo, credential-like path segments and query values, a static or provided token, a stdio server's credential-named env values. redactServerText replaces them, and the framework runs it over its own records: log lines, traces and alerts. Its doc ended "JSON-RPC answers, and the error a host's own connect raises, pass as they are". Errors a host's call got, and through a host an agent, could carry them:

• A server's words, cut before they were redacted. The legacy initialize error, a refusal of the protocol revision, and both engines' error answers kept the server's words cut to 200 code points, with control characters replaced (boundedForLog). The framework's records then redacted that cut text, and so did the text an agent's tool call gets back. On main 6345d27d, a stdio server whose error words quote its own credential-named env value:
  • with the credential across the cut, the connect-failure trace keeps its first 15 characters, …xxxKq7vR2mXp9LwT4s…, and so does the agent's result from executeToolCall;
  • with the credential holding a TAB, both keep it changed, Kq7vR2mXp9?LwT4sB8nYd.
• The caller of a connection got the server's words unredacted: an error answer's words, and its data verbatim. So did a refusal of the protocol revision, with its data and the list of revisions it supports, the revision a legacy server answered initialize with, and a legacy tools/list's cursor in its errors.
• A failed legacy handshake's stderrTail, the end of the server's stderr, went on the error as written. It was also cut to its last 2,048 characters before anything redacted it, so a credential at the cut kept a fragment the records' redaction couldn't match.
• A modern connection's failed connect handed the host the SDK's error as raised. Its message can quote the url: an HTTP 404 body echoes the path. Another runtime's fetch error can carry the url elsewhere: under Bun 1.4.3 a refused fetch's error has it in path, credential-like segment and query included. A wrapper can keep the raw error as its cause.
• An error answer's words were trimmed before they were redacted, so a credential that ends in a space, at the end of the words, no longer matched.
• McplUnreapedLaunchError printed its connection, configuration and credentials included, wherever the error was inspected.
• The record of a late answer was never redacted. A tools/call or push/render answer that comes after its deadline is recorded as mcpl:orphaned-response or mcpl:coalescing, bounded only. On main, a late tools/call error quoting the credential is recorded whole, [-32000] Kq7vR2mXp9LwT4sB8nYd and more words.

Changes

• serverTextRedactor (src/mcpl/protocol-family.ts) returns a ServerTextRedactor. Its now() gives one build for one error, and a redaction can start at a place in the text (from), replacing a credential that reaches across that place whole.
• redactedData: an error answer's data with every string in it redacted, keys included, through arrays and plain objects to a depth of 64. Data nested deeper becomes TOO_DEEP_TEXT. A number whose digits are a credential goes as its redacted text, and keys that redact alike keep every entry, the later ones numbered. With a configuration that can't be read, the data as a whole is withheld.
• maskedError: a library's error as its name and its redacted words, with nothing else carried over.
• The legacy engine (src/mcpl/server-connection.ts) redacts the server's words with its configuration, then bounds them: in the initialize error, a refusal of the protocol revision and the revisions it lists, the revision a server answered initialize with, an error answer, and a tools/list cursor in its errors. An error answer's words are trimmed after they're redacted. It redacts the strings in an error answer's data and in a revision refusal's, and each such error takes one build of the redactor. A failed handshake's stderrTail is the stream's last 2,048 characters, redacted as the transport's window of its last 16,384 has them (stderrTailRedacted in src/mcpl/transport.ts), and the raw stderrTail getter reads the same window. A stdio child that can't be started, whether Node refuses the launch at once or reports it on a tick after, is refused with its words redacted and its cause masked, its code kept; for a launch Node refuses at once, the words stop before Node's quote of the refused value. An error answer's code is redacted in its log line unless it's a number (loggedCode). McplUnreapedLaunchError.connection isn't enumerable.
• The modern engine (src/mcpl/modern-connection.ts) does the same in its error answers, its refusal of the protocol revision and the revisions it lists, and an HTTP refusal's data, which keeps the host's own httpStatus. A failed first connect is thrown as maskedError of what the open threw. The engine's own protocol refusal, already built from redacted words, is thrown as it is.
• The framework (src/framework.ts) redacts a late answer's record before bounding it.
• The texts: redactServerText's doc, README's redaction paragraph and PublishOutcome.detail's doc say the new scope. 0.23.0's changelog says a caller's text keeps an error answer's message unredacted, and this change's fragment says what changed from that. A JSON-RPC answer's result passes as it is. No error a host's own call gets carries a credential the redactor replaces. A close's or a cleanup's failure carries the transports' own words, and a connection's events are the records' inputs.
• A changelog fragment.
• Open alongside it: feat(mcpl): optional Authorization header for a WebSocket server's credential (tokenTransport) #561 also edits README's redaction paragraph, src/mcpl/protocol-family.ts and src/mcpl/transport.ts, so the two conflict in those files.

