@agent-inspect/mcp-server 6.4.0 → 6.5.0

package/dist/index.cjs

@@ -1810,6 +1810,9 @@ function toMetadataSafeStatus(status) {
   if (status === "SAFE WITH WARNINGS") return "SAFE_WITH_WARNINGS";
   return status;
 }
+function bundleFailsOnSafety(status, allowUnsafe) {
+  return status === "UNSAFE" || status === "UNKNOWN";
+}
 
 // packages/core/src/bundle/manifest.ts
 var BUNDLE_NOTE = "Generated locally by AgentInspect. Bundles are derived copies for review \u2014 not compliance or security certification. Review before sharing.";
@@ -1842,6 +1845,44 @@ var STATUS_RANK = {
   warning: 1,
   pass: 2
 };
+var DEFAULT_SENSITIVE_KEYS = [
+  "authorization",
+  "cookie",
+  "token",
+  "apikey",
+  "api_key",
+  "password",
+  "secret",
+  "email"
+];
+var DEFAULT_RAW_CONTENT_KEYS = [
+  "body",
+  "headers",
+  "input",
+  "messages",
+  "output",
+  "payload",
+  "prompt",
+  "requestbody",
+  "request_body",
+  "responsebody",
+  "response_body",
+  "rawprompt",
+  "raw_prompt",
+  "rawoutput",
+  "raw_output",
+  "toolinput",
+  "tool_input",
+  "tooloutput",
+  "tool_output"
+];
+var DEFAULT_SECRET_PATTERNS = [
+  { id: "bearer-token", pattern: /Bearer\s+[A-Za-z0-9._~+/-]{12,}=*/ },
+  { id: "openai-key", pattern: /sk-[A-Za-z0-9_-]{16,}/ },
+  { id: "aws-access-key", pattern: /AKIA[0-9A-Z]{16}/ },
+  { id: "github-token", pattern: /gh[opsu]_[A-Za-z0-9_]{20,}/ },
+  { id: "key-value-secret", pattern: /(api[_-]?key|token|password|secret)=\S{8,}/i }
+];
 function compareStrings(a, b) {
   return (a ?? "").localeCompare(b ?? "");
 }
@@ -2037,7 +2078,7 @@ function eventEvidence(event, path13) {
     kind: event.kind,
     name: event.name,
     status: event.status,
-    ...{}
+    ...path13 ? { path: path13 } : {}
   };
 }
 function runEvidence(run) {
@@ -2054,6 +2095,84 @@ function failFinding(ruleId, message, evidence, expected, actual) {
     evidence: [...evidence]
   };
 }
+function isRecord6(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizedKey(value) {
+  return value.toLowerCase().replace(/[^a-z0-9_]/g, "");
+}
+function lastPathSegment(path13) {
+  const parts = path13.split(".");
+  return parts[parts.length - 1] ?? path13;
+}
+function valueType(value) {
+  if (Array.isArray(value)) return "array";
+  if (value === null) return "null";
+  return typeof value;
+}
+function serializedByteLength(value) {
+  try {
+    return Buffer.byteLength(JSON.stringify(value), "utf-8");
+  } catch {
+    return void 0;
+  }
+}
+function pushValueEntries(entries, event, value, path13, key, depth = 0) {
+  entries.push({ event, path: path13, key, value });
+  if (depth >= 8) return;
+  if (Array.isArray(value)) {
+    for (const [index, item] of value.entries()) {
+      pushValueEntries(entries, event, item, `${path13}.${index}`, String(index), depth + 1);
+    }
+    return;
+  }
+  if (!isRecord6(value)) return;
+  for (const nestedKey of Object.keys(value).sort((a, b) => a.localeCompare(b))) {
+    pushValueEntries(
+      entries,
+      event,
+      value[nestedKey],
+      `${path13}.${nestedKey}`,
+      nestedKey,
+      depth + 1
+    );
+  }
+}
+function eventValueEntries(event, options = {}) {
+  const entries = [];
+  if (event.attributes !== void 0) {
+    pushValueEntries(entries, event, event.attributes, "attributes", "attributes");
+  }
+  if (options.includeSummaries) {
+    if (event.inputSummary !== void 0) {
+      pushValueEntries(entries, event, event.inputSummary, "inputSummary", "inputSummary");
+    }
+    if (event.outputSummary !== void 0) {
+      pushValueEntries(entries, event, event.outputSummary, "outputSummary", "outputSummary");
+    }
+  }
+  if (options.includeError && event.error !== void 0) {
+    pushValueEntries(entries, event, event.error, "error", "error");
+  }
+  return entries;
+}
+function limitFindings(findings, maxFindings) {
+  if (maxFindings === void 0 || findings.length <= maxFindings) return findings;
+  return findings.slice(0, Math.max(0, maxFindings));
+}
+function hasRedactionMarker(value, markers) {
+  return markers.some((marker) => value.includes(marker)) || /^\[HASH:[A-Za-z0-9_-]+\]$/.test(value);
+}
+function isSensitiveKey(key, sensitiveKeys) {
+  if (!key) return false;
+  const normalized = normalizedKey(key);
+  return sensitiveKeys.some((sensitive) => normalized.includes(normalizedKey(sensitive)));
+}
+function isRawContentKey(key, forbiddenKeys) {
+  if (!key) return false;
+  const normalized = normalizedKey(key);
+  return forbiddenKeys.some((forbidden) => normalized === normalizedKey(forbidden));
+}
 function createRunStatusRule(options = {}) {
   const expected = options.expected ?? "ok";
   const allowIncomplete = options.allowIncomplete === true;
@@ -2093,6 +2212,157 @@ function createRunStatusRule(options = {}) {
     }
   };
 }
+function createSafetyRedactionRule(options = {}) {
+  const sensitiveKeys = options.sensitiveKeys ?? DEFAULT_SENSITIVE_KEYS;
+  const markers = options.redactedMarkers ?? ["[REDACTED]", "[REDACTED:"];
+  return {
+    id: "safety.redaction",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (!isSensitiveKey(entry.key ?? lastPathSegment(entry.path), sensitiveKeys)) continue;
