Tool call arguments and results end up in the Drupal log

Related: #3583783 (closed) (PSR-3 context logger decorator).

Problem/Motivation

The SDK logs every JSON-RPC message through the mcp_server channel, and since #3583783 (closed) its structured context reaches the log as well. One tools/call wrote 12 rows to watchdog (1 warning, 8 info, 3 debug), among them:

  • the whole request, arguments included, at info level ("Handling request.");
  • the arguments again at debug level ("Executing tool");
  • the result at debug level ("Tool executed successfully … structured_content=…").

With Database Logging enabled (and syslog, depending on its level), tool payloads end up in the site log, readable by anyone with access site reports. Tool calls can carry content a site would not otherwise log.

Measured on Drupal 11.4.8 with mcp_server 2.0.0-beta5 and mcp/sdk 0.8.1.

Steps to reproduce

  1. Enable Database Logging and expose any tool.
  2. Call it over HTTP with some arguments.
  3. Open /admin/reports/dblog filtered by type mcp_server: the arguments and the result are there.

Proposed resolution

Keep payloads out of the log by default: log the method, the tool name and the outcome, and add the arguments and results only behind a debug setting.