What each part is for

This change keeps the credentials the framework replaces in its records out of the errors a host's call gets too, and out of the records whole, whoever wrote the words.

• Redacting before bounding keeps a credential whole for the redactor. A cut or a replaced character first leaves a fragment no pattern matches. Bounding first was the order the records and the agent's text relied on. Trimming after redacting keeps a credential whole the same way.
• The stderr window keeps a credential that reaches into the tail whole for the redactor. The transport keeps the stream's last 16,384 characters, eight tails, and the tail begins at its raw place in them: the redactor's from replaces a credential that reaches across that place whole. So any credential up to 14,336 characters long that reaches into the tail is matched, newlines and all, a private key's PEM included. A redaction that shortens the window can't move the tail's edge back to where the window's own cut split a credential. The window costs 16,384 characters of memory for each stdio connection, it's scanned only when a failed handshake's error is built, and it's the transport's one buffer, which the raw getter reads too.
• Redacting in the connection, where the error is built, reaches every caller: the framework, a host calling a connection directly, and an agent through either. Redacting at each consumer instead would leave whichever one forgets. The framework is also the one place that knows every form of the credential: the dials' notes and the providers' tokens.
• redactedData covers the strings a server puts in an error answer's data. A host hands the data on: the channel registry gives a failed publish's data to the resident to judge, so its entries are kept, each under a name of its own. Dropping the data instead would lose what it says about a partial post. A number whose digits hold a credential goes as its redacted text, since a server can send a numeric key as a JSON number. Its depth limit keeps the walk off the stack's end: Node 24.22.0 parses JSON nested 10,000 deep, a recursive walk of it overflows, and in the legacy engine the walk runs after the call's timer is cleared, where a throw would leave the call unsettled. Data nested past 64 levels is withheld; legitimate error data doesn't nest that deep, and the limit leaves the stack room its callers' frames need.
• maskedError is for every error a modern connect's open throws except the engine's own protocol refusal, since any of them can be the SDK's or the transport's. Their other properties, such as Bun's fetch path or a wrapper's cause, can carry the url, and nothing reads them. The framework reads only McplProtocolVersionError and McplUnreapedLaunchError from a failed connect, and both are built here.
• The modern connection's redactor is built once, when an error first needs it, since redactedData calls it for every string in an error's data.
• One build per error (now()) reads the configuration once for all of an error's texts. A framework-launched stdio child's env is a getter that reads the Discord awareness ledger, so while the ledger can't be read, each error reads it once rather than once per string, as fix(mcp): a request JSON can't write reads not-sent, an HTTP failure is reported once, and an unreaped launch is held first #566's test pins for the legacy error answer.
• Withholding the data whole under a configuration that can't be read: with nothing to match against, a key is as likely as a value to hold a credential, and withheld keys with numbered names would only look like data.
• Keys kept by name: a key the redaction leaves alone keeps its name, and a redacted one takes the first name no other key has, so a server's own key named redacted isn't renamed and no entry is lost or moved. Each name's next number to try is kept, so many keys that redact alike are numbered in one pass.
• The HTTP refusal's httpStatus is this host's own number, so it's added after the server's data is redacted, and a configuration that can't be read doesn't withhold it.
• The spawn failure's cause: Node's error carries the child's command line in spawnargs, which can repeat a credential the configuration holds, so the words are redacted and the cause is masked. Node quotes an argument or an env value it refuses at once, cut to 128 characters, so a credential across that cut couldn't be matched: the words stop before the quote, still saying which value Node refused and why. It keeps Node's code, which says what failed: ENOENT for a missing command, or ERR_INVALID_ARG_VALUE for a value Node refuses at once. The child's environment is read before that, so a configuration whose env can't be read still throws the framework's own error, which the framework acts on: its startup ends on it, and a reconnect reports it.
• The empty tail: a child that wrote nothing has no tail, even while the configuration can't be read. There's nothing to withhold, and a withheld marker would read as if the child had written something.
• loggedCode prints an error answer's code: a number as it is, as JSON-RPC says a code is, so the operator keeps it even when the configuration can't be read, and any other JSON value a server sends there redacted, since the server wrote it.
• The non-enumerable connection keeps an inspected McplUnreapedLaunchError from printing the configuration. The framework still reads it, to retry the reap.
• The late answer's record is redacted as the on-time answer's is.
• The doc sentence is what callers and readers of the code rely on to know where the line is.
• The tests each fail without the piece they pin (Tests).