+          if (typeof entry.value === "string" && hasRedactionMarker(entry.value, markers)) continue;
+          findings.push(
+            failFinding(
+              "safety.redaction",
+              `Sensitive-looking field at ${entry.path} is not redacted.`,
+              [eventEvidence(event, entry.path)],
+              "redaction marker",
+              { path: entry.path, valueType: valueType(entry.value) }
+            )
+          );
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createSafetyRawContentRule(options = {}) {
+  const forbiddenKeys = options.forbiddenKeys ?? DEFAULT_RAW_CONTENT_KEYS;
+  return {
+    id: "safety.rawPrompt",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: options.includeSummaries })) {
+          const key = entry.key ?? lastPathSegment(entry.path);
+          if (!isRawContentKey(key, forbiddenKeys)) continue;
+          findings.push(
+            failFinding(
+              "safety.rawPrompt",
+              `Raw content-like field ${entry.path} is present.`,
+              [eventEvidence(event, entry.path)],
+              "metadata-only trace fields",
+              { path: entry.path, valueType: valueType(entry.value) }
+            )
+          );
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createSafetySecretPatternRule(options = {}) {
+  const patterns = options.patterns ?? DEFAULT_SECRET_PATTERNS;
+  const maxStringLength = options.maxStringLength ?? 4096;
+  return {
+    id: "safety.secretPattern",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (typeof entry.value !== "string") continue;
+          const sample = entry.value.slice(0, maxStringLength);
+          for (const pattern of patterns) {
+            pattern.pattern.lastIndex = 0;
+            if (!pattern.pattern.test(sample)) continue;
+            pattern.pattern.lastIndex = 0;
+            findings.push(
+              failFinding(
+                "safety.secretPattern",
+                `Secret-like pattern ${pattern.id} matched at ${entry.path}.`,
+                [eventEvidence(event, entry.path)],
+                "no secret-like strings",
+                { pattern: pattern.id, path: entry.path }
+              )
+            );
+            break;
+          }
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
+function createSafetyOversizedAttributeRule(options) {
+  return {
+    id: "safety.oversizedAttribute",
+    category: "safety",
+    defaultSeverity: "error",
+    evaluate(context) {
+      const findings = [];
+      for (const event of context.events) {
+        for (const entry of eventValueEntries(event, { includeSummaries: true, includeError: true })) {
+          if (typeof entry.value === "string" && options.maxStringLength !== void 0 && entry.value.length > options.maxStringLength) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `String at ${entry.path} exceeds ${options.maxStringLength} characters.`,
+                [eventEvidence(event, entry.path)],
+                { maxStringLength: options.maxStringLength },
+                { path: entry.path, length: entry.value.length }
+              )
+            );
+          }
+          if (Array.isArray(entry.value) && options.maxArrayLength !== void 0 && entry.value.length > options.maxArrayLength) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `Array at ${entry.path} exceeds ${options.maxArrayLength} items.`,
+                [eventEvidence(event, entry.path)],
+                { maxArrayLength: options.maxArrayLength },
+                { path: entry.path, length: entry.value.length }
+              )
+            );
+          }
+          if (isRecord6(entry.value) && options.maxObjectKeys !== void 0 && Object.keys(entry.value).length > options.maxObjectKeys) {
+            findings.push(
+              failFinding(
+                "safety.oversizedAttribute",
+                `Object at ${entry.path} exceeds ${options.maxObjectKeys} keys.`,
+                [eventEvidence(event, entry.path)],
+                { maxObjectKeys: options.maxObjectKeys },
+                { path: entry.path, keys: Object.keys(entry.value).length }
+              )
+            );
+          }
+          if (options.maxSerializedBytes !== void 0) {
+            const bytes = serializedByteLength(entry.value);
+            if (bytes !== void 0 && bytes > options.maxSerializedBytes) {
+              findings.push(
+                failFinding(
+                  "safety.oversizedAttribute",
+                  `Value at ${entry.path} exceeds ${options.maxSerializedBytes} serialized bytes.`,
+                  [eventEvidence(event, entry.path)],
+                  { maxSerializedBytes: options.maxSerializedBytes },
+                  { path: entry.path, bytes }
+                )
+              );
+            }
+          }
+        }
+      }
+      return limitFindings(findings, options.maxFindings);
+    }
+  };
+}
 function runTraceChecks(input, options = {}) {
   const selected = resolveSelectedRun(input, options.runId);
   if (selected.diagnostics.length > 0) {
