[Server] Log JSON-RPC payloads at debug level only

CHANGELOG.md

@@ -11,6 +11,7 @@ All notable changes to `mcp/sdk` will be documented in this file.
 * Add `HttpTransport::getSessionId()` to read the server-minted `Mcp-Session-Id`: a request-scoped caller can persist it and pass it back through the constructor's `$headers` on a later transport. Always `null` on `2026-07-28`, which removed protocol-level sessions.
 * Fix OIDC discovery rejecting issuers with a trailing slash (e.g. Authentik, Auth0).
 * Fix stateless SSE streams holding back frames until close when PHP output buffering is enabled.
+* Stop the server `Protocol` from logging full JSON-RPC payloads (tool arguments, client replies) at info level: info records now carry only the method and id, the raw message is logged at debug level.
 
 0.8.0
 -----

src/Server/Protocol.php

@@ -178,7 +178,8 @@ private static function findResponseId(string $input): string|int|null
      */
     private function doProcessInput(TransportInterface $transport, string $input, ?Uuid $sessionId): void
     {
-        $this->logger->info('Received message to process.', ['message' => $input]);
+        $this->logger->info('Received message to process.');
+        $this->logger->debug('Received message payload.', ['message' => $input]);
 
         $this->sessionManager->gc();
 
@@ -257,7 +258,7 @@ private function dispatchEvent(object $event): object
      */
     private function handleRequest(TransportInterface $transport, Request $request, SessionInterface $session): void
     {
-        $this->logger->info('Handling request.', ['request' => $request]);
+        $this->logger->info('Handling request.', ['method' => $request::getMethod(), 'request_id' => $request->getId()]);
 
         $session->set(self::SESSION_ACTIVE_REQUEST_META, $request->getMeta());
 
@@ -361,7 +362,7 @@ private function handleRequest(TransportInterface $transport, Request $request,
      */
     private function handleResponse(Response|Error $response, SessionInterface $session): void
     {
-        $this->logger->info('Handling response from client.', ['response' => $response]);
+        $this->logger->info('Handling response from client.', ['message_id' => $response->getId()]);
 
         $messageId = $response->getId();
 
@@ -381,7 +382,7 @@ private function handleResponse(Response|Error $response, SessionInterface $sess
 
     private function handleNotification(Notification $notification, SessionInterface $session): void
     {
-        $this->logger->info('Handling notification.', ['notification' => $notification]);
+        $this->logger->info('Handling notification.', ['method' => $notification::getMethod()]);
 
         $event = $this->dispatchEvent(new NotificationEvent($notification, $session));
         $notification = $event->getNotification();

tests/Unit/Server/ProtocolTest.php

@@ -36,6 +36,8 @@
 use PHPUnit\Framework\MockObject\MockObject;
 use PHPUnit\Framework\TestCase;
 use Psr\EventDispatcher\EventDispatcherInterface;
+use Psr\Log\AbstractLogger;
+use Psr\Log\LogLevel;
 use Symfony\Component\Uid\Uuid;
 
 final class ProtocolTest extends TestCase
@@ -1648,4 +1650,90 @@ public function testNotificationEventWithNullDispatcher(): void
             $sessionId
         );
     }
+
+    /**
+     * @return iterable<string, array{string, string}>
+     */
+    public static function provideMessagesCarryingPayloads(): iterable
+    {
+        yield 'tools/call request' => [
+            '{"jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": {"name": "login", "arguments": {"password": "s3cr3t-payload"}}}',
+            'tools/call',
+        ];
+        yield 'client response to an elicitation' => [
+            '{"jsonrpc": "2.0", "id": 1000, "result": {"action": "accept", "content": {"password": "s3cr3t-payload"}}}',
+            '1000',
+        ];
+        yield 'notification' => [
+            '{"jsonrpc": "2.0", "method": "notifications/cancelled", "params": {"requestId": 1, "reason": "s3cr3t-payload"}}',
+            'notifications/cancelled',
+        ];
+    }
+
+    #[TestDox('Message payloads are only logged at debug level, info and above carry the method and id')]
+    #[DataProvider('provideMessagesCarryingPayloads')]
+    public function testMessagePayloadsAreOnlyLoggedAtDebugLevel(string $input, string $identifier): void
+    {
+        $handler = $this->createMock(RequestHandlerInterface::class);
+        $handler->method('supports')->willReturn(true);
+        $handler->method('handle')->willReturn(new Response(1, ['content' => []]));
+
+        $session = $this->createMock(SessionInterface::class);
+        $this->sessionManager->method('createWithId')->willReturn($session);
+        $this->sessionManager->method('exists')->willReturn(true);
+
+        $logger = new LevelRecordingLogger();
+        $protocol = new Protocol(
+            requestHandlers: [$handler],
+            notificationHandlers: [],
+            messageFactory: MessageFactory::make(),
+            sessionManager: $this->sessionManager,
+            logger: $logger,
+        );
+
+        $protocol->processInput($this->transport, $input, Uuid::v4());
+
+        $debug = $logger->contextsAt([LogLevel::DEBUG]);
+        $infoAndAbove = $logger->contextsAt([LogLevel::INFO, LogLevel::NOTICE, LogLevel::WARNING, LogLevel::ERROR, LogLevel::CRITICAL, LogLevel::ALERT, LogLevel::EMERGENCY]);
+
+        $this->assertStringNotContainsString('s3cr3t-payload', $infoAndAbove);
+        $this->assertStringContainsString($identifier, $infoAndAbove);
+        $this->assertStringContainsString('s3cr3t-payload', $debug);
+    }
+}
+
+/**
+ * Records every log entry with its level, so a test can tell what a logger
+ * configured at a given minimum level would have written.
+ */
+final class LevelRecordingLogger extends AbstractLogger
+{
+    /** @var list<array{level: mixed, context: array<string, mixed>}> */
+    private array $records = [];
+
+    /**
+     * @param string|\Stringable   $message
+     * @param array<string, mixed> $context
+     */
+    public function log($level, $message, array $context = []): void
+    {
+        $this->records[] = ['level' => $level, 'context' => $context];
+    }
+
+    /**
+     * The JSON-encoded contexts of every record logged at one of the given levels.
+     *
+     * @param list<string> $levels
+     */
+    public function contextsAt(array $levels): string
+    {
+        $contexts = [];
+        foreach ($this->records as $record) {
+            if (\in_array($record['level'], $levels, true)) {
+                $contexts[] = $record['context'];
+            }
+        }
+
+        return json_encode($contexts, \JSON_THROW_ON_ERROR | \JSON_UNESCAPED_SLASHES);
+    }
 }