Summary
HTTP MCP request logging records auth outcomes such as missing, wrong-scheme, and wrong-token. The distinction is useful during debugging, but it can reveal more auth-state detail than needed in normal logs.
Evidence
HttpMcpTransport auth logging and tests use distinct auth outcome values.- A generic unauthorized category would usually be enough outside debug mode.
Expected
Coarsen auth failure telemetry by default, or gate detailed failure reasons behind explicit debug diagnostics.
Summary
HTTP MCP request logging records auth outcomes such as
missing,wrong-scheme, andwrong-token. The distinction is useful during debugging, but it can reveal more auth-state detail than needed in normal logs.Evidence
HttpMcpTransportauth logging and tests use distinct auth outcome values.Expected
Coarsen auth failure telemetry by default, or gate detailed failure reasons behind explicit debug diagnostics.