@@ -2139,14 +2409,14 @@ function runTraceChecks(input, options = {}) {
 }
 
 // packages/core/src/persisted/token-usage.ts
-function isRecord6(value) {
+function isRecord7(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function nonNegativeFinite(value) {
   return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : void 0;
 }
 function normalizeTokenUsage(value) {
-  if (!isRecord6(value)) return void 0;
+  if (!isRecord7(value)) return void 0;
   const input = nonNegativeFinite(value.input);
   const output = nonNegativeFinite(value.output);
   const suppliedTotal = nonNegativeFinite(value.total);
@@ -2904,7 +3174,7 @@ function persistedEventsForParsedTrace(parsed) {
     sourceName: "agent-inspect-jsonl-reader"
   });
 }
-function isRecord7(value) {
+function isRecord8(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function isNonEmptyString3(value) {
@@ -2919,13 +3189,13 @@ function readStringField(record, keys) {
 }
 function readRecordField(record, key) {
   const value = record[key];
-  return isRecord7(value) ? value : void 0;
+  return isRecord8(value) ? value : void 0;
 }
 function parseJsonDocument(content) {
   return JSON.parse(content);
 }
 function looksLikeOpenInferenceSpan(value) {
-  if (!isRecord7(value)) return false;
+  if (!isRecord8(value)) return false;
   const attributes = readRecordField(value, "attributes");
   return readStringField(value, ["trace_id", "traceId"]) !== void 0 && readStringField(value, ["span_id", "spanId"]) !== void 0 && (readStringField(value, ["name"]) !== void 0 || attributes?.["openinference.span.kind"] !== void 0);
 }
@@ -2950,7 +3220,7 @@ function extractOpenInferenceDocument(root) {
       unsupportedFields
     };
   }
-  if (!isRecord7(root)) return void 0;
+  if (!isRecord8(root)) return void 0;
   const rootFormat = root.format;
   const rootCompatibility = root.compatibility;
   const version = typeof root.version === "string" && root.version.trim() !== "" ? root.version : void 0;
@@ -3090,7 +3360,7 @@ function summarizeAttributeValue(value) {
   if (Array.isArray(value)) {
     return { type: "array", length: value.length };
   }
-  if (isRecord7(value)) {
+  if (isRecord8(value)) {
     return { type: "object", keyCount: Object.keys(value).length };
   }
   if (value === null) {
@@ -3177,7 +3447,7 @@ function mapOpenInferenceKind(span, attributes, pathPrefix) {
   }
 }
 function mapOpenInferenceStatus(status) {
-  if (!isRecord7(status)) return void 0;
+  if (!isRecord8(status)) return void 0;
   const rawCode = status.code;
   if (typeof rawCode !== "string") return void 0;
   switch (rawCode.toUpperCase()) {
@@ -3277,7 +3547,7 @@ function mapOpenInferenceSpan(span, index, version) {
   warnings.push(...kindWarnings);
   const status = mapOpenInferenceStatus(span.status);
   const tokenUsage = readOpenInferenceTokenUsage(rawAttributes);
-  const errorMessage = isRecord7(span.status) && typeof span.status.message === "string" ? span.status.message : void 0;
+  const errorMessage = isRecord8(span.status) && typeof span.status.message === "string" ? span.status.message : void 0;
   const event = {
     schemaVersion: "0.2",
     eventId: typeof rawAttributes["agent_inspect.event_id"] === "string" ? rawAttributes["agent_inspect.event_id"] : spanId,
@@ -3423,7 +3693,7 @@ var openInferenceJsonReader = {
   }
 };
 function parseOtlpAnyValue(value, field, warnings, unsupportedFields) {
-  if (!isRecord7(value)) {
+  if (!isRecord8(value)) {
     unsupportedFields.push(field);
     warnings.push({
       code: "otlp_attribute_value_invalid",
@@ -3445,15 +3715,15 @@ function parseOtlpAnyValue(value, field, warnings, unsupportedFields) {
   if (typeof value.doubleValue === "number" && Number.isFinite(value.doubleValue)) {
     return value.doubleValue;
   }
-  if (isRecord7(value.arrayValue) && Array.isArray(value.arrayValue.values)) {
+  if (isRecord8(value.arrayValue) && Array.isArray(value.arrayValue.values)) {
     return value.arrayValue.values.map(
       (item, index) => parseOtlpAnyValue(item, `${field}.arrayValue.values[${index}]`, warnings, unsupportedFields)
     );
   }
-  if (isRecord7(value.kvlistValue) && Array.isArray(value.kvlistValue.values)) {
+  if (isRecord8(value.kvlistValue) && Array.isArray(value.kvlistValue.values)) {
     const out = {};
     for (const [index, item] of value.kvlistValue.values.entries()) {
-      if (!isRecord7(item) || typeof item.key !== "string") {
+      if (!isRecord8(item) || typeof item.key !== "string") {
         unsupportedFields.push(`${field}.kvlistValue.values[${index}]`);
         continue;
       }
@@ -3504,7 +3774,7 @@ function parseOtlpAttributes(value, pathPrefix) {
   }
   for (const [index, item] of value.entries()) {
     const field = `${pathPrefix}[${index}]`;
-    if (!isRecord7(item) || typeof item.key !== "string") {
+    if (!isRecord8(item) || typeof item.key !== "string") {
       unsupportedFields.push(field);
       warnings.push({
         code: "otlp_attribute_invalid",
@@ -3527,16 +3797,16 @@ function parseOtlpAttributes(value, pathPrefix) {
