Summary
The MCP server logs the absolute path of the DB file to stderr at startup:
[cdidx-mcp] Starting MCP server v1.21.0 (db: /Users/<username>/.cdidx/codeindex.db)
This stderr stream is typically captured by the LLM client's log buffer and may be persisted, indexed, or sent over the wire alongside other diagnostics. The full path discloses the username / home directory layout, which is unnecessary PII for a routine startup log.
Evidence
src/CodeIndex/Mcp/McpServer.cs:57 — startup banner includes _dbPath verbatim.
Impact
- Username / home-directory leak into log capture pipelines.
- For multi-user CI or shared host setups, the leak compounds.
Proposed direction
- Default: log only the DB basename, or a sanitized form like
<workspace>/.cdidx/codeindex.db.
- Allow opting-in to the full path via
CDIDX_DEBUG=unsafe (a flag the codebase already uses for similar disclosures).
- Apply the same treatment to other startup-banner fields that include user-derived paths.
Repro env
- Branch:
main @ 2ee912d (release v1.21.0)
Summary
The MCP server logs the absolute path of the DB file to stderr at startup:
This stderr stream is typically captured by the LLM client's log buffer and may be persisted, indexed, or sent over the wire alongside other diagnostics. The full path discloses the username / home directory layout, which is unnecessary PII for a routine startup log.
Evidence
src/CodeIndex/Mcp/McpServer.cs:57— startup banner includes_dbPathverbatim.Impact
Proposed direction
<workspace>/.cdidx/codeindex.db.CDIDX_DEBUG=unsafe(a flag the codebase already uses for similar disclosures).Repro env
main@ 2ee912d (release v1.21.0)