@mastra/mcp-docs-server 1.2.15 → 1.2.16-alpha.1

package/.docs/docs/observability/integrations/processors/sensitive-data-filter.md

@@ -1,302 +0,0 @@
-> Discover all available pages from the documentation index: https://mastra.ai/llms.txt
-
-# Sensitive data filter
-
-The Sensitive Data Filter is a span processor that redacts sensitive information from your traces during the processing pipeline before export. This ensures that passwords, API keys, tokens, and other confidential data never leave your application or get stored in observability platforms.
-
-## Default configuration
-
-The Sensitive Data Filter is included in the recommended observability configuration:
-
-```ts
-import {
-  Observability,
-  MastraStorageExporter,
-  MastraPlatformExporter,
-  SensitiveDataFilter,
-} from '@mastra/observability'
-
-export const mastra = new Mastra({
-  observability: new Observability({
-    configs: {
-      default: {
-        serviceName: 'mastra',
-        exporters: [new MastraStorageExporter(), new MastraPlatformExporter()],
-        spanOutputProcessors: [
-          new SensitiveDataFilter(), // Redacts sensitive fields before export
-        ],
-      },
-    },
-  }),
-  storage: new LibSQLStore({
-    id: 'mastra-storage',
-    url: 'file:./mastra.db',
-  }),
-})
-```
-
-With the default configuration, the filter redacts these common sensitive field names:
-
-- `password`
-- `token`
-- `secret`
-- `key`
-- `apikey`
-- `auth`
-- `authorization`
-- `bearer`
-- `bearertoken`
-- `jwt`
-- `credential`
-- `clientsecret`
-- `privatekey`
-- `refresh`
-- `ssn`
-
-> **Note:** Field matching is case-insensitive and normalizes separators. For example, `api-key`, `api_key`, and `Api Key` are all treated as `apikey`.
-
-## How it works
-
-The Sensitive Data Filter processes spans before they're sent to exporters, scanning through:
-
-- **Attributes** - Span metadata and properties
-- **Metadata** - Custom metadata attached to spans
-- **Input** - Data sent to agents, tools, and LLMs
-- **Output** - Responses and results
-- **Error Information** - Stack traces and error details
-
-When a sensitive field is detected, its value is replaced with `[REDACTED]` by default. The filter handles nested objects, arrays, and circular references safely.
-
-## Custom configuration
-
-You can customize which fields are redacted and how redaction displays:
-
-```ts
-import { SensitiveDataFilter, MastraStorageExporter, Observability } from '@mastra/observability'
-
-export const mastra = new Mastra({
-  observability: new Observability({
-    configs: {
-      production: {
-        serviceName: 'my-service',
-        exporters: [new MastraStorageExporter()],
-        spanOutputProcessors: [
-          new SensitiveDataFilter({
-            // Add custom sensitive fields
-            sensitiveFields: [
-              // Default fields
-              'password',
-              'token',
-              'secret',
-              'key',
-              'apikey',
-              // Custom fields for your application
-              'creditCard',
-              'bankAccount',
-              'routingNumber',
-              'email',
-              'phoneNumber',
-              'dateOfBirth',
-            ],
-            // Custom redaction token
-            redactionToken: '***SENSITIVE***',
-            // Redaction style
-            redactionStyle: 'full', // or 'partial'
-          }),
-        ],
-      },
-    },
-  }),
-})
-```
-
-## Redaction styles
-
-The filter supports two redaction styles:
-
-### Full Redaction (Default)
-
-Replaces the entire value with a fixed token:
-
-```jsonc
-// Before
-{
-  "apiKey": "sk-abc123xyz789def456",
-  "userId": "user_12345"
-}
-
-// After
-{
-  "apiKey": "[REDACTED]",
-  "userId": "user_12345"
-}
-```
-
-### Partial Redaction
-
-Shows the first and last 3 characters, useful for debugging without exposing full values:
-
-```ts
-new SensitiveDataFilter({
-  redactionStyle: 'partial',
-})
-```
-
-```json
-// Before
-{
-  "apiKey": "sk-abc123xyz789def456",
-  "creditCard": "4111111111111111"
-}
-
-// After
-{
-  "apiKey": "sk-…456",
-  "creditCard": "411…111"
-}
-```
-
-Values shorter than 7 characters are fully redacted to prevent information leakage.