   return { attributes, warnings, unsupportedFields };
 }
 function looksLikeOtlpSpan(value) {
-  return isRecord7(value) && readStringField(value, ["traceId"]) !== void 0 && readStringField(value, ["spanId"]) !== void 0 && readStringField(value, ["name"]) !== void 0;
+  return isRecord8(value) && readStringField(value, ["traceId"]) !== void 0 && readStringField(value, ["spanId"]) !== void 0 && readStringField(value, ["name"]) !== void 0;
 }
 function extractOtlpDocument(root) {
-  if (!isRecord7(root) || !Array.isArray(root.resourceSpans)) return void 0;
+  if (!isRecord8(root) || !Array.isArray(root.resourceSpans)) return void 0;
   const spans = [];
   const warnings = [];
   const unsupportedFields = [];
   for (const [resourceIndex, resourceSpan] of root.resourceSpans.entries()) {
     const resourcePath = `resourceSpans[${resourceIndex}]`;
-    if (!isRecord7(resourceSpan)) {
+    if (!isRecord8(resourceSpan)) {
       unsupportedFields.push(resourcePath);
       continue;
     }
@@ -3559,7 +3829,7 @@ function extractOtlpDocument(root) {
     }
     for (const [scopeIndex, scopeSpan] of resourceSpan.scopeSpans.entries()) {
       const scopePath = `${resourcePath}.scopeSpans[${scopeIndex}]`;
-      if (!isRecord7(scopeSpan)) {
+      if (!isRecord8(scopeSpan)) {
         unsupportedFields.push(scopePath);
         continue;
       }
@@ -3626,7 +3896,7 @@ function extractOtlpDocument(root) {
   };
 }
 function mapOtlpStatus(status) {
-  if (!isRecord7(status)) return void 0;
+  if (!isRecord8(status)) return void 0;
   const rawCode = status.code;
   if (typeof rawCode !== "string") return void 0;
   switch (rawCode.toUpperCase()) {
@@ -3726,7 +3996,7 @@ function mapOtlpEvents(value, pathPrefix) {
   const events = [];
   for (const [index, event] of value.entries()) {
     const eventPath = `${pathPrefix}[${index}]`;
-    if (!isRecord7(event)) {
+    if (!isRecord8(event)) {
       unsupportedFields.push(eventPath);
       continue;
     }
@@ -3864,7 +4134,7 @@ function mapOtlpSpan(context) {
   warnings.push(...kindWarnings);
   const status = mapOtlpStatus(span.status);
   const tokenUsage = readOtlpTokenUsage(parsedSpanAttributes.attributes);
-  const errorMessage = isRecord7(span.status) && typeof span.status.message === "string" ? span.status.message : void 0;
+  const errorMessage = isRecord8(span.status) && typeof span.status.message === "string" ? span.status.message : void 0;
   const event = {
     schemaVersion: "0.2",
     eventId: typeof parsedSpanAttributes.attributes["agent_inspect.event_id"] === "string" ? parsedSpanAttributes.attributes["agent_inspect.event_id"] : spanId,
@@ -4660,7 +4930,7 @@ function diffRuns(left, right, options) {
 var EXPORT_PAYLOAD_VERSION = "0.1.2";
 
 // packages/core/src/exporters/redact-export.ts
-function isRecord8(value) {
+function isRecord9(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function deepClone(value) {
@@ -4734,7 +5004,7 @@ function redactEventAttributes(attrs, redactor, maxMetadataValueLength, maxPrevi
     0
   );
   const err = bounded.error;
-  if (isRecord8(err) && typeof err.message === "string") {
+  if (isRecord9(err) && typeof err.message === "string") {
     bounded.error = {
       ...err,
       message: truncateStringForProfile(
@@ -5337,6 +5607,453 @@ function exportRunTree(tree, options) {
   }
 }
 
+// packages/mcp-server/src/assess-trace.ts
+var DEFAULT_MAX_STRING_LENGTH = 16384;
+var DEFAULT_MAX_ARRAY_LENGTH = 1e3;
+var DEFAULT_MAX_OBJECT_KEYS = 200;
+var DEFAULT_MAX_SERIALIZED_BYTES = 128 * 1024;
+function buildMcpSafetyRules() {
+  return [
+    createSafetyRawContentRule(),
+    createSafetyRedactionRule(),
+    createSafetySecretPatternRule(),
+    createSafetyOversizedAttributeRule({
+      maxStringLength: DEFAULT_MAX_STRING_LENGTH,
+      maxArrayLength: DEFAULT_MAX_ARRAY_LENGTH,
+      maxObjectKeys: DEFAULT_MAX_OBJECT_KEYS,
+      maxSerializedBytes: DEFAULT_MAX_SERIALIZED_BYTES
+    })
+  ];
+}
+function statusFrom(findings, hasErrors) {
+  if (hasErrors) return "UNKNOWN";
+  if (findings.some((item) => item.severity === "error")) return "UNSAFE";
+  if (findings.some((item) => item.severity === "warning")) return "SAFE WITH WARNINGS";
+  return "SAFE";
+}
+function assessTraceForMcp(read, runId) {
+  const rules = buildMcpSafetyRules();
+  const checkResult = runTraceChecks({ read }, { rules, runId });
+  const hasErrors = checkResult.diagnostics.some((item) => item.severity === "error");
+  const status = statusFrom(checkResult.findings, hasErrors);
+  return {
+    status,
+    errors: checkResult.diagnostics.filter((item) => item.severity === "error").length + checkResult.findings.filter((item) => item.severity === "error").length,
+    warnings: checkResult.diagnostics.filter((item) => item.severity === "warning").length + checkResult.findings.filter((item) => item.severity === "warning").length,
+    findings: checkResult.findings.length
+  };
+}
+var DEFAULT_REDACT_KEYS2 = [
+  "authorization",
+  "cookie",
+  "token",
+  "apiKey",
+  "password",
+  "secret",
+  "email"
+];
+var SHARE_PROFILE_EXTRA_KEYS2 = [
+  "userEmail",
+  "customerEmail",
