Redact MCP tool arguments by default at the logger config, then opt non-sensitive fields back in

Digital Applied·medium signal

Flip your structured logger (Pino/Winston/Python logging) to mask all argument values by default and maintain an explicit allow-list of fields approved for logging, with a documented reason each. Source-side redaction survives library upgrades, log-routing changes, and incident-response stress, whereas sink-side scrubbing is permanently best-effort. This stops your audit trail from quietly becoming a second copy of every secret that ever flowed through a tool call.