From 4043faccf3179ec67a4324fb5595d6cf0c9db77e Mon Sep 17 00:00:00 2001
From: John Lee <johnteee@gmail.com>
Date: Fri, 5 Jun 2026 23:27:29 +0800
Subject: [PATCH] Potential fix for code scanning alert no. 32: Clear-text
 logging of sensitive information

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 teaagent/cli/_handlers/_mcp_trust.py |  8 ++++----
 teaagent/mcp_trust.py                | 16 ++++++++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/teaagent/cli/_handlers/_mcp_trust.py b/teaagent/cli/_handlers/_mcp_trust.py
index 7cc5fcd3..1d9cfd50 100644
--- a/teaagent/cli/_handlers/_mcp_trust.py
+++ b/teaagent/cli/_handlers/_mcp_trust.py
@@ -76,7 +76,7 @@ def _mask_leaf_values(obj: Any) -> Any:
 
 def mcp_trust_list_command(args: argparse.Namespace) -> int:
     policy = load_mcp_trust_policy(args.root)
-    _print_json({'ok': True, 'policy': policy.to_dict()})
+    _print_json({'ok': True, 'policy': policy.to_public_dict()})
     return 0
 
 
@@ -98,7 +98,7 @@ def mcp_trust_inspect_command(args: argparse.Namespace) -> int:
             }
         )
         return 0
-    _print_json({'ok': True, 'policy': policy.to_dict()})
+    _print_json({'ok': True, 'policy': policy.to_public_dict()})
     return 0
 
 
@@ -110,7 +110,7 @@ def mcp_trust_allow_command(args: argparse.Namespace) -> int:
     else:
         update_global_tools(policy, allow=tools)
     save_mcp_trust_policy(args.root, policy)
-    _print_json({'ok': True, 'policy': policy.to_dict()})
+    _print_json({'ok': True, 'policy': policy.to_public_dict()})
     return 0
 
 
@@ -122,5 +122,5 @@ def mcp_trust_deny_command(args: argparse.Namespace) -> int:
     else:
         update_global_tools(policy, deny=tools)
     save_mcp_trust_policy(args.root, policy)
-    _print_json({'ok': True, 'policy': policy.to_dict()})
+    _print_json({'ok': True, 'policy': policy.to_public_dict()})
     return 0
diff --git a/teaagent/mcp_trust.py b/teaagent/mcp_trust.py
index 21e4e811..a5e95973 100644
--- a/teaagent/mcp_trust.py
+++ b/teaagent/mcp_trust.py
@@ -49,6 +49,22 @@ def to_dict(self) -> dict[str, Any]:
             },
         }
 
+    def to_public_dict(self) -> dict[str, Any]:
+        return {
+            'version': self.version,
+            'allowed_tools': list(self.allowed_tools),
+            'denied_tools': list(self.denied_tools),
+            'default_ttl_seconds': self.default_ttl_seconds,
+            'servers': {
+                name: {
+                    'allowed_tools': list(server.allowed_tools),
+                    'denied_tools': list(server.denied_tools),
+                    'expires_at': server.expires_at,
+                }
+                for name, server in self.servers.items()
+            },
+        }
+
     @classmethod
     def from_dict(cls, data: dict[str, Any]) -> 'MCPTrustPolicy':
         servers: dict[str, MCPServerTrust] = {}