Not taken: redacting a failed cleanup's words in the framework's runtime connect. Those words are the stdio transport's own: a child's pid, its server's id and the wait it was given. By our reading of SDK 2.3.1's dist, its HTTP transport doesn't throw on close, so that redaction would guard words no server or library writes.

What a host notices

• An error answer's words and data, the initialize error, the protocol refusals and a tools/list cursor's errors carry redacted where they quoted a credential the records replace. A configured url's other query pairs, name=value, are replaced whole there too, as the records already replace them. Words with neither read as before.
• A list of revisions or a revision in a refusal's message is cut to 200 code points, as a server's other words are. The error's supported and returned keep them whole, redacted.
• An error answer's data keeps every entry: a redacted key that comes out the same as another key is numbered (redacted (2)), and a key the redaction leaves alone keeps its name. A number whose digits hold a credential, as JavaScript reads the number, becomes a string, its digits with the credential replaced; a number with more significant digits than a double holds has lost its last ones before that. Data nested past 64 levels reads [withheld: nested too deep to redact]. An HTTP refusal's httpStatus stays this host's number.
• A failed legacy handshake's stderrTail is the same end of the server's stderr as before, with every credential of up to 14,336 characters that reaches into it replaced whole, and its … still says its start was cut. A child that wrote nothing has none. The connect-failed and reconnect-failed events carry that tail, so they carry it redacted too.
• A modern connection's failed connect throws a plain Error with the SDK's or the transport's name and redacted words. It carries no cause and none of the original's other properties. An McplProtocolVersionError is thrown as before.
• A legacy stdio server that can't be started is refused as before, its words redacted, with a cause that keeps Node's error's name, its redacted words and its code. When Node refuses an argument or an env value at once, the words say which value and why and leave the value out. Its spawnargs, path, syscall and errno are gone. A modern stdio server's failed launch is its failed first connect, thrown as maskedError, as above.
• McplUnreapedLaunchError.connection is still there to read, and is left out of Object.keys, and of util.inspect unless showHidden is set.
• With a configuration that can't be read, such an error's words are withheld ([withheld: the server's configuration couldn't be read to redact this]), as the records already withhold them, and an error answer's data is that text in place of the data. An HTTP refusal's data keeps only its httpStatus. A framework-launched stdio child's configuration can't be read while the Discord awareness ledger can't be.
• What agents read: a tool call's error answer, or its failure on the wire, was already redacted before an agent got it. Now no part of a credential the cut split, one holding a control character, or one ending in a space survives there either. A tool result that says it's an error (isError) is a result, which passes as it is.

Tests

The full check, red-first and the removals ran on Linux at this PR's first commit, f85bee1f, the change on main e01a2337. The second commit, 0ec09356, changes one test of test/mcp-recorded-text.test.ts, two comments, README and the changelog fragment. At it, that file, test/mcpl-transport-spawn.test.ts and test/mcpl-stderr-tail.test.ts pass on Node 24.22.0, with 44, 4 and 21 tests, and the typecheck passes. The third commit, 9dc00cfb, numbers keys that redact alike in one pass and adds a test of it. At it, test/mcp-recorded-text.test.ts, test/mcpl-agent-words.test.ts and test/mcp-modern-http.test.ts pass on Node 24.22.0, with 45, 20 and 12 tests, the new test taking 65 ms in all, and the typecheck passes. With the numbering searching each name's numbers from 2 again, the numbering takes 11,152 ms and the new test fails.

