MCP server filtering improvements #5654
Open
+1,406
−562
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Converted file retrieval methods in PhabricatorPatch and related interfaces to async, replacing synchronous HTTP calls with httpx.AsyncClient.
Trusted users are now: - Mozilla Corporation employees, OR - Users with editbugs privilege who have been active within last year This prevents dormant accounts with editbugs from being considered trusted.
Refactor metadata filtering into a SanitizedBug class that inherits from Bug and overrides properties to return sanitized values when no trusted user has commented. When there's no trusted comment, the following are redacted: - Bug title/summary - Reporter name and email - Assignee name and email The trust check uses cached_property to avoid redundant API calls. Bug.get() now returns SanitizedBug by default for security.
Refactor metadata filtering into a SanitizedPhabricatorPatch class that inherits from PhabricatorPatch and overrides properties to return sanitized values when no trusted user has commented. When there's no trusted comment, the following are redacted: - Revision title - Author name and email - Summary and test plan - Diff author (if different from revision author) - Stack graph titles The trust check uses cached_property to avoid redundant API calls. PhabricatorReviewData.get_patch_by_id() now returns SanitizedPhabricatorPatch.
This is now the full list from BMO
Automatically trust comments created before 2022 as prompt injection was not a concern at that time. This applies to both comment content validation and metadata redaction policies.
Ensure collapsed/admin tagged comments are excluded from all trust validation logic, not just the timeline output: - Skip when finding last trusted comment - Skip when building trusted user cache - Skip when checking for any trusted comment
Add comprehensive test coverage for: - Admin-tagged comments being completely disregarded - Pre-2022 comments being automatically trusted - All collapsed tags (spam, abuse, nsfw, etc.) filtering These tests validate the security policy changes implemented in previous commits.
suhaibmujahid
requested changes
Feb 6, 2026
Member
suhaibmujahid
left a comment
suhaibmujahid
left a comment
There was a problem hiding this comment.
Thank you! It looks good to me, with a few comments.
We agreed not to use the last_seen_date activity data since it's not useful for determining trust.
All Mozilla Corporation members are inherently in the editbugs group, so checking both is redundant.
Changed Bug.get from @staticmethod to @classmethod to use cls instead of hardcoding the return type. Modified MCP server to use SanitizedBug directly so sanitization only happens at the API boundary.
The title is already displayed in the page header and is automatically sanitized via the patch_title property.
Modified MCP server to use SanitizedPhabricatorPatch instead of PhabricatorPatch so sanitization only happens at the API boundary.
This method is not used by the MCP server, so sanitization should not be applied here. Sanitization is handled at the MCP server boundary.
The _display suffix is a new pattern not in master. Removing it to keep the changes minimal and avoid introducing new naming conventions.
- Remove mozilla-corporation group check (only editbugs matters) - Remove activity date checks (not useful for trust determination)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This implements the policy as discussed on the 2026-02-05.