Sanitize credentials in Docker command logs

[Copilot]

Docker environment variables containing secrets (e.g., GITHUB_PERSONAL_ACCESS_TOKEN=ghp_xxx...) were being logged in plaintext when launching MCP backend servers.

Changes

• Added SanitizeArgs() function (internal/logger/sanitize/sanitize.go)

  • Detects -e VAR=VALUE patterns in Docker args
  • Truncates values using existing TruncateSecret() (shows first 4 chars + "...")
  • Preserves non-env-var arguments unchanged

• Updated logging statements to sanitize args before output:

  • internal/launcher/launcher.go: 4 locations (GetOrLaunch, GetOrLaunchForSession)
  • internal/mcp/connection.go: 5 locations (NewConnection, startup, error paths)

• Test coverage: 13 test cases including dedicated leak detection test

Example

Before:

[INFO] [backend] args=[run -e GITHUB_PERSONAL_ACCESS_TOKEN=ghp_1234567890123456789012345678901234567890 ...]

After:

[INFO] [backend] args=[run -e GITHUB_PERSONAL_ACCESS_TOKEN=ghp_... ...]

Variable names remain visible for debugging while values are safely truncated.

Warning

GitHub's Secret Scanning detected potential secrets in the added content. We attempted to remediate the issue by updating the code or redacting.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3753664088/b278/mcp.test /tmp/go-build3753664088/b278/mcp.test -test.testlogfile=/tmp/go-build3753664088/b278/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true -c=4 -nolocalimports -importcfg /tmp/go-build3753664088/b243/importcfg -pack /home/REDACTED/go/pkg/mod/github.com/modelcontextprotocol/go-sdk@v1.1.0/internal/util/util.go 64/pkg/include ortc�� 64/src/runtime/cgo 64/src/weak/doc.go ache/go/1.25.5/x64/pkg/tool/linu-o pull.rebase (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.