fix(mcp): redact secrets from /mcp show in group chats#103396
Merged
Conversation
Contributor
Author
Live ephemeral-gateway E2E proofAdded and ran What it does
Result |
Prevent owner /mcp show from dumping raw headers/env credentials into group chats. Mark MCP env values sensitive, restore redaction sentinels on set so show→set cannot overwrite real secrets. Fixes #103053
Spin up an ephemeral gateway process, chat.send /mcp show with live credential-bearing config, and prove secrets never leave the reply path. Also prove show→set sentinel restore on disk via chat and CLI.
obviyus
force-pushed
the
fix/mcp-show-redact-credentials
branch
from
July 10, 2026 05:58
cea9ee0 to
718c5d8
Compare
Contributor
Author
|
Landed via squash onto main (landpr, no scripts/pr wrapper).
|
github-actions Bot
pushed a commit
to Desicool/openclaw
that referenced
this pull request
Jul 10, 2026
* fix(mcp): redact secrets in /mcp show replies Prevent owner /mcp show from dumping raw headers/env credentials into group chats. Mark MCP env values sensitive, restore redaction sentinels on set so show→set cannot overwrite real secrets. Fixes openclaw#103053 * test(mcp): e2e redaction of /mcp show secrets on live gateway Spin up an ephemeral gateway process, chat.send /mcp show with live credential-bearing config, and prove secrets never leave the reply path. Also prove show→set sentinel restore on disk via chat and CLI.
wheakerd
pushed a commit
to wheakerd/clawdbot
that referenced
this pull request
Jul 15, 2026
* fix(mcp): redact secrets in /mcp show replies Prevent owner /mcp show from dumping raw headers/env credentials into group chats. Mark MCP env values sensitive, restore redaction sentinels on set so show→set cannot overwrite real secrets. Fixes openclaw#103053 * test(mcp): e2e redaction of /mcp show secrets on live gateway Spin up an ephemeral gateway process, chat.send /mcp show with live credential-bearing config, and prove secrets never leave the reply path. Also prove show→set sentinel restore on disk via chat and CLI. (cherry picked from commit 08b6996)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #103053
What Problem This Solves
Fixes an issue where an owner running
/mcp show(or/mcp show <name>) from a group or channel would post the full MCP server config—including credential-bearingheadersandenvvalues—into that shared chat for every member to read.Why This Change Was Made
/mcp showwas owner-gated but still rendered raw server JSON with no secret redaction. This change reuses the existing config redaction contract (redactConfigObject+ schema uiHints) so show output never contains live secrets, and marks MCPenvvalues sensitive the same wayheadersalready were.Write-side safety is included:
/mcp setrestores redaction sentinels from the existing server entry (and rejects unrestorable sentinels), so a show → edit → set round-trip cannot overwrite real credentials with the display placeholder.User Impact
/mcp showin groups without leaking MCP Authorization headers, env tokens, or other sensitive server fields.command,args, server names, etc.) still appear for inspection./mcp setkeep existing secrets instead of silently writing__OPENCLAW_REDACTED__.Evidence
Focused tests:
Coverage added:
/mcp shownamed + list forms with secretheaders/envmust emit the redaction sentinel and never the secret values.setConfiguredMcpServerrestores secrets when the payload contains the redaction sentinel.mcp.servers.*.env.*is sensitive.fable-5 closeout review: accepted show→set restore gap and fixed it; remaining P3 note about short env values affecting raw snapshot text view is intentional/shared with other all-sensitive env maps and is fail-safe (no leak).