Skip to content

Conversation

@galatanovidiu
Copy link
Contributor

Why

Internal _metadata fields were appearing in the client-facing response, showing up in both the structuredContent object and the JSON-encoded content[0].text field.
This metadata is intended only for internal observability tracking and should not be exposed to MCP clients.

What

  • Extract _metadata from the result before adding it to response content/structuredContent
  • Add unset($result['_metadata']) to ensure metadata is removed from the result
  • Reorder operations in ToolsHandler::call_tool() to:
    1. Extract metadata first
    2. Remove it from result
    3. Then add cleaned result to response

This ensures metadata is only present at the top level of the response (where RequestRouter removes it) and never reaches the client.

Copilot AI review requested due to automatic review settings October 21, 2025 10:42
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR fixes a bug where internal _metadata fields were being exposed in client-facing tool response content. The fix ensures metadata is extracted and removed from the result before it's added to the response content, preventing it from appearing in both structuredContent and the JSON-encoded content[0].text field.

  • Reordered metadata extraction to occur before result is added to response content
  • Added explicit removal of _metadata from result using unset()
  • Preserved metadata at response top level where it's properly handled by RequestRouter

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@github-actions
Copy link

github-actions bot commented Oct 21, 2025

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: galatanovidiu <[email protected]>
Co-authored-by: JasonTheAdams <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

@codecov
Copy link

codecov bot commented Oct 21, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.95%. Comparing base (040625e) to head (2a8058b).
⚠️ Report is 14 commits behind head on trunk.

Additional details and impacted files
@@             Coverage Diff              @@
##              trunk      #72      +/-   ##
============================================
+ Coverage     68.94%   68.95%   +0.01%     
  Complexity      821      821              
============================================
  Files            46       46              
  Lines          3037     3038       +1     
============================================
+ Hits           2094     2095       +1     
  Misses          943      943              
Flag Coverage Δ
unit 68.95% <100.00%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Member

@JasonTheAdams JasonTheAdams left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for explaining! This is good to go, then!

@JasonTheAdams JasonTheAdams merged commit 4a80513 into trunk Oct 30, 2025
24 of 25 checks passed
@JasonTheAdams JasonTheAdams deleted the fix/metadata-leaking-in-response branch October 30, 2025 20:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants