Mask plaintext value in codex_set MCP response when encryption is used

[Copilot]

When codex_set was called with encrypt: true, the success response echoed back the plaintext value, leaking it through the MCP tool response despite the stored value being encrypted.

Changes

• src/mcp-server.ts: Replace value with [encrypted] in both codex_set response paths (with and without alias) when encrypt is truthy

// Before
return textResponse(`Set: ${resolved} = ${value}`);

// After
return textResponse(`Set: ${resolved} = ${encrypt ? '[encrypted]' : value}`);

• src/__tests__/mcp-server.test.ts: Added two tests to verify the masking behavior:
  • Verifies [encrypted] is shown (and plaintext is absent) in the response when encrypt: true is passed without an alias
  • Verifies the same masking behavior when an alias is also provided

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.

[Copilot]

Pull request overview

This PR addresses a security vulnerability where the codex_set MCP tool was leaking plaintext values in success responses when encryption was enabled. The fix ensures that encrypted values are properly masked in tool responses, preventing sensitive data exposure through the MCP interface.

Changes:

• Modified codex_set tool response messages to display [encrypted] instead of the plaintext value when the encrypt parameter is true

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.