Tin Chi Lo cf08c07fbb fix(mcp): key every caller-visible listing surface by the display prefix, never canonical names ... Outcome keys in the tools/list _meta, the spend-log outcome and count maps, and the REST error messages now all use get_server_prefix (alias, or the short prefix when that mode is enabled), the same naming the caller already sees on tool names. Keying them by canonical server_name let an authenticated caller enumerate internal server names and their health or auth state that the alias and short-prefix schemes deliberately hide (Veria finding). One helper decides the key for every surface; exception messages reaching the multi-server REST error list are mapped to their fault tag with the display prefix instead of relaying exception text carrying canonical names. Server-side logs keep the real names		2026-07-17 13:31:21 -07:00
..
mcp_server	fix(mcp): key every caller-visible listing surface by the display prefix, never canonical names	2026-07-17 13:31:21 -07:00