🤖 fix: redact MCP command env values and credential URLs in settings backup export - #3985
🤖 fix: redact MCP command env values and credential URLs in settings backup export#3985ibetitsmike wants to merge 104 commits into
Conversation
…ckup export The export projection treated 'command' and 'url' as fully portable strings, so env-style credentials embedded in a command (FOO_TOKEN=... cmd) and credentials inside URLs were published verbatim with an empty mcpRedactions. Redact assignment values in command strings (object and bare-string servers), redact credential-bearing URLs whole-value, and record both in the manifest so restore rehydrates them from the local config. Manifest sha256 stays computed over the redacted bytes as written. Defense in depth: createBackupPayload now hard-fails when a known credential token format survives in the finished payload, with no approval override; the local safety snapshot stays exempt. The Settings UI hides the secret-scan override for blocks that carry no approval digest.
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cbfabe752e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This comment has been minimized.
This comment has been minimized.
…ted URLs on restore
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7c2d5ad4be
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 7c2d5ad4be
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
…on quote-led assignments
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 543d699c8f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 543d699c8f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This comment has been minimized.
This comment has been minimized.
…, process substitution fail-closed
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 875b0c8c82
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This comment has been minimized.
This comment has been minimized.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b9f9f51be0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: b9f9f51be0
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9fd948f88e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 9fd948f88e
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
This comment has been minimized.
This comment has been minimized.
|
@codex review |
This comment has been minimized.
This comment has been minimized.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d579b5843f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
… chains, and track java -jar
|
@codex review |
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 5e06d589ea
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5e06d589ea
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
xum/src/node/services/backup/payload.ts
Line 3397 in 8bb9fec
Preserve URLs with empty userinfo
When an MCP endpoint uses the valid spelling https://@example.com/mcp, this raw check classifies the mere @ delimiter as credentials even though new URL(...) produces an empty username and password and canonicalizes the endpoint to https://example.com/mcp. Export therefore replaces the whole URL with the marker, and a fresh restore with no local counterpart removes the URL-only server entirely. Require non-empty userinfo before redacting this raw-authority form while retaining detection of values such as :password@host.
xum/src/node/services/backup/payload.ts
Lines 3414 to 3418 in 8bb9fec
Redact path-based capability URLs
When an HTTP MCP endpoint embeds its credential in the path, such as a capability URL shaped like https://discord.com/api/webhooks/<id>/<token>, all four checks return false because the URL has neither userinfo nor a credential-named query or fragment parameter. The opaque token therefore remains verbatim in mcp.jsonc, and unlike a command-bearing config this URL-only payload does not even require publish approval; the known-token backstop also misses provider tokens without one of its enumerated prefixes. Recognize established path-credential URL families or conservatively require review for opaque capability paths instead of treating every path as public.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 8bb9fec020
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 19c9cddf44
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…Python under PYTHONSTARTUP
|
@codex review |
This comment has been minimized.
This comment has been minimized.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8cfe2e0a2d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 733a118b58
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Security Review
Here are some automated security review suggestions for this pull request.
Reviewed commit: 733a118b58
ℹ️ About Codex security reviews in GitHub
This is an experimental Codex feature. Security reviews are triggered when:
- You comment "@codex security review"
- A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review
Once complete, Codex will leave suggestions, or a comment if no findings are found.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: a1ff70a324
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This comment has been minimized.
This comment has been minimized.
|
@codex review |
1 participant
Summary
Settings backup export published MCP server
commandstrings andurlvalues verbatim, so inline credentials (env-style assignments in commands, tokens in URLs) could leak into backup repositories once the user approved the secret-scan digest formcp.jsonc. This PR redacts those values at export time and adds a non-overridable credential-format backstop on the finished payload.Background
The exporter always classified
commandandurlas fully-portable strings (an old test asserted "keeps MCP commands and URLs ... verbatim"), relying on the digest-approvable secret scan instead. Once a user approved the flaggedmcp.jsonc, inline tokens published verbatim withmcpRedactions: []. The restore machinery already supported redacted command rehydration, so the export side and a URL-marker restore gap were the missing pieces.Implementation
redactMcpConfigreplaces everyNAME=valueassignment value in command strings (object and bare-string servers) with__MUX_BACKUP_REDACTED__. The value grammar consumes a whole shell word (escapes and quoted segments included), and assignments are recognized at start-of-string, whitespace, and shell word breaks (;,&,|,<,>,(,),{,}, backquote). When boundaries cannot be trusted, the whole command is replaced by the marker instead: unconsumable values (unterminated quote, trailing backslash), words that shell quote removal turns intoNAME=valueassignments forenv/eval-style consumers (TOKEN\=x,'TOKEN'=x,"TOKEN=a b"), or expansion syntax ($(),${}, backticks,<(,>() around an assignment.mcpRedactions. Restore rehydrates each marker from the local config at the same path; without a local value,resolveRestoredUrls(mirroring the command resolution) drops a marker url when the entry keeps a usable command — the command approval gate covers the now-runnable stdio fallback — and removes the server otherwise, so a marker can never survive as a connectable endpoint or executable command. Restore bookkeeping keys resolved paths with the JSON path encoder, so crafted server names containing delimiter characters cannot shadow another entry's resolution.createBackupPayloadhard-fails (BackupCredentialDetectedError, codeSECRET_DETECTED, no approval digest) when a known credential format (glsa_,ghp_,gho_,github_pat_,sk-,lin_api_,ntn_,xox[baprs]-,AKIA…) survives anywhere in the finished payload. Local safety snapshots (keepLocalSecrets) stay exempt since they never leave the machine.Validation
Red-green verified with independent toggles: removing command redaction, reverting the shell-word grammar, reverting operator boundaries, disabling the fail-closed fallbacks, removing URL redaction, unwiring the URL restore resolver, and unwiring the backstop each fail exactly the guarding tests.
Risks
ghp_token in AGENTS.md) is now a hard export block instead of an approvable finding. Intentional, but users who previously approved such content will see exports fail until they remove the credential.NAME=valueassignment value becomes machine-local, and commands with untrustworthy word boundaries (quote-led assignments, expansions around assignments) go local as a whole, requiring rehydration on restore.Generated with
xum• Model:anthropic:claude-fable-5• Thinking:xhigh