+  "phone",
+  "phoneNumber",
+  "address",
+  "ip",
+  "ipAddress",
+  "sessionId",
+  "requestId",
+  "correlationId",
+  "decisionId",
+  "groupId",
+  "customerId",
+  "userId",
+  "accountId",
+  "tenantId",
+  "orgId",
+  "organizationId",
+  "traceId",
+  "spanId",
+  "parentSpanId"
+];
+var STRICT_PROFILE_EXTRA_KEYS2 = [
+  "prompt",
+  "completion",
+  "input",
+  "output",
+  "inputPreview",
+  "outputPreview",
+  "message",
+  "messages",
+  "transcript",
+  "context",
+  "document",
+  "documents",
+  "chunk",
+  "chunks",
+  "retrieval",
+  "query"
+];
+function isRecord10(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function toKey2(key) {
+  return key.toLowerCase();
+}
+function stableHash2(value) {
+  const hash = crypto__default.default.createHash("sha256").update(value, "utf8").digest("hex");
+  return hash.slice(0, 8);
+}
+function stringifyScalar(value) {
+  if (typeof value === "string") return value;
+  if (typeof value === "number" || typeof value === "boolean" || typeof value === "bigint") {
+    return String(value);
+  }
+  return void 0;
+}
+function patternDetector(options) {
+  return {
+    id: options.id,
+    severity: options.severity ?? "warning",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      options.pattern.lastIndex = 0;
+      return options.pattern.test(input.value) ? [{ action: "replace", severity: options.severity ?? "warning", matchKind: "value" }] : [];
+    }
+  };
+}
+function digitsOnly(value) {
+  return value.replace(/\D/g, "");
+}
+function passesLuhn(value) {
+  const digits = digitsOnly(value);
+  if (digits.length < 13 || digits.length > 19) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i -= 1) {
+    let digit = Number(digits[i]);
+    if (double) {
+      digit *= 2;
+      if (digit > 9) digit -= 9;
+    }
+    sum += digit;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+var credentialDetectors = [
+  patternDetector({
+    id: "value.authorizationHeader",
+    pattern: /^(?:basic|bearer|digest|apikey)\s+[a-z0-9._~+/=-]+$/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.bearerToken",
+    pattern: /\bbearer\s+[a-z0-9._~+/=-]{12,}\b/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.cookie",
+    pattern: /\b[a-z0-9_.-]+=[^;\s]+(?:;\s*[a-z0-9_.-]+=[^;\s]+)+/i,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.jwt",
+    pattern: /\beyJ[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\.[a-zA-Z0-9_-]{8,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.providerApiKey",
+    pattern: /\b(?:sk-(?:proj-)?[a-zA-Z0-9_-]{16,}|sk-ant-[a-zA-Z0-9_-]{16,}|AIza[0-9A-Za-z_-]{20,})\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.githubToken",
+    pattern: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{20,}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.awsAccessKey",
+    pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/,
+    severity: "error"
+  }),
+  patternDetector({
+    id: "value.privateKey",
+    pattern: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*-----END [A-Z ]*PRIVATE KEY-----/,
+    severity: "error"
+  }),
+  {
+    id: "value.creditCard",
+    severity: "error",
+    matchKind: "value",
+    detect(input) {
+      if (typeof input.value !== "string") return [];
+      const candidatePattern = /(?:\d[ -]?){13,19}/g;
+      for (const match of input.value.matchAll(candidatePattern)) {
+        const candidate = match[0] ?? "";
+        if (passesLuhn(candidate)) {
+          return [{ action: "replace", severity: "error", matchKind: "value" }];
+        }
+      }
+      return [];
+    }
+  }
+];
+var identifierDetectors = [
+  patternDetector({
+    id: "value.email",
+    pattern: /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/i
+  }),
+  patternDetector({
+    id: "value.phone",
+    pattern: /\b(?:\+\d{1,3}[\s.-]?)?(?:\(?\d{3}\)?[\s.-])\d{3}[\s.-]\d{4}\b/
+  }),
+  patternDetector({
+    id: "value.ipv4",
+    pattern: /\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/
+  }),
+  patternDetector({
+    id: "value.ipv6",
+    pattern: /\b(?:[0-9a-f]{1,4}:){2,7}[0-9a-f]{1,4}\b/i
+  })
+];
+function builtInDetectorsForProfile(profile) {
+  if (profile === "local") return credentialDetectors;
+  return [...credentialDetectors, ...identifierDetectors];
+}
+function compileRules2(rules, extraKeys) {
+  const out = /* @__PURE__ */ new Map();
+  const set = (rule) => {
+    const key = toKey2(rule.key);
+    out.set(key, { ...rule, key });
+  };
+  for (const key of DEFAULT_REDACT_KEYS2) {
+    set({ key, strategy: "full" });
+  }
+  for (const key of extraKeys ?? []) {
+    if (typeof key === "string" && key.length > 0) {
+      set({ key, strategy: "full" });
+    }
+  }
+  for (const rule of rules ?? []) {
+    if (typeof rule === "string") {
+      set({ key: rule, strategy: "full" });
+      continue;
+    }
+    if (rule.strategy === "full") set({ key: rule.key, strategy: "full" });
+    if (rule.strategy === "hash") set({ key: rule.key, strategy: "hash" });
+    if (rule.strategy === "prefix") {
+      set({
+        key: rule.key,
+        strategy: "prefix",
