fix: critical cloud deployment fixes for MCP stability#317
Conversation
- Remove sensitive JWT token from debug logging output - Log only non-authorization header keys for debugging - Keep authorization injection confirmation message concise - Improve security by preventing token leakage in logs This addresses a security issue where JWT tokens were being logged in plain text in the debug output, potentially exposing them in production logs. Signed-off-by: phernandez <paul@basicmachines.co>
- Increase read/write timeout from 5s to 30s to handle longer operations - Add explicit timeout configuration for all connection phases - Prevents timeout errors on write_note operations that take >5 seconds - Particularly important for cloud deployments with file sync overhead This fixes timeout issues where write_note operations would fail when they took longer than the default 5-second httpx timeout. Signed-off-by: phernandez <paul@basicmachines.co>
- Add hasattr() checks before accessing 'results' attribute - Handle case where search_notes returns error strings instead of SearchResponse - Prevents AttributeError when search operations fail or timeout - Applies fix to both title and text search fallbacks This fixes the 'AttributeError: str object has no attribute results' error that occurred when search operations failed in cloud deployments. Signed-off-by: phernandez <paul@basicmachines.co>
- Format async_client.py timeout configuration - Format headers.py security improvements - Format read_note.py error handling Maintains all functionality while conforming to project code style. Signed-off-by: phernandez <paul@basicmachines.co>
|
Claude finished @phernandez's task —— View job PR Review: Critical Cloud Deployment FixesI've completed my review of PR #317. These are important stability and security fixes for cloud deployments. Here's my evaluation against the team checklist: ✅ Code Quality & Standards
|
…ests - Expand sensitive header filtering to include cookie, x-api-key, x-auth-token, api-key - Add comprehensive test coverage for 30-second timeout configuration - Ensure all sensitive authentication headers are excluded from debug logs Addresses review comments from github-actions bot on PR #317 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com> Signed-off-by: phernandez <paul@basicmachines.co>
|
Claude finished @phernandez's task —— View job PR Review: Critical Cloud Deployment FixesI've completed my review of PR #317. These are important stability and security fixes for cloud deployments. Here's my evaluation against the team checklist: Task List:
Review Results✅ Code Quality & Standards
|
Summary
Addresses critical issues discovered during cloud deployment testing that were causing MCP tool failures and poor user experience.
🔒 Security Fix
⏱️ Performance Fixes
🐛 Error Handling
Changes
1. Security: Prevent JWT Token Exposure
headers.pyto only log non-sensitive header keys2. Performance: Increase Client Timeout
3. Stability: Handle Search Error Responses
hasattr()checks before accessingresultsattributeImpact
These fixes resolve critical issues that were causing:
Test plan
🤖 Generated with Claude Code