Skip to content

Fix T-1004 false positives in logging statements#147

Merged
hello-args merged 2 commits into
MCP-Audit:mainfrom
winkle05:fix/mcts-t-1004-logging-false-positive
Jun 11, 2026
Merged

Fix T-1004 false positives in logging statements#147
hello-args merged 2 commits into
MCP-Audit:mainfrom
winkle05:fix/mcts-t-1004-logging-false-positive

Conversation

@winkle05

@winkle05 winkle05 commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Fixes #117

Issue 117: Fixed an issue where logging statements containg e.g. localhost would be flagged as
a security vulnerability.

Type of change

  • [x ] Bug fix
  • New feature / analyzer
  • Breaking change
  • Documentation

Test plan

  • [x ] uv run pytest
  • [x ] uv run ruff check src tests
  • Manual CLI test (if applicable)
    uv run mcts scan examples/vulnerable-mcp-server/server.py
    uv run mcts scan examples/vulnerable-mcp-server/server.py -o report.json
    uv run mcts report report.json -o security-report.html

Checklist

  • CHANGELOG.md updated (if user-facing) — see Keep a Changelog
  • [x ] Tests added or updated
  • No secrets or credentials in code
  • Docs updated if CLI behavior or report output changed — see Documentation index (guides live under docs/get-started/, docs/scanning/, docs/platform/, etc.)

@biswajit-satapathy1998 biswajit-satapathy1998 left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. Thank you very much for your contribution. As we don't have a dedicated contant file so we can keep "Internal URL" for now. Once we have the file ready we can move this thing to constant file.

@hello-args hello-args merged commit 1fa34ca into MCP-Audit:main Jun 11, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] Internal URL detection fires on console print() statements (false positive)

3 participants