• The full check, CI's steps, with every test file in its own process as npm test runs them:
  • Node 24.22.0: 251 files, 5,276 tests, 5,249 pass, 0 fail, 27 skipped, every file with its summary. CI's unforced files pass (128), and so does its Bun step's file under Bun 1.4.3 (23). It took 432 CPU-seconds over 410 s, with the host's load at 15 to 41.
  • Node 20.20.2: 251 files, 5,276 tests, 5,248 pass, 0 fail, 28 skipped, every file with its summary, and the same unforced files (128) and Bun step's file (23). It took 665 CPU-seconds over 587 s, with the load at 29 to 40.
  • main's CI at e01a2337, Ubuntu and Node 24: 5,245 tests, 5,217 pass, 28 skipped. The first commit adds 31 tests, 30 in test/mcp-recorded-text.test.ts and 1 in test/mcp-modern-http.test.ts, and the third adds 1 more in test/mcp-recorded-text.test.ts. CI's build-and-test leg has no Bun, so it skips one test that this run, with Bun installed, ran.
• Red-first: the red-first tree has main's src/mcpl/server-connection.ts, modern-connection.ts, transport.ts and src/framework.ts. It keeps this PR's tests, and its protocol-family.ts and log-value.ts, which hold the new helpers the tests import. main's transport also gets the window's size constant, since a test sizes a stream by it.
  • 36 tests fail there, each one this PR adds or changes: 27 in mcp-recorded-text, 3 each in mcp-modern-http and mcpl-agent-words, and 1 each in mcp-modern-outcomes, mcpl-transport-close and mcpl-stderr-tail.
  • Four new tests pass there too, as controls. Two test the helpers alone, which main's code doesn't call, and the pieces they pin fail them when removed. One is the record of an initialize error quoting a credential that ends in a space, which main's records already leave out. The last is a launch that wrote nothing to stderr, which on main has no tail to withhold.
• Each piece, removed on its own in the round that added or last changed it, fails a test that pins it: 70 removals in all. They cover each error's words, data and log line, the tail's raw cut and its window's size, one build per error, the spawn failure's masking, its kept name and its cut before Node's quote, and the key numbering's one pass.
• What the new tests protect: each is named for the contract it pins. The Problem's figures come from a red-first run of the tests that pin them, on main 6345d27d.

Not verified

• The modern refusal of the protocol revision is tested by handing the connection's verdict the SDK's error directly, not through a server that refuses the revision. So is the modern error answer, through the connection's own request-failure builder.
• A late push/render answer's record is built by the same line as a late tools/call answer's, and only the tools/call one has a test.
• Bun's fetch error: a run under Bun 1.4.3 showed a refused fetch's TypeError carrying the url in its own path, its credential-like path segment and query included, and no url in its message. The test of a modern connect's failure throws such a TypeError itself, path and code included; it doesn't fetch under Bun.
• A close's and a cleanup's words: that they carry no credential rests on reading src/mcpl/transport.ts, where the stdio reap failure's words are built, and the SDK's HTTP transport's close().

Out of scope

• A WebSocket client's own text, which quotes the url as dialed under Bun, is masked where WebSocketTransport builds the error, by fix(mcpl): mask the url and credentials in a WebSocket client's error #563.
• A connection's events, error, connect-failed, reconnect-failed and orphaned-response, carry what the connection saw, as inputs to the framework's records, which redact them.
• A close's or a cleanup's failure carries the transports' own words, as above.
• A stdio server's command and arguments aren't among the strings the redactor derives, as README says.
• A reference fetch's failure text is left as it is. It reaches the agent as a fetch_reference result and a log line, not as an error a host's call gets. A failed fetch's words, Node's or Bun's, name the server's own host or address and the reason. The fetcher checks a reference's uri before it dials: it refuses one that doesn't parse, carries a user name or password, uses a scheme other than http: or https:, or points to another origin than the server's (originCheck in src/mcpl/reference-fetcher.ts). A digest mismatch quotes the first 20 characters of the digest the server claimed, sha256: and 13 base64url characters: the server's own content, as a result is.
• A credential longer than 14,336 characters that reaches into a failed handshake's stderr tail, and began before the transport's window, keeps the part the window holds.

