Problem
TrySampleSuggestionMetadataAsync builds a sampling prompt by appending category, language, description, caller-provided context, and tool invocation context directly into the message sent to the MCP sampling client. Large context values can produce oversized outbound prompts, and sensitive invocation payloads can be forwarded to the client without a clear scrub or summary boundary.
Suggested fix
Clamp prompt fields before sampling, add a byte budget for the complete prompt, and redact or summarize invocation context before it leaves the server boundary.
Evidence
src/CodeIndex/Mcp/McpToolHandlers.cs: TrySampleSuggestionMetadataAsync- prompt construction for category, language, description, context, and
toolInvocationContext
Problem
TrySampleSuggestionMetadataAsyncbuilds a sampling prompt by appending category, language, description, caller-provided context, and tool invocation context directly into the message sent to the MCP sampling client. Large context values can produce oversized outbound prompts, and sensitive invocation payloads can be forwarded to the client without a clear scrub or summary boundary.Suggested fix
Clamp prompt fields before sampling, add a byte budget for the complete prompt, and redact or summarize invocation context before it leaves the server boundary.
Evidence
src/CodeIndex/Mcp/McpToolHandlers.cs:TrySampleSuggestionMetadataAsynctoolInvocationContext