feat(streamable-proxy,transparent-proxy,vmcp-server,operator): opt-in secret redaction for tool-call results

cmd/thv-operator/api/v1beta1/mcpserver_types.go

@@ -369,6 +369,18 @@ type MCPServerSpec struct {
 	// +optional
 	TrustProxyHeaders bool `json:"trustProxyHeaders,omitempty"`
 
+	// RedactToolResultSecrets enables best-effort credential-shape scanning
+	// on tools/call responses (AWS/GitHub/Slack/Google/Stripe keys, JWTs, PEM
+	// private keys): matches are redacted before the response reaches the
+	// client. Off by default; enable when the backend MCP server is not
+	// fully trusted. This setting is ONLY applicable when Transport is
+	// "stdio" (the streamable-HTTP proxy path) -- it has no effect when
+	// Transport is "streamable-http" or "sse" (those reverse-proxy to an
+	// already-HTTP backend without inspecting message content).
+	// +kubebuilder:default=false
+	// +optional
+	RedactToolResultSecrets bool `json:"redactToolResultSecrets,omitempty"`
+
 	// EndpointPrefix is the path prefix to prepend to SSE endpoint URLs.
 	// This is used to handle path-based ingress routing scenarios where the ingress
 	// strips a path prefix before forwarding to the backend.

cmd/thv-operator/controllers/mcpserver_runconfig.go

@@ -150,6 +150,7 @@ func (r *MCPServerReconciler) createRunConfigFromMCPServer(m *mcpv1beta1.MCPServ
 		runner.WithProxyMode(transporttypes.ProxyMode(effectiveProxyMode)),
 		runner.WithHost(proxyHost),
 		runner.WithTrustProxyHeaders(m.Spec.TrustProxyHeaders),
+		runner.WithRedactToolResultSecrets(m.Spec.RedactToolResultSecrets),
 		runner.WithEndpointPrefix(m.Spec.EndpointPrefix),
 		runner.WithToolsFilter(toolsFilter),
 		runner.WithEnvVars(envVars),

cmd/thv-operator/controllers/mcpserver_runconfig_test.go

@@ -1681,3 +1681,42 @@ func TestCreateRunConfigFromMCPServer_SetsMCPServerGeneration(t *testing.T) {
 	assert.Equal(t, int64(7), rc.MCPServerGeneration,
 		"MCPServerGeneration should match MCPServer .metadata.generation")
 }
+
+// TestCreateRunConfigFromMCPServer_RedactToolResultSecrets verifies
+// MCPServerSpec.RedactToolResultSecrets flows into RunConfig, mirroring
+// TrustProxyHeaders's plumbing.
+func TestCreateRunConfigFromMCPServer_RedactToolResultSecrets(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name    string
+		enabled bool
+	}{
+		{name: "enabled", enabled: true},
+		{name: "disabled (default)", enabled: false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			m := v1beta1test.NewMCPServer("redact-secrets-server", "default",
+				v1beta1test.WithImage("ghcr.io/example/mcp:v1"),
+				v1beta1test.Mutate(func(m *mcpv1beta1.MCPServer) {
+					m.Spec.RedactToolResultSecrets = tt.enabled
+				}))
+
+			r := newTestMCPServerReconciler(
+				fake.NewClientBuilder().WithScheme(testutil.NewScheme(t)).WithObjects(m).Build(),
+				testutil.NewScheme(t),
+				kubernetes.PlatformKubernetes,
+			)
+
+			rc, err := r.createRunConfigFromMCPServer(m)
+
+			require.NoError(t, err)
+			require.NotNil(t, rc)
+			assert.Equal(t, tt.enabled, rc.RedactToolResultSecrets)
+		})
+	}
+}

cmd/thv/app/run_flags.go

@@ -106,6 +106,10 @@ type RunFlags struct {
 	// on the streamable HTTP proxy.
 	StrictProtocolValidation bool
 
+	// RedactToolResultSecrets enables best-effort credential-shape scanning
+	// on tools/call responses relayed by the streamable HTTP proxy.
+	RedactToolResultSecrets bool
+
 	// Endpoint prefix for SSE endpoint URLs
 	EndpointPrefix string
 
