Found during the MCP cutover program (development#104, mcpcall prototype lane
dev#107, 2026-08-09).
~/.cache/mcp2cli/logs/audit.ndjson records responseSummary with the full
response body of tool calls. Observed live: a vaultwarden-secrets get_credential entry carrying a complete service-account private key in
cleartext, in an unencrypted cache file, on every box running mcp2cli. Any
credential-returning service has its payloads persisted the same way.
Fix at the mechanism: the audit line should record param KEY NAMES and a
response byte count / status only — never param values, never response bodies.
(The mcpcall prototype's contract adopts exactly that shape;
development:mcp-cutover/prototypes/mcpcall/contract.md §audit.)
Independent of whether mcpcall ships — this is worth fixing in mcp2cli while
it remains the stdio bridge. Also observed in the same log: get_credential
latency of 9691 ms, worth a look while in the file.
Found during the MCP cutover program (development#104, mcpcall prototype lane
dev#107, 2026-08-09).
~/.cache/mcp2cli/logs/audit.ndjsonrecordsresponseSummarywith the fullresponse body of tool calls. Observed live: a
vaultwarden-secrets get_credentialentry carrying a complete service-account private key incleartext, in an unencrypted cache file, on every box running mcp2cli. Any
credential-returning service has its payloads persisted the same way.
Fix at the mechanism: the audit line should record param KEY NAMES and a
response byte count / status only — never param values, never response bodies.
(The mcpcall prototype's contract adopts exactly that shape;
development:mcp-cutover/prototypes/mcpcall/contract.md§audit.)Independent of whether mcpcall ships — this is worth fixing in mcp2cli while
it remains the stdio bridge. Also observed in the same log:
get_credentiallatency of 9691 ms, worth a look while in the file.