oct.mcp.redactor module

oct.mcp.redactor module#

Purpose#

Output Redactor (Layer 5) for the oct-mcp six-layer pipeline. Applies a five-step sanitisation pipeline to every tool output before it is returned to the MCP client.

Responsibilities#

  • Step 1: Apply redaction_patterns from debug_config.json (loaded at server startup; falls back to empty list if unavailable).

  • Step 2: Apply _SECRET_NAME_PATTERNS line filtering — any output line that looks like a KEY=value assignment whose key matches a secret pattern is replaced with [REDACTED].

  • Step 3: Anonymise absolute paths:

    $HOME/... → [HOME]/... /usr/, /bin/, /opt/, etc. → [SYSTEM]/... <project_root>/... → [PROJECT]/... Drive-letter paths on Windows follow the same rules.

  • Step 4: Strip ANSI escape sequences.

  • Step 5: Truncate output that exceeds max_output_bytes, appending a [OUTPUT TRUNCATED AT <N> BYTES] marker.

Also applies git-URL credential redaction (_redact_git_url) as a supplementary step after step 2 to catch any credentials that survived the key-pattern filter.

Diagnostics#

Domain: MCP Levels:

L2 — lifecycle: redactor instantiation L3 — per-call redaction counts L4 — deep trace: individual substitutions

Contracts#

  • This module does not import click or the MCP SDK.

  • Redactor.apply_all() is pure: the same input always produces the same output given the same configuration.

  • Redactor.apply_all() never raises.

  • redactions_applied in RedactorResult counts all individual substitutions made across all steps.

class oct.mcp.redactor.Redactor(redaction_patterns: list[str | dict] | None = None, max_output_bytes: int = 1048576)[source]#

Bases: object

Five-step output sanitisation pipeline (Layer 5).

Parameters:

  • redaction_patterns – List of regex patterns loaded from debug_config.json. Each entry may be a plain string (treated as a literal) or a dict with keys pattern (regex) and replacement (substitution, default "[REDACTED]"). Patterns that fail to compile are silently skipped.

  • max_output_bytes – Hard truncation limit. Default 1 MB. Matches McpConfig max_output_bytes.

apply_all(text: str, project_root: Path) → RedactorResult[source]#

Run the full five-step pipeline on text.

Never raises. Any unexpected exception is caught and the original text is returned with a warning prepended.

Parameters:

  • text – Raw tool output to sanitise.

  • project_root – Absolute path to the project root (used for step 3 path anonymisation).

Return type:

RedactorResult

class oct.mcp.redactor.RedactorResult(text: str, redactions_applied: int, truncated: bool, original_size_bytes: int)[source]#

Bases: object

Output from Redactor.apply_all().

text#

The sanitised output string.

Type:

str

redactions_applied#

Total number of individual substitutions performed across all five pipeline steps.

Type:

int

truncated#

True if the output was truncated to max_output_bytes.

Type:

bool

original_size_bytes#

Byte length of the input text (before any processing).

Type:

int

original_size_bytes: int#
redactions_applied: int#
text: str#
truncated: bool#