@@ -290,6 +294,10 @@ func AddRunFlags(cmd *cobra.Command, config *RunFlags) {
 	cmd.Flags().BoolVar(&config.StrictProtocolValidation, "strict-protocol-validation", false,
 		"Reject client requests whose MCP-Protocol-Version header is an unknown/unsupported MCP revision with HTTP 400 "+
 			"(streamable-HTTP proxy only; an absent header is accepted). Off by default: any version is accepted.")
+	cmd.Flags().BoolVar(&config.RedactToolResultSecrets, "redact-tool-result-secrets", false,
+		"Scan tools/call responses for credential-shaped content (AWS/GitHub/Slack/Google/Stripe keys, JWTs, PEM "+
+			"private keys, generic Bearer tokens) and redact matches before relaying them to the client. "+
+			"Off by default; enable when the backend MCP server is not fully trusted.")
 	cmd.Flags().BoolVar(&config.Stateless, "stateless", false,
 		"Declare the server as stateless (POST-only, no SSE). "+
 			"Use for MCP servers implementing streamable-HTTP stateless mode.")
@@ -705,6 +713,7 @@ func buildRunnerConfig(
 		runner.WithAllowDockerGateway(runFlags.AllowDockerGateway),
 		runner.WithTrustProxyHeaders(runFlags.TrustProxyHeaders),
 		runner.WithStrictProtocolValidation(runFlags.StrictProtocolValidation),
+		runner.WithRedactToolResultSecrets(runFlags.RedactToolResultSecrets),
 		runner.WithStateless(runFlags.Stateless),
 		runner.WithSessionTTL(runFlags.SessionTTL),
 		runner.WithEndpointPrefix(runFlags.EndpointPrefix),

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_mcpservers.yaml

@@ -515,6 +515,18 @@ spec:
                 - message: at least one of shared, perUser, or tools must be configured
                   rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                     && size(self.tools) > 0)
+              redactToolResultSecrets:
+                default: false
+                description: |-
+                  RedactToolResultSecrets enables best-effort credential-shape scanning
+                  on tools/call responses (AWS/GitHub/Slack/Google/Stripe keys, JWTs, PEM
+                  private keys): matches are redacted before the response reaches the
+                  client. Off by default; enable when the backend MCP server is not
+                  fully trusted. This setting is ONLY applicable when Transport is
+                  "stdio" (the streamable-HTTP proxy path) -- it has no effect when
+                  Transport is "streamable-http" or "sse" (those reverse-proxy to an
+                  already-HTTP backend without inspecting message content).
+                type: boolean
               replicas:
                 description: |-
                   Replicas is the desired number of proxy runner (thv run) pod replicas.
@@ -1459,6 +1471,18 @@ spec:
                 - message: at least one of shared, perUser, or tools must be configured
                   rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                     && size(self.tools) > 0)
+              redactToolResultSecrets:
+                default: false
+                description: |-
+                  RedactToolResultSecrets enables best-effort credential-shape scanning
+                  on tools/call responses (AWS/GitHub/Slack/Google/Stripe keys, JWTs, PEM
+                  private keys): matches are redacted before the response reaches the
+                  client. Off by default; enable when the backend MCP server is not
+                  fully trusted. This setting is ONLY applicable when Transport is
+                  "stdio" (the streamable-HTTP proxy path) -- it has no effect when
+                  Transport is "streamable-http" or "sse" (those reverse-proxy to an
+                  already-HTTP backend without inspecting message content).
+                type: boolean
               replicas:
                 description: |-
                   Replicas is the desired number of proxy runner (thv run) pod replicas.

