Found while dogfooding the current source.
The codebase has comments explaining that MCP tool errors should avoid raw ex.Message because bound SQLite parameters or matched content can leak into exception messages. Some paths still return or log raw exception messages directly.
Examples:
src/CodeIndex/Mcp/McpToolHandlers.cs:1277 returns CreateToolErrorResponse(id, ex.Message) from ExecuteSearch.src/CodeIndex/Mcp/McpToolHandlers.cs:2610 returns invalid regular expression: {ex.Message}.src/CodeIndex/Mcp/McpToolHandlers.cs:3014 logs BuildToolErrorLog(toolName, ex.Message).src/CodeIndex/Mcp/McpToolHandlers.cs:4481 logs BuildToolErrorLog("backfill_fold", ex.Message).src/CodeIndex/Mcp/McpToolHandlers.cs:5063 appends ex.Message to .cdidx writability errors.
Expected: MCP client-visible errors and logs should go through the central sanitizer/bounded formatter consistently, with tests covering these remaining direct paths.
Found while dogfooding the current source.
The codebase has comments explaining that MCP tool errors should avoid raw
ex.Messagebecause bound SQLite parameters or matched content can leak into exception messages. Some paths still return or log raw exception messages directly.Examples:
src/CodeIndex/Mcp/McpToolHandlers.cs:1277returnsCreateToolErrorResponse(id, ex.Message)fromExecuteSearch.src/CodeIndex/Mcp/McpToolHandlers.cs:2610returnsinvalid regular expression: {ex.Message}.src/CodeIndex/Mcp/McpToolHandlers.cs:3014logsBuildToolErrorLog(toolName, ex.Message).src/CodeIndex/Mcp/McpToolHandlers.cs:4481logsBuildToolErrorLog("backfill_fold", ex.Message).src/CodeIndex/Mcp/McpToolHandlers.cs:5063appendsex.Messageto.cdidxwritability errors.Expected: MCP client-visible errors and logs should go through the central sanitizer/bounded formatter consistently, with tests covering these remaining direct paths.