dbt-mcp Server Plaintext Logging of Sensitive Tool Call Arguments

Technical Analysis

The vulnerability resides in DbtMCP.call_tool() within src/dbt_mcp/mcp/server.py, which logged the full arguments dictionary at INFO level before tool execution and again at ERROR level on exceptions. When DBT_MCP_SERVER_FILE_LOGGING=true, configure_file_logging() persisted these records to dbt-mcp.log without rotation or automatic deletion, meaning sensitive sql_query, vars, and node_selection values (potentially containing credentials, business logic, or PII embedded in queries) accumulated in plaintext over time. The entry point is any legitimate MCP tool call made by an authorized agent or client; no injection or bypass is needed. The attacker gains access to sensitive data only if they can separately obtain read access to the log file (e.g., via misconfigured permissions, shared hosting, or backup exposure), making this a secondary-exposure risk rather than a directly exploitable remote vulnerability.

Affected Systems

dbt-mcp; protocols: MCP

Detection Signatures

• Presence of dbt-mcp.log files containing plaintext sql_query, vars, or node_selection fields
• DBT_MCP_SERVER_FILE_LOGGING=true in environment configuration for dbt-mcp versions prior to 1.17.1
• INFO or ERROR level log entries in dbt-mcp logs containing full raw tool argument dictionaries
• Absence of log rotation/retention policy on MCP server log directories

Remediation Steps

1. 1

   Upgrade dbt-mcp

   Update to dbt-mcp version 1.17.1 or later, which addresses the plaintext logging of sensitive tool arguments.

2. 2

   Audit existing logs

   Review and securely delete or redact existing dbt-mcp.log files that may contain sensitive sql_query, vars, or node_selection data from before the fix was applied.

3. 3

   Restrict log file access

   Ensure log directories have appropriate filesystem permissions and are excluded from backups, shared volumes, or version control.

4. 4

   Implement log rotation and retention policies

   Configure automatic log rotation and deletion for MCP server logs to limit the window of exposure for any sensitive data inadvertently logged.

5. 5

   Avoid enabling verbose file logging in production

   Only enable DBT_MCP_SERVER_FILE_LOGGING when actively debugging, and disable it in production environments handling sensitive data.