Problem
Tool usage stats store raw exception messages from prior method calls and expose them to any caller of get_tool_usage_stats.
Evidence
Editor/MCPServerMethods.ToolUsage.cs:50-52 stores failure.Message as LastError.Editor/MCPServerMethods.ToolUsage.cs:56-75 returns usage stats to callers.- Error messages can include local paths, object names, environment details, or project-specific information.
Impact
One local client can read error details generated by another client/session. With the current unauthenticated local server, this leaks project/environment information across local processes.
Suggested fix
Redact or truncate sensitive exception details in stats, or expose detailed last errors only to the originating session once session/auth boundaries exist.
Source report
Imported from audit report item: security (15) / Editor/MCPServerMethods.ToolUsage.cs:52.
Problem
Tool usage stats store raw exception messages from prior method calls and expose them to any caller of
get_tool_usage_stats.Evidence
Editor/MCPServerMethods.ToolUsage.cs:50-52storesfailure.MessageasLastError.Editor/MCPServerMethods.ToolUsage.cs:56-75returns usage stats to callers.Impact
One local client can read error details generated by another client/session. With the current unauthenticated local server, this leaks project/environment information across local processes.
Suggested fix
Redact or truncate sensitive exception details in stats, or expose detailed last errors only to the originating session once session/auth boundaries exist.
Source report
Imported from audit report item:
security (15)/Editor/MCPServerMethods.ToolUsage.cs:52.