deploy/charts/operator-crds/files/crds/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -3195,6 +3195,14 @@ spec:
                     - message: at least one of shared, perUser, or tools must be configured
                       rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                         && size(self.tools) > 0)
+                  redactToolResultSecrets:
+                    default: false
+                    description: |-
+                      RedactToolResultSecrets enables best-effort credential-shape scanning
+                      (see pkg/mcp/secretscan) on tools/call results before they are relayed
+                      to the client: matches are redacted in place. Opt-in (default false);
+                      enable when a backend this vMCP aggregates is not fully trusted.
+                    type: boolean
                   sessionStorage:
                     description: |-
                       SessionStorage configures session storage for stateful horizontal scaling.
@@ -7186,6 +7194,14 @@ spec:
                     - message: at least one of shared, perUser, or tools must be configured
                       rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                         && size(self.tools) > 0)
+                  redactToolResultSecrets:
+                    default: false
+                    description: |-
+                      RedactToolResultSecrets enables best-effort credential-shape scanning
+                      (see pkg/mcp/secretscan) on tools/call results before they are relayed
+                      to the client: matches are redacted in place. Opt-in (default false);
+                      enable when a backend this vMCP aggregates is not fully trusted.
+                    type: boolean
                   sessionStorage:
                     description: |-
                       SessionStorage configures session storage for stateful horizontal scaling.

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_mcpservers.yaml

@@ -518,6 +518,18 @@ spec:
                 - message: at least one of shared, perUser, or tools must be configured
                   rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                     && size(self.tools) > 0)
+              redactToolResultSecrets:
+                default: false
+                description: |-
+                  RedactToolResultSecrets enables best-effort credential-shape scanning
+                  on tools/call responses (AWS/GitHub/Slack/Google/Stripe keys, JWTs, PEM
+                  private keys): matches are redacted before the response reaches the
+                  client. Off by default; enable when the backend MCP server is not
+                  fully trusted. This setting is ONLY applicable when Transport is
+                  "stdio" (the streamable-HTTP proxy path) -- it has no effect when
+                  Transport is "streamable-http" or "sse" (those reverse-proxy to an
+                  already-HTTP backend without inspecting message content).
+                type: boolean
               replicas:
                 description: |-
                   Replicas is the desired number of proxy runner (thv run) pod replicas.
@@ -1462,6 +1474,18 @@ spec:
                 - message: at least one of shared, perUser, or tools must be configured
                   rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                     && size(self.tools) > 0)
+              redactToolResultSecrets:
+                default: false
+                description: |-
+                  RedactToolResultSecrets enables best-effort credential-shape scanning
+                  on tools/call responses (AWS/GitHub/Slack/Google/Stripe keys, JWTs, PEM
+                  private keys): matches are redacted before the response reaches the
+                  client. Off by default; enable when the backend MCP server is not
+                  fully trusted. This setting is ONLY applicable when Transport is
+                  "stdio" (the streamable-HTTP proxy path) -- it has no effect when
+                  Transport is "streamable-http" or "sse" (those reverse-proxy to an
+                  already-HTTP backend without inspecting message content).
+                type: boolean
               replicas:
                 description: |-
                   Replicas is the desired number of proxy runner (thv run) pod replicas.

deploy/charts/operator-crds/templates/toolhive.stacklok.dev_virtualmcpservers.yaml

@@ -3198,6 +3198,14 @@ spec:
                     - message: at least one of shared, perUser, or tools must be configured
                       rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                         && size(self.tools) > 0)
+                  redactToolResultSecrets:
+                    default: false
+                    description: |-
+                      RedactToolResultSecrets enables best-effort credential-shape scanning
+                      (see pkg/mcp/secretscan) on tools/call results before they are relayed
+                      to the client: matches are redacted in place. Opt-in (default false);
+                      enable when a backend this vMCP aggregates is not fully trusted.
+                    type: boolean
                   sessionStorage:
                     description: |-
                       SessionStorage configures session storage for stateful horizontal scaling.
@@ -7189,6 +7197,14 @@ spec:
                     - message: at least one of shared, perUser, or tools must be configured
                       rule: has(self.shared) || has(self.perUser) || (has(self.tools)
                         && size(self.tools) > 0)
+                  redactToolResultSecrets:
+                    default: false
+                    description: |-
+                      RedactToolResultSecrets enables best-effort credential-shape scanning
+                      (see pkg/mcp/secretscan) on tools/call results before they are relayed
+                      to the client: matches are redacted in place. Opt-in (default false);
+                      enable when a backend this vMCP aggregates is not fully trusted.
+                    type: boolean
                   sessionStorage:
                     description: |-
                       SessionStorage configures session storage for stateful horizontal scaling.