AI-written debug logging in the POST /mcp handler serialized full request bodies and headers, leaking bearer tokens and API keys into logs.

 import dotenv from 'dotenv'; import { getStartupBaseUrl, formatEndpointUrls, detectBaseUrl } from './utils/url-detector'; import { PROJECT_VERSION } from './utils/version';+import { v4 as uuidv4 } from 'uuid';+import { isInitializeRequest } from '@modelcontextprotocol/sdk/types.js'; 

   sessionId: string;+  initialized: boolean;+  isSSE: boolean; }  export class SingleSessionHTTPServer {

   private sessionTimeout = 30 * 60 * 1000; // 30 minutes@@ -33,8 +44,10 @@ export class SingleSessionHTTPServer {   constructor() {     // Validate environment on construction     this.validateEnvironment();+    // No longer pre-create session - will be created per initialize request following SDK pattern   }   +     /**    * Load auth token from environment variable or file    */@@ -97,93 +110,171 @@ export class SingleSessionHTTPServer {     }   }   +   /**-   * Handle incoming MCP request+   * Handle incoming MCP request using proper SDK pattern    */   async handleRequest(req: express.Request, res: express.Response): Promise<void> {     const startTime = Date.now();          // Wrap all operations to prevent console interference     return this.consoleManager.wrapOperation(async () => {       try {-        // Ensure we have a valid session-        if (!this.session || this.isExpired()) {-          await this.resetSession();-        }+        const sessionId = req.headers['mcp-session-id'] as string | undefined;+        const isInitialize = req.body ? isInitializeRequest(req.body) : false;         -        // Update last access time-        this.session!.lastAccess = new Date();+        // Log comprehensive incoming request details for debugging+        logger.info('handleRequest: Processing MCP request - SDK PATTERN', {+          requestId: req.get('x-request-id') || 'unknown',+          sessionId: sessionId,+          method: req.method,+          url: req.url,+          bodyType: typeof req.body,+          bodyContent: req.body ? JSON.stringify(req.body, null, 2) : 'undefined',+          existingTransports: Object.keys(this.transports),+          isInitializeRequest: isInitialize+        });         -        // Handle request with existing transport-        logger.debug('Calling transport.handleRequest...');-        await this.session!.transport.handleRequest(req, res);-        logger.debug('transport.handleRequest completed');

+    // Allow ERROR level logs through in more cases for debugging+    const allowErrorLogs = level === LogLevel.ERROR && (this.isHttp || process.env.DEBUG === 'true');+         // Check environment variables FIRST, before level check-    // In stdio mode, suppress ALL console output to avoid corrupting JSON-RPC+    // In stdio mode, suppress ALL console output to avoid corrupting JSON-RPC (except errors when debugging)     // Also suppress in test mode unless debug is explicitly enabled     if (this.isStdio || this.isDisabled || (this.isTest && process.env.DEBUG !== 'true')) {-      // Silently drop all logs in stdio/test mode-      return;+      // Allow error logs through if debugging is enabled+      if (!allowErrorLogs) {+        return;+      }     }     -    if (level <= this.config.level) {+    if (level <= this.config.level || allowErrorLogs) {       const formattedMessage = this.formatMessage(levelName, message);       

         jsonrpc: '2.0',

@@ -557,14 +558,13 @@ export class SingleSessionHTTPServer {         const sessionId = req.headers['mcp-session-id'] as string | undefined;         const isInitialize = req.body ? isInitializeRequest(req.body) : false; -        // Log comprehensive incoming request details for debugging+        // SECURITY (GHSA-pfm2-2mhg-8wpx): log body summary only, not payload.         logger.info('handleRequest: Processing MCP request - SDK PATTERN', {           requestId: req.get('x-request-id') || 'unknown',           sessionId: sessionId,           method: req.method,

@@ -1270,23 +1270,6 @@ export class SingleSessionHTTPServer {      // Main MCP endpoint with authentication and rate limiting     app.post('/mcp', authLimiter, jsonParser, async (req: express.Request, res: express.Response): Promise<void> => {-      // Log comprehensive debug info about the request-      logger.info('POST /mcp request received - DETAILED DEBUG', {-        headers: req.headers,-        readable: req.readable,-        readableEnded: req.readableEnded,-        complete: req.complete,-        bodyType: typeof req.body,-        bodyContent: req.body ? JSON.stringify(req.body, null, 2) : 'undefined',-        contentLength: req.get('content-length'),-        contentType: req.get('content-type'),-        userAgent: req.get('user-agent'),-        ip: req.ip,-        method: req.method,-        url: req.url,-        originalUrl: req.originalUrl-      });-             // Handle connection close to immediately clean up sessions       const sessionId = req.headers['mcp-session-id'] as string | undefined;       // Only add event listener if the request object supports it (not in test mocks)@@ -1320,7 +1303,14 @@ export class SingleSessionHTTPServer {              if (!this.authenticateRequest(req, res)) return; -      logger.info('Authentication successful - proceeding to handleRequest', {+      // SECURITY (GHSA-pfm2-2mhg-8wpx): redacted summary only, post-auth.+      logger.debug('POST /mcp authenticated', {+        ip: req.ip,

+++ b/src/utils/redaction.ts@@ -0,0 +1,52 @@+/**+ * Redaction helpers for log output. The project logger has no built-in+ * redaction, so callers must scrub sensitive values before passing them in.+ */++const SENSITIVE_HEADER_NAMES = new Set([+  'authorization',+  'proxy-authorization',+  'cookie',+  'set-cookie',+  'x-n8n-key',+  'x-n8n-url',+]);++export const REDACTED = '[REDACTED]';++/**

+    return {};+  }+  const out: Record<string, unknown> = {};+  for (const [key, value] of Object.entries(headers)) {+    out[key] = SENSITIVE_HEADER_NAMES.has(key.toLowerCase()) ? REDACTED : value;+  }+  return out;+}++/**

+  if (typeof body !== 'object' || Array.isArray(body)) {+    return { bodyType: Array.isArray(body) ? 'array' : typeof body };+  }+  const b = body as Record<string, unknown>;+  return {+    jsonrpc: typeof b.jsonrpc === 'string' ? b.jsonrpc : undefined,+    method: typeof b.method === 'string' ? b.method : undefined,+    id: typeof b.id === 'string' || typeof b.id === 'number' ? b.id : undefined,+    hasParams: b.params !== undefined && b.params !== null,+  };+}