feat: redact secrets from tool results by default - #170

What does this PR do?

Stops the MCP server from putting secrets into the model's context. Every response field Appwrite's API spec marks format: password is redacted from tool results by default and replaced with a fingerprint. A new reveal_secrets option returns the values when the user asks to see them.

The problem

Whatever a tool returns goes into the model's context, then into the client's local transcripts, subagent transcripts and tool-result caches. Some Appwrite responses carry live secrets, and the MCP returned them in full:

As a result, a key created or rotated through the MCP was leaked the moment it existed, so an agent couldn't rotate a leaked key without leaking the replacement. The CLI already hides these by default, so the two surfaces behaved differently on the same API.

Where the list of secret fields comes from

There is no hand-kept list in this repo. Secret fields are marked once in Appwrite's API spec with OpenAPI's standard format: password, and both this server and the CLI read that marking:

1. feat: mark secret response fields with format password appwrite#15543 and #15547 mark 73 secret fields in server-ce. That covers key, session, token and device secrets, JWTs, MFA secrets and recovery codes, password hashes, provider tokens and every OAuth client secret.
2. appwrite-labs/cloud#7502 marks 20 more on cloud-only models. That covers app keys and secrets, dedicated database passwords and connection strings, OAuth2 server tokens, device codes, domain-transfer codes and Stripe client secrets.
3. feat: redact the response fields the spec marks format password sdk-generator#2219 (released in 5.19.0) makes the generator use the marking:
   • The CLI masks marked fields.
   • Python models carry the marking on each field: Field(..., json_schema_extra={'format': 'password'}).
4. appwrite-console 0.16.0 (feat: Console Python SDK update for version 0.16.0 sdk-for-console-python#25) ships it, with 88 marked fields in the console SDK.

How it works

New module, redaction.py. After the SDK call, execute_registered_tool passes the typed result to redact() before it's serialised. redact() walks the pydantic model tree and handles each marked field like this:

Fields that aren't marked are serialised exactly as before (the same model_dump(by_alias=True, mode="json", exclude_unset=True) the SDK's to_dict uses).

A note to the model. When anything was redacted, a second text item names the fields. It also tells the model to read the value again with reveal_secrets=true only if the user explicitly asks, and never to repeat a create, which would make a new secret.

reveal_secrets. It's a boolean on appwrite_call_tool and appwrite_call_write_tool, off by default, and it's stripped from the arguments sent to Appwrite. A write that reveals still needs confirm_write and a reason, and the reason is recorded on the project's audit log as before.

Where it applies.

• Every hidden tool call, whichever transport (hosted HTTP or stdio) and whichever auth (OAuth or API key).
• Results stored as MCP resources, since redaction happens before storage.
• The MCP Apps views (appwrite_show).

views._json now parses only the first text item, so the note never breaks a view.

What this affects

Upgrading from 0.12 needed one test change: the SDK now fills defaults on partial documents. The select test's second half asserted that full models reject partial rows, which no longer holds. The part that matters is still asserted: a select result comes back exactly as Appwrite sent it, with no defaults filled in.

Test Plan

• Existing e2e flows extended:
  • test_tools.py, test_reads_and_writes_run_only_through_their_own_tool:
    • webhooks_create's result doesn't contain the stored signing key anywhere.
    • secret is [redacted], and secretFingerprint equals the stored key's SHA-256 prefix.
    • The note names secret.
    • webhooks_update_secret with reveal_secrets: true returns the rotated key in full, with no note.
  • test_server.py, test_format_appwrite_error_returns_the_unhydrated_payload: a key secret in an unparsed payload comes back as [redacted] with the note.
  • test_stdio.py, test_acts_in_the_configured_environment: users_list over stdio contains no $argon2. Every user's password is [redacted] with a sha256: fingerprint.
• ruff check, black --check and pyright (0 errors) pass.
• Unit tests pass: 301.
• Full e2e suite passes: 64.
• Docker build: not run locally because the disk is full, so the docker job checks it.
• Re-rendered docs/appwrite-mcp-flow.png from the SVG and compared it with the previous PNG: identical apart from the catalog line (38 services · 981 tools → 41 · 1065).