+        keep: typeof rule.keep === "number" ? rule.keep : 8
+      });
+    }
+  }
+  return [...out.values()];
+}
+function actionForRule(rule) {
+  if (rule.strategy === "full") return "replace";
+  return rule.strategy;
+}
+function applyRule(rule, value, replacement) {
+  if (rule.strategy === "full") return replacement;
+  const asString = stringifyScalar(value);
+  if (rule.strategy === "prefix") {
+    if (asString === void 0) return replacement;
+    const keep = Math.max(0, Math.floor(rule.keep));
+    return asString.length <= keep ? `${asString}\u2026` : `${asString.slice(0, keep)}\u2026`;
+  }
+  if (rule.strategy === "hash") {
+    if (asString === void 0) return "[HASH:unknown]";
+    return `[HASH:${stableHash2(asString)}]`;
+  }
+  return value;
+}
+function childPath(path13, key) {
+  if (/^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key)) {
+    return path13 ? `${path13}.${key}` : key;
+  }
+  return `${path13 || "$"}[${JSON.stringify(key)}]`;
+}
+function indexPath(path13, index) {
+  return `${path13 || "$"}[${index}]`;
+}
+function makeFinding(path13, detector, action, matchKind, severity = "warning", preview) {
+  return preview === void 0 ? { path: path13, detector, action, severity, matchKind } : { path: path13, detector, action, severity, matchKind, preview };
+}
+function createRedactionProfile(profile = "local") {
+  switch (profile) {
+    case "local":
+      return { profile: "local", extraKeys: [] };
+    case "share":
+      return {
+        profile: "share",
+        extraKeys: SHARE_PROFILE_EXTRA_KEYS2,
+        maxMetadataValueLengthCap: 500,
+        maxPreviewLengthCap: 200
+      };
+    case "strict":
+      return {
+        profile: "strict",
+        extraKeys: [...SHARE_PROFILE_EXTRA_KEYS2, ...STRICT_PROFILE_EXTRA_KEYS2],
+        maxMetadataValueLengthCap: 200,
+        maxPreviewLengthCap: 80
+      };
+  }
+}
+var Redactor2 = class {
+  #rules;
+  #detectors;
+  #profile;
+  #replacement;
+  #maxDepth;
+  #collectFindings;
+  constructor(options) {
+    const resolved = createRedactionProfile(options?.profile ?? "local");
+    this.#profile = resolved.profile;
+    this.#rules = compileRules2(options?.rules, [
+      ...resolved.extraKeys,
+      ...options?.extraKeys ?? []
+    ]);
+    this.#detectors = [
+      ...builtInDetectorsForProfile(this.#profile),
+      ...options?.detectors ?? []
+    ];
+    this.#replacement = options?.replacement ?? "[REDACTED]";
+    this.#maxDepth = options?.maxDepth ?? 32;
+    this.#collectFindings = options?.collectFindings ?? true;
+  }
+  redactValue(key, value) {
+    return this.#redactValue(value, key, key, 0, {
+      findings: [],
+      seen: /* @__PURE__ */ new WeakMap()
+    });
+  }
+  redactRecord(record) {
+    return this.redact(record).value;
+  }
+  redact(value) {
+    const state = {
+      findings: [],
+      seen: /* @__PURE__ */ new WeakMap()
+    };
+    const redacted = this.#redactValue(value, void 0, "$", 0, state);
+    return {
+      value: redacted,
+      findings: state.findings,
+      redacted: state.findings.some((finding) => finding.action !== "keep"),
+      profile: this.#profile
+    };
+  }
+  #recordFinding(state, finding) {
+    if (this.#collectFindings) state.findings.push(finding);
+  }
+  #redactValue(value, key, path13, depth, state) {
+    if (depth > this.#maxDepth) {
+      this.#recordFinding(
+        state,
+        makeFinding(path13, "structure.maxDepth", "truncate", "value", "warning")
+      );
+      return "[Truncated]";
+    }
+    if (key !== void 0) {
+      const rule = this.#rules.find((candidate) => candidate.key === toKey2(key));
+      if (rule) {
+        this.#recordFinding(
+          state,
+          makeFinding(path13, `key.${rule.key}`, actionForRule(rule), "key", "warning")
+        );
+        return applyRule(rule, value, this.#replacement);
+      }
+    }
+    for (const detector of this.#detectors) {
+      const detections = detector.detect({ path: path13, key, value });
+      for (const detection of detections) {
+        const action = detection.action ?? "replace";
+        this.#recordFinding(
+          state,
+          makeFinding(
+            path13,
+            detector.id,
+            action,
+            detection.matchKind ?? detector.matchKind ?? "custom",
+            detection.severity ?? detector.severity ?? "warning",
+            detection.preview
+          )
+        );
+        if (action !== "keep") {
+          return detection.replacement ?? this.#replacement;
+        }
+      }
+    }
+    if (Array.isArray(value)) {
+      if (state.seen.has(value)) return state.seen.get(value);
+      const out = [];
+      state.seen.set(value, out);
+      value.forEach((item, index) => {
+        out[index] = this.#redactValue(item, void 0, indexPath(path13, index), depth + 1, state);
+      });
+      return out;
+    }
+    if (isRecord10(value)) {
+      if (state.seen.has(value)) return state.seen.get(value);
+      const out = {};
+      state.seen.set(value, out);
+      for (const [entryKey, entryValue] of Object.entries(value)) {