-
-## Field matching rules
-
-The filter uses intelligent field matching:
-
-1. **Case-Insensitive**: `APIKey`, `apikey`, and `ApiKey` are all matched
-
-2. **Separator-Agnostic**: `api-key`, `api_key`, and `apiKey` are treated identically
-
-3. **Exact Matching**: After normalization, fields must match exactly
-
-   - `token` matches `token`, `Token`, `TOKEN`
-   - `token` doesn't match `promptTokens` or `tokenCount`
-
-## Nested object handling
-
-The filter recursively processes nested structures:
-
-```json
-// Before
-{
-  "user": {
-    "id": "12345",
-    "credentials": {
-      "password": "SuperSecret123!",
-      "apiKey": "sk-production-key"
-    }
-  },
-  "config": {
-    "auth": {
-      "jwt": "eyJhbGciOiJIUzI1NiIs..."
-    }
-  }
-}
-
-// After
-{
-  "user": {
-    "id": "12345",
-    "credentials": {
-      "password": "[REDACTED]",
-      "apiKey": "[REDACTED]"
-    }
-  },
-  "config": {
-    "auth": {
-      "jwt": "[REDACTED]"
-    }
-  }
-}
-```
-
-## Performance considerations
-
-The Sensitive Data Filter is designed to be lightweight and efficient:
-
-- **Synchronous Processing**: No async operations, minimal latency impact
-- **Circular Reference Handling**: Safely handles complex object graphs
-- **Error Recovery**: If filtering fails, the field is replaced with an error marker rather than crashing
-
-## Disabling the filter
-
-If you need to disable sensitive data filtering (not recommended for production):
-
-```ts
-export const mastra = new Mastra({
-  observability: new Observability({
-    configs: {
-      debug: {
-        serviceName: 'debug-service',
-        spanOutputProcessors: [], // No processors, including no SensitiveDataFilter
-        exporters: [new MastraStorageExporter()],
-      },
-    },
-  }),
-})
-```
-
-> **Warning:** Only disable sensitive data filtering in controlled environments. Never disable it when sending traces to external services or shared storage.
-
-## Common use cases
-
-### Healthcare Applications
-
-```ts
-new SensitiveDataFilter({
-  sensitiveFields: [
-    // HIPAA-related fields
-    'ssn',
-    'socialSecurityNumber',
-    'medicalRecordNumber',
-    'mrn',
-    'healthInsuranceNumber',
-    'diagnosisCode',
-    'icd10',
-    'prescription',
-    'medication',
-  ],
-})
-```
-
-### Financial Services
-
-```ts
-new SensitiveDataFilter({
-  sensitiveFields: [
-    // PCI compliance fields
-    'creditCard',
-    'ccNumber',
-    'cardNumber',
-    'cvv',
-    'cvc',
-    'securityCode',
-    'expirationDate',
-    'expiry',
-    'bankAccount',
-    'accountNumber',
-    'routingNumber',
-    'iban',
-    'swift',
-  ],
-})
-```
-
-## Error handling
-
-If the filter encounters an error while processing a field, it replaces the field with a safe error marker:
-
-```json
-{
-  "problematicField": {
-    "error": {
-      "processor": "sensitive-data-filter"
-    }
-  }
-}
-```
-
-As a result, processing errors don't prevent traces from being exported or cause application crashes.
-
-## Related
-
-- [SensitiveDataFilter API](https://mastra.ai/reference/observability/tracing/processors/sensitive-data-filter)