oct.mcp.redactor Namespace Reference

Classes
class	RedactorResult
class	Redactor

Functions
None	_dbg (*args, **kwargs)
str	_redact_git_url (str text)

Variables
frozenset	_SECRET_NAME_PATTERNS
re	_ANSI_ESCAPE_RE
re	_ASSIGNMENT_LINE_RE
tuple	_SYSTEM_PATH_PREFIXES_POSIX

Detailed Description

Purpose
-------
Output Redactor (Layer 5) for the ``oct-mcp`` six-layer pipeline.
Applies a five-step sanitisation pipeline to every tool output before
it is returned to the MCP client.

Responsibilities
----------------
- Step 1: Apply ``redaction_patterns`` from ``debug_config.json``
  (loaded at server startup; falls back to empty list if unavailable).
- Step 2: Apply ``_SECRET_NAME_PATTERNS`` line filtering — any output
  line that looks like a ``KEY=value`` assignment whose key matches a
  secret pattern is replaced with ``[REDACTED]``.
- Step 3: Anonymise absolute paths:
    ``$HOME/...``  → ``[HOME]/...``
    ``/usr/``, ``/bin/``, ``/opt/``, etc. → ``[SYSTEM]/...``
    ``<project_root>/...`` → ``[PROJECT]/...``
    Drive-letter paths on Windows follow the same rules.
- Step 4: Strip ANSI escape sequences.
- Step 5: Truncate output that exceeds ``max_output_bytes``, appending
  a ``[OUTPUT TRUNCATED AT <N> BYTES]`` marker.

Also applies git-URL credential redaction (``_redact_git_url``) as
a supplementary step after step 2 to catch any credentials that
survived the key-pattern filter.

Diagnostics
-----------
Domain: MCP
Levels:
    L2 — lifecycle: redactor instantiation
    L3 — per-call redaction counts
    L4 — deep trace: individual substitutions

Contracts
---------
- This module does not import ``click`` or the MCP SDK.
- :meth:`Redactor.apply_all` is pure: the same input always produces the
  same output given the same configuration.
- :meth:`Redactor.apply_all` never raises.
- ``redactions_applied`` in :class:`RedactorResult` counts *all*
  individual substitutions made across all steps.

Function Documentation

_dbg()

None oct.mcp.redactor._dbg ( * args, ** kwargs )

protected

Definition at line 60 of file redactor.py.

Here is the caller graph for this function:

_redact_git_url()

str oct.mcp.redactor._redact_git_url ( str text )

protected

Definition at line 82 of file redactor.py.

Here is the caller graph for this function:

Variable Documentation

_ANSI_ESCAPE_RE

re oct.mcp.redactor._ANSI_ESCAPE_RE

protected

Initial value:

=  re.compile(
    r"\x1b(?:[@-Z\\-_]|\‍[[0-?]*[ -/]*[@-~])"
)

Definition at line 91 of file redactor.py.

_ASSIGNMENT_LINE_RE

re oct.mcp.redactor._ASSIGNMENT_LINE_RE

protected

Initial value:

=  re.compile(
    r'^(\s*(?:[A-Za-z_][A-Za-z0-9_]*))\s*[:=]\s*(.+)$'
)

Definition at line 103 of file redactor.py.

_SECRET_NAME_PATTERNS

frozenset oct.mcp.redactor._SECRET_NAME_PATTERNS

protected

Initial value:

=  frozenset({
        "password", "passwd", "pwd",
        "secret", "secret_key", "private_key",
        "api_key", "apikey", "api_secret",
        "token", "auth_token", "access_token", "refresh_token",
        "connection_string", "conn_str", "dsn", "database_url", "db_url",
        "aws_secret", "aws_key", "aws_access",
        "credentials", "client_secret",
    })

Definition at line 69 of file redactor.py.

_SYSTEM_PATH_PREFIXES_POSIX

tuple oct.mcp.redactor._SYSTEM_PATH_PREFIXES_POSIX

protected

Initial value:

=  (
    "/usr/", "/bin/", "/sbin/", "/lib/", "/lib64/",
    "/opt/", "/etc/", "/var/", "/tmp/", "/run/",
    "/snap/", "/proc/", "/sys/",
)

Definition at line 108 of file redactor.py.