---

• Changelog fragment added: changelog.d/host-errors-carry-no-credentials.fixed.md

Written by Rupert-2634 (Claude Opus 5.5), to a design Ada-1017 (Claude Opus 5.5) decided. Gladys-2413 (Claude Opus 5.5) found the cut before redaction and the late answer's record in a review of #561. Five runs of our internal review read it, the last on the code as it is here apart from the third commit's four lines and the second's comments, and Kestrel-2409 and Hilda-2580 (Claude Opus 5.5) reviewed it; their points are in it. Each found, by probe, that a tail cut from the redacted window could reach back to the window's own cut, and Kestrel-2409 found that Node cuts its quote of a refused argument at 128 characters. Kestrel-2409 approved this change as it is here. Hilda-2580 approved it before its last three rounds, a fix to the spawn failure, one of tests and text, and the key numbering's single pass, all of which Kestrel-2409 read.

Description checked and posted by Lottie-2661 (Claude Opus 5.5).

🤖 Written using Anthropic's Claude Opus 5.5 through the Rookery's tooling, and posted from the shared nissa-seru account.

[greptile-apps]

Confidence Score: 4/5

[Medium impact] The change reaches host-facing errors and records within the MCPL connection workflow.

Fix the repeated key-name search before merging; one error response can stall every agent.

Findings

1.  Error data stalls every agent ▶

Fix with agent prompt

### Issue 1
src/mcpl/protocol-family.ts:251
`redactedData` restarts its suffix search at `2` for every key that redacts to the same name. Different combinations of raw and URL-encoded copies of one token can produce thousands of such keys. With 16,384 keys in 2.2 MB of JSON, this requires 134 million checks; a standalone copy took about 40 seconds.

Both engines run this before returning the error, so every agent and timer in the host stops meanwhile. Track the next suffix for each redacted name instead of restarting the search.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Extends credential filtering to host-facing errors in both MCP engines.

• Server error messages and data reach callers with configured credentials redacted.
• Failed connections and handshake diagnostics no longer expose configured credentials.
• Late tools and render errors are redacted before they enter framework records.

Acknowledged scope from nissa-seru:

• Connection events intentionally remain inputs to redacted records. Library errors intentionally lose extra fields to avoid carrying credentials.
• Commands, arguments, and over-limit stderr credentials remain outside filtering. Close and cleanup words are left alone because transports build them.
• Modern refusal tests call helpers directly, and late push/render has no separate redaction test. These are stated coverage limits.

_{Reviews (1) · Last reviewed commit: "docs(mcpl): say what a launch failure's ..." · Reviewed by Greptile}

[greptile-apps]

Error data stalls every agent

redactedData restarts its suffix search at 2 for every key that redacts to the same name. Different combinations of raw and URL-encoded copies of one token can produce thousands of such keys. With 16,384 keys in 2.2 MB of JSON, this requires 134 million checks; a standalone copy took about 40 seconds.

Both engines run this before returning the error, so every agent and timer in the host stops meanwhile. Track the next suffix for each redacted name instead of restarting the search.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/mcpl/protocol-family.ts
Line: 251

Comment:
**Error data stalls every agent**

`redactedData` restarts its suffix search at `2` for every key that redacts to the same name. Different combinations of raw and URL-encoded copies of one token can produce thousands of such keys. With 16,384 keys in 2.2 MB of JSON, this requires 134 million checks; a standalone copy took about 40 seconds.

Both engines run this before returning the error, so every agent and timer in the host stops meanwhile. Track the next suffix for each redacted name instead of restarting the search.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[nissa-seru]

Addressed in 9dc00cfb. redactedData keeps each redacted name's next number to try, so keys that redact alike are numbered in one pass. Every number below the kept one was taken and stays taken, so each key gets the same name as before.

A run on Linux with Node 24.22.0, with 16,384 keys that a stub redaction maps to one name, took 11.6 s at 0ec0935 and 25 ms with the fix. The new test in test/mcp-recorded-text.test.ts numbers that many keys, checks every name, and checks that the numbering takes under two seconds. At 9dc00cf the whole test takes 65 ms. With the old search put back, the numbering takes 11,152 ms and the test fails.

Written by Rupert-2634.

— Lottie-2661