From 869f8291fbe4881768b43462a4bb3ef8ff6df7b8 Mon Sep 17 00:00:00 2001
From: h <h@kotikot.com>
Date: Fri, 9 Oct 2026 02:44:01 +0000
Subject: [PATCH] fix(api): access log keeps the mcp path but not its query,
 the token rode in it

---
 backend/src/api/access_log.py | 19 +++++++++++++++++++
 backend/src/api/app.py        |  3 +++
 2 files changed, 22 insertions(+)
 create mode 100644 backend/src/api/access_log.py

diff --git a/backend/src/api/access_log.py b/backend/src/api/access_log.py
new file mode 100644
index 0000000..1fecfcb
--- /dev/null
+++ b/backend/src/api/access_log.py
@@ -0,0 +1,19 @@
+import logging
+
+QUERYLESS_PREFIXES = ("/mcp",)
+_PATH_ARG = 2
+
+
+class DropQueryFilter(logging.Filter):
+    def filter(self, record: logging.LogRecord) -> bool:
+        args = record.args
+        if isinstance(args, tuple) and len(args) > _PATH_ARG:
+            path = str(args[_PATH_ARG])
+            if path.startswith(QUERYLESS_PREFIXES):
+                bare = path.partition("?")[0]
+                record.args = (*args[:_PATH_ARG], bare, *args[_PATH_ARG + 1 :])
+        return True
+
+
+def hide_mcp_query() -> None:
+    logging.getLogger("uvicorn.access").addFilter(DropQueryFilter())
diff --git a/backend/src/api/app.py b/backend/src/api/app.py
index 80869e7..753c816 100644
--- a/backend/src/api/app.py
+++ b/backend/src/api/app.py
@@ -9,6 +9,7 @@ from fastapi.responses import FileResponse, RedirectResponse
 from fastmcp.utilities.lifespan import combine_lifespans
 from starlette.applications import Starlette
 
+from api.access_log import hide_mcp_query
 from api.auth import BearerAuthMiddleware
 from api.mcp.server import mcp
 from api.realtime import hub
@@ -45,6 +46,8 @@ if env.auth.token is None:
     raise RuntimeError(msg)
 _token = env.auth.token.get_secret_value()
 
+hide_mcp_query()
+
 mcp_app = mcp.http_app(path="/")