Prompt logging

What mcp-scan saw

Unlike the other data-controls checks, this one runs unconditionally and only over descriptive text: server name, server description, schema description, and every tool name and description. It matches a logging verb (log, record, store, capture, persist) within 60 characters of a user-data noun (prompt, query, interaction, message, chat), in either order.

Why it fires

Raw prompts are the highest-density personal data an MCP server can touch, because they carry whatever the user pasted into the conversation. The proximity window and the word boundaries were added deliberately: two independent substring matches previously flagged 'dialog' and 'log in' on nearly every server.

When this is a false positive

• A database or logging server describing its own product function, for example 'store a query result' or 'record a message', matches the verb and noun by design.
• 'query' is the noun most likely to appear innocently. Any SQL, search, or GraphQL server whose description says it stores or caches queries matches without touching a user prompt.
• A chat-platform integration describing itself, for example 'capture chat history from the workspace', is doing exactly what it says and the logging is the product.

How to fix it

1. Read the description that matched and decide whether the logged object is a user prompt or a domain object.
2. If it is a domain object, reword to name it: 'store SQL results' rather than 'store a query'. That is more accurate and clears the match.
3. If prompts are genuinely logged, strip personal data before writing, or add an env flag such as DISABLE_PROMPT_LOGGING and default it on.
4. Say in the description what is written and where it goes, since the description is what the model and your reviewers both read.
5. To suppress, add 'data-controls-prompt-logging' to suppressRules in .mcp-scan.json.