Privacy and authorization

MCP Eval is read-only by default and has no raw-payload mode. It stores structured call metadata and shaped arguments, not raw response bodies. Human error text is reduced to the constant {message} plus a salted template identifier; the original message is not stored.

Server labels, methods, tool names, keys, enum values, numeric and boolean values, and registrable domains are retained only within their documented bounded grammars. Other hosts and string values are reduced to privacy-safe categories or length buckets. Server stderr passes through to the client and is not journaled.

Probe records are tagged synthetic and use the same persistence boundary. Raw manifest arguments, response bodies, tool descriptions, sandbox descriptions, and raw errors are not stored or printed in summaries. Manifest files can still contain sensitive operational inputs and are outside the share-safe boundary.

Capture records under <MCPEVAL_HOME>/store/ are content-minimized, but annotation notes are deliberate free-form user prose and are not automatically redacted. Before sharing any store records, you must manually review or remove every annotation note and inspect the remaining files. The fingerprint salt lives at <MCPEVAL_HOME>/.salt, outside store/, and must never accompany shared records. Do not share the entire capture root.

Mutation requires two independent controls: the manifest case uses "access": "mutating" and names a declared sandbox, and the operator passes --allow-mutation. A missing or invalid manifest, undeclared sandbox, or missing flag never authorizes mutation. generate --confirm-read-only attests that an eligible tool is read-only and does not authorize mutation.

HTTP endpoints are loopback-only by default. Remote endpoints require HTTPS plus --allow-remote-http. Optional authorization is read from MCPEVAL_HTTP_AUTHORIZATION, validated, used in memory, and never persisted or printed. The HTTP proxy may relay an incoming Authorization value in memory, but it does not originate calls or grant mutation permission.

mcpeval share --dir <directory> assembles the shareable artifact mechanically instead of asking you to hand-pick files. It runs the redaction sweep first and refuses to package a store the sweep flags. The envelope contains the store's JSONL records (plus optionally the readiness-trend history with --include-probe-history) and a SHARE.md manifest describing what is inside, what was deliberately excluded — the fingerprint salt, derived databases such as index.db, and manifest files — and whether annotation notes need manual review. The salt is never copied into the envelope; keep any file containing it separate from the envelope when attaching either.