From af1eb5bbe68abb6b17922f069dce24383bab9e97 Mon Sep 17 00:00:00 2001 From: "xzq.xu" Date: Thu, 26 Mar 2026 14:01:03 +0800 Subject: [PATCH] fix(security): stop leaking Python tracebacks to MCP clients Error handlers in execute_task, fix_skill, and upload_skill returned traceback.format_exc() to MCP clients, exposing internal file paths, code structure, and potentially sensitive details. The full traceback is already logged server-side via logger.error(exc_info=True). Remove the traceback field from client-facing error responses and clean up the unused traceback import. Closes #19 Made-with: Cursor --- openspace/mcp_server.py | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/openspace/mcp_server.py b/openspace/mcp_server.py index b010f2f..168485c 100644 --- a/openspace/mcp_server.py +++ b/openspace/mcp_server.py @@ -22,7 +22,6 @@ import json import logging import os import sys -import traceback from pathlib import Path from typing import Any, Dict, List, Optional @@ -597,7 +596,7 @@ async def execute_task( except Exception as e: logger.error(f"execute_task failed: {e}", exc_info=True) - return _json_error(e, status="error", traceback=traceback.format_exc(limit=5)) + return _json_error(e, status="error") @mcp.tool() @@ -818,7 +817,7 @@ async def fix_skill( except Exception as e: logger.error(f"fix_skill failed: {e}", exc_info=True) - return _json_error(e, status="error", traceback=traceback.format_exc(limit=5)) + return _json_error(e, status="error") @mcp.tool() @@ -889,7 +888,7 @@ async def upload_skill( except Exception as e: logger.error(f"upload_skill failed: {e}", exc_info=True) - return _json_error(e, status="error", traceback=traceback.format_exc(limit=5)) + return _json_error(e, status="error") def run_mcp_server() -> None: """Console-script entry point for ``openspace-mcp``."""