+        out[entryKey] = this.#redactValue(
+          entryValue,
+          entryKey,
+          childPath(path13 === "$" ? "" : path13, entryKey),
+          depth + 1,
+          state
+        );
+      }
+      return out;
+    }
+    return value;
+  }
+};
+function createRedactor(options) {
+  return new Redactor2(options);
+}
+function redact(value, options) {
+  return createRedactor(options).redact(value);
+}
+
+// packages/mcp-server/src/prepare-result.ts
+var DEFAULT_MCP_RESULT_MAX_BYTES = 512 * 1024;
+function stableStringify(value) {
+  return JSON.stringify(value);
+}
+function prepareMcpToolResult(payload, options = {}) {
+  const maxBytes = options.maxBytes ?? DEFAULT_MCP_RESULT_MAX_BYTES;
+  const profile = options.redactionProfile ?? "share";
+  const diagnostics = [];
+  const redacted = redact(payload, { profile });
+  let result = redacted.value;
+  const redactionFindings = redacted.findings.length;
+  if (redactionFindings > 0) {
+    diagnostics.push(`Redacted ${redactionFindings} sensitive value(s) from MCP tool result.`);
+  }
+  let text = stableStringify(result);
+  let truncated = false;
+  if (text.length > maxBytes) {
+    truncated = true;
+    diagnostics.push(
+      `MCP tool result truncated from ${text.length} to ${maxBytes} bytes.`
+    );
+    text = `${text.slice(0, maxBytes)}
+\u2026[truncated]`;
+    try {
+      result = JSON.parse(text.replace(/\n…\[truncated\]$/, ""));
+    } catch {
+      result = { truncated: true, preview: text.slice(0, maxBytes) };
+    }
+  }
+  return { payload: result, diagnostics, truncated, redactionFindings };
+}
+
 // packages/mcp-server/src/tools.ts
 var READ_ONLY_TOOLS = [
   {
@@ -5453,6 +6170,20 @@ function textResult(payload) {
     isError: false
   };
 }
+function deliverMcpPayload(payload, context) {
+  const prepared = prepareMcpToolResult(payload, {
+    redactionProfile: redactionProfileForExport(context)
+  });
+  const body = prepared.diagnostics.length > 0 || prepared.truncated ? {
+    ...typeof prepared.payload === "object" && prepared.payload !== null && !Array.isArray(prepared.payload) ? prepared.payload : { value: prepared.payload },
+    _mcp: {
+      diagnostics: prepared.diagnostics,
+      truncated: prepared.truncated,
+      redactionFindings: prepared.redactionFindings
+    }
+  } : prepared.payload;
+  return textResult(body);
+}
 function errorResult2(message) {
   return {
     content: [{ type: "text", text: message }],
@@ -5502,25 +6233,29 @@ async function callReadOnlyTool(context, name, args = {}) {
         files,
         (fileName) => td.getPath(fileName)
       );
-      return textResult(
+      return deliverMcpPayload(
         metas.map((meta) => ({
           runId: meta.runId,
           name: meta.name,
           status: meta.status,
           file: path__default.default.basename(meta.filePath)
-        }))
+        })),
+        context
       );
     }
     case "read_trace": {
       const runId = String(args.runId ?? "");
       const { read } = await openRunTrace(context, runId);
       const events = read.events.length > context.maxEvents ? read.events.slice(0, context.maxEvents) : read.events;
-      return textResult({
-        runId,
-        format: read.format,
-        truncated: read.events.length > events.length,
-        events
-      });
+      return deliverMcpPayload(
+        {
+          runId,
+          format: read.format,
+          truncated: read.events.length > events.length,
+          events
+        },
+        context
+      );
     }
     case "search_traces": {
       const query = String(args.query ?? "").trim();
@@ -5537,17 +6272,20 @@ async function callReadOnlyTool(context, name, args = {}) {
         name: query,
         limit: 25
       });
-      return textResult(results);
+      return deliverMcpPayload(results, context);
     }
     case "find_first_error": {
       const runId = String(args.runId ?? "");
       const { read } = await openRunTrace(context, runId);
       const timeline = buildRunTimeline(legacyTraceEvents(read.events));
       const firstError = timeline.entries.find((entry) => entry.isError);
-      return textResult({
-        runId,
-        firstError: firstError ?? null
-      });
+      return deliverMcpPayload(
+        {
+          runId,
+          firstError: firstError ?? null
+        },
+        context
+      );
     }
     case "find_slowest_path": {
       const runId = String(args.runId ?? "");
@@ -5557,11 +6295,14 @@ async function callReadOnlyTool(context, name, args = {}) {
         slowTopN: 5
       });
       const ranked = [...timeline.entries].filter((entry) => entry.durationMs !== void 0 && Number.isFinite(entry.durationMs)).sort((a, b) => (b.durationMs ?? 0) - (a.durationMs ?? 0)).slice(0, 5);
-      return textResult({
-        runId,
-        slowest: ranked[0] ?? null,
-        top: ranked
-      });
+      return deliverMcpPayload(
+        {
+          runId,
+          slowest: ranked[0] ?? null,
+          top: ranked
+        },
+        context
+      );
     }
     case "compare_runs": {
