Skip to content

env vars set on StdioServerInfo are logged as plain text to external tracing tools (langfuse) #9487

Closed
deepset-ai/haystack-core-integrations
#1900
@mathislucka

Description

@mathislucka
Member

Describe the bug
I noticed that with an Agent using MCP tools, the environment variables defined on StdioServerInfo are sent to langfuse as plain text. I don't think we should send env vars as plain text to another service.

from pathlib import Path

from haystack.components.agents.agent import Agent
from haystack.utils.auth import Secret
from haystack_integrations.components.generators.anthropic.chat.chat_generator import AnthropicChatGenerator
from haystack_integrations.tools.mcp import MCPToolset, StdioServerInfo

from deepset_mcp.benchmark.runner.config import BenchmarkConfig


def get_agent(benchmark_config: BenchmarkConfig) -> Agent:
    """Get an instance of the Generalist agent."""
    tools = MCPToolset(
        server_info=StdioServerInfo(
            command="uv",
            args=["run", "deepset-mcp"],
            env={
                "DEEPSET_WORKSPACE": benchmark_config.deepset_workspace,
                "DEEPSET_API_KEY": benchmark_config.deepset_api_key,
            },
        )
    )
    prompt = (Path(__file__).parent / "system_prompt.md").read_text()
    generator = AnthropicChatGenerator(
        model="claude-sonnet-4-20250514",
        generation_kwargs={"max_tokens": 8000},
        api_key=Secret.from_token(benchmark_config.get_env_var("ANTHROPIC_API_KEY")),
    )

    return Agent(tools=tools, system_prompt=prompt, chat_generator=generator)

Error message

Image

FAQ Check

  • Have you had a look at our new FAQ page?

System:

  • OS:
  • GPU/CPU:
  • Haystack version (commit or version number):
  • DocumentStore:
  • Reader:
  • Retriever:

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

P1High priority, add to the next sprint

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

    Development

    Participants

    @vblagoje@sjrl@mathislucka

    Issue actions

      env vars set on StdioServerInfo are logged as plain text to external tracing tools (langfuse) · Issue #9487 · deepset-ai/haystack