Sanitize gateway token

src/mcp_agent/cli/cloud/commands/deploy/bundle_utils.py

@@ -14,7 +14,9 @@
 import pathspec
 
 
-def create_pathspec_from_gitignore(ignore_file_path: Path) -> Optional[pathspec.PathSpec]:
+def create_pathspec_from_gitignore(
+    ignore_file_path: Path,
+) -> Optional[pathspec.PathSpec]:
     """Create and return a `PathSpec` from an ignore file.
 
     The file is parsed using the `gitwildmatch` (gitignore) syntax. If the file
@@ -34,7 +36,6 @@ def create_pathspec_from_gitignore(ignore_file_path: Path) -> Optional[pathspec.
         spec = pathspec.PathSpec.from_lines("gitwildmatch", f)
 
     return spec
-
 
 
 def should_ignore_by_gitignore(
@@ -76,5 +77,4 @@ def should_ignore_by_gitignore(
         elif full_path.is_dir() and spec.match_file(rel_path_str + "/"):
             ignored.add(name)
 
-
     return ignored

src/mcp_agent/executor/workflow.py

@@ -761,9 +761,23 @@ async def initialize(self):
                 if isinstance(memo_map, dict):
                     gateway_url = memo_map.get("gateway_url")
                     gateway_token = memo_map.get("gateway_token")
+                    sanitized_token = None
+                    if isinstance(gateway_token, str):
+                        # If it's an MCP API key, include some suffix to allow debugging
+                        if (
+                            gateway_token.startswith("lm_mcp_api_")
+                            and len(gateway_token) > 24
+                        ):
+                            sanitized_token = (
+                                f"{gateway_token[:10]}...{gateway_token[-4:]}"
+                            )
+                        elif len(gateway_token) > 10:
+                            sanitized_token = f"{gateway_token[:4]}..."
+                        else:
+                            sanitized_token = "***"
 
                     self._logger.debug(
-                        f"Proxy parameters: gateway_url={gateway_url}, gateway_token={gateway_token}"
+                        f"Proxy parameters: gateway_url={gateway_url}, gateway_token={sanitized_token}"
                     )
 
                     if gateway_url:

tests/cli/commands/test_deploy_command.py

@@ -117,22 +117,22 @@ async def mock_process_secrets(*args, **kwargs):
             "mcp_agent.cli.cloud.commands.deploy.main.wrangler_deploy",
             return_value=MOCK_APP_ID,
         ),
-        ):
-            # Run the deploy command
-            result = runner.invoke(
-                app,
-                [
-                    "deploy",
-                    MOCK_APP_NAME,
-                    "--config-dir",
-                    temp_config_dir,
-                    "--api-url",
-                    "http://test-api.com",
-                    "--api-key",
-                    "test-api-key",
-                    "--non-interactive",  # Prevent prompting for input
-                ],
-            )
+    ):
+        # Run the deploy command
+        result = runner.invoke(
+            app,
+            [
+                "deploy",
+                MOCK_APP_NAME,
+                "--config-dir",
+                temp_config_dir,
+                "--api-url",
+                "http://test-api.com",
+                "--api-key",
+                "test-api-key",
+                "--non-interactive",  # Prevent prompting for input
+            ],
+        )
 
     # Check command exit code
     assert result.exit_code == 0, f"Deploy command failed: {result.stdout}"

tests/cli/commands/test_wrangler_wrapper.py

@@ -1037,7 +1037,7 @@ def test_should_ignore_by_gitignore():
 """
 
     # Create a mock PathSpec directly
-    spec = pathspec.PathSpec.from_lines('gitwildmatch', gitignore_content.splitlines())
+    spec = pathspec.PathSpec.from_lines("gitwildmatch", gitignore_content.splitlines())
 
     project_dir = Path("/fake/project")
     current_path = str(project_dir)
@@ -1117,9 +1117,7 @@ def test_should_ignore_by_gitignore_matches_directories(tmp_path):
     (project_dir / "build").mkdir()
     spec = pathspec.PathSpec.from_lines("gitwildmatch", ["build/"])
 
-    ignored = should_ignore_by_gitignore(
-        str(project_dir), ["build"], project_dir, spec
-    )
+    ignored = should_ignore_by_gitignore(str(project_dir), ["build"], project_dir, spec)
 
     assert "build" in ignored
 
@@ -1202,7 +1200,9 @@ def check_gitignore_respected(*args, **kwargs):
             return MagicMock(returncode=0)
 
         with patch("subprocess.run", side_effect=check_gitignore_respected):
-            wrangler_deploy("test-app", "test-api-key", project_path, project_path / ".mcpacignore")
+            wrangler_deploy(
+                "test-app", "test-api-key", project_path, project_path / ".mcpacignore"
+            )
 
 
 def test_wrangler_deploy_warns_when_ignore_file_missing():
@@ -1243,9 +1243,7 @@ def check_missing_ignore_behavior(*args, **kwargs):
             ) as mock_warning,
             patch("subprocess.run", side_effect=check_missing_ignore_behavior),
         ):
-            wrangler_deploy(
-                "test-app", "test-api-key", project_path, missing_ignore
-            )
+            wrangler_deploy("test-app", "test-api-key", project_path, missing_ignore)
 
         mock_warning.assert_called_once()
         warning_message = mock_warning.call_args[0][0]