       const leftRunId = String(args.leftRunId ?? "");
@@ -5572,11 +6313,14 @@ async function callReadOnlyTool(context, name, args = {}) {
         manualTraceEventsToComparableRun(legacyTraceEvents(left.read.events)),
         manualTraceEventsToComparableRun(legacyTraceEvents(right.read.events))
       );
-      return textResult({
-        summary: diff.summary,
-        differences: diff.differences.slice(0, 50),
-        truncated: diff.differences.length > 50
-      });
+      return deliverMcpPayload(
+        {
+          summary: diff.summary,
+          differences: diff.differences.slice(0, 50),
+          truncated: diff.differences.length > 50
+        },
+        context
+      );
     }
     case "run_checks": {
       const runId = String(args.runId ?? "");
@@ -5585,7 +6329,7 @@ async function callReadOnlyTool(context, name, args = {}) {
         { read },
         { rules: [createRunStatusRule()], select: ["run.status"], runId }
       );
-      return textResult(result);
+      return deliverMcpPayload(result, context);
     }
     case "create_share_safe_report": {
       const runId = String(args.runId ?? "");
@@ -5595,43 +6339,55 @@ async function callReadOnlyTool(context, name, args = {}) {
       const profile = redactionProfileForExport(context);
       const markdown = exportMarkdown(run, {
         redacted: true});
-      return textResult({ runId, profile, markdown: markdown.content });
+      return deliverMcpPayload({ runId, profile, markdown: markdown.content }, context);
     }
     case "summarize_failed_run": {
       const runId = String(args.runId ?? "");
       const { read } = await openRunTrace(context, runId);
       const traceEvents = legacyTraceEvents(read.events);
       const summary = buildRunWhatSummary(traceEvents);
-      return textResult({
-        runId,
-        status: summary.status,
-        summary: renderRunWhat(summary),
-        failedStepNames: summary.failedStepNames,
-        correlation: summary.correlation ?? null
-      });
+      return deliverMcpPayload(
+        {
+          runId,
+          status: summary.status,
+          summary: renderRunWhat(summary),
+          failedStepNames: summary.failedStepNames,
+          correlation: summary.correlation ?? null
+        },
+        context
+      );
     }
     case "retrieve_decision_notes": {
       const runId = String(args.runId ?? "");
       const { read } = await openRunTrace(context, runId);
       const notes = decisionNotes(read.events);
-      return textResult({ runId, decisions: notes, count: notes.length });
+      return deliverMcpPayload({ runId, decisions: notes, count: notes.length }, context);
     }
     case "find_failed_observation": {
       const runId = String(args.runId ?? "");
       const { read } = await openRunTrace(context, runId);
       const outcomes = extractOutcomesFromTraceEvents(legacyTraceEvents(read.events));
       const failed = outcomes.filter((outcome) => outcome.status === "failed");
-      return textResult({
-        runId,
-        failed,
-        count: failed.length
-      });
+      return deliverMcpPayload(
+        {
+          runId,
+          failed,
+          count: failed.length
+        },
+        context
+      );
     }
     case "create_share_safe_bundle": {
       const runId = String(args.runId ?? "");
       const { read } = await openRunTrace(context, runId);
       const run = read.runs.find((item) => item.runId === runId) ?? read.runs[0];
       if (!run) return errorResult2(`Run tree not found: ${runId}`);
+      const safety = assessTraceForMcp(read, runId);
+      if (bundleFailsOnSafety(safety.status)) {
+        return errorResult2(
+          `Share-safe bundle refused: safety status is ${safety.status}. Resolve findings before export.`
+        );
+      }
       const profile = redactionProfileForExport(context);
       const markdown = exportMarkdown(run, {
         redacted: true});
@@ -5645,20 +6401,31 @@ async function callReadOnlyTool(context, name, args = {}) {
         profile,
         resolve: { runIds: [runId] },
         checks: {
-          aggregateStatus: "SAFE",
-          runs: [{ runId, status: "SAFE", errors: 0, warnings: 0, findings: 0 }]
+          aggregateStatus: safety.status,
+          runs: [
+            {
+              runId,
+              status: safety.status,
+              errors: safety.errors,
+              warnings: safety.warnings,
+              findings: safety.findings
+            }
+          ]
         },
         files: ["report.md", "tree.json"]
       });
-      return textResult({
-        runId,
-        profile,
-        metadata,
-        files: {
-          "report.md": markdown.content,
-          "tree.json": tree.content
-        }
-      });
+      return deliverMcpPayload(
+        {
+          runId,
+          profile,
+          metadata,
+          files: {
+            "report.md": markdown.content,
+            "tree.json": tree.content
+          }
+        },
+        context
+      );
     }
     default:
       return errorResult2(`Unknown tool: ${name}`);