From a44193b6e4895a6a4992813cb907763893d10c49 Mon Sep 17 00:00:00 2001
From: Andras Bacsai <5845193+andrasbacsai@users.noreply.github.com>
Date: Mon, 9 Nov 2026 11:04:47 +0100
Subject: [PATCH] fix(mcp): return only service fields from get_service

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .changes/hid-the-server-details-of-a.md |  4 ++++
 app/Mcp/Tools/GetService.php            |  2 +-
 tests/Feature/Mcp/McpReadToolsTest.php  | 18 ++++++++++++++++++
 3 files changed, 23 insertions(+), 1 deletion(-)
 create mode 100644 .changes/hid-the-server-details-of-a.md

diff --git a/.changes/hid-the-server-details-of-a.md b/.changes/hid-the-server-details-of-a.md
new file mode 100644
index 0000000000..2eebc3f5fb
--- /dev/null
+++ b/.changes/hid-the-server-details-of-a.md
@@ -0,0 +1,4 @@
+---
+type: security
+---
+Removed the server details from the response of the `get_service` MCP tool
diff --git a/app/Mcp/Tools/GetService.php b/app/Mcp/Tools/GetService.php
index ba5725e902..5560dca0fa 100644
--- a/app/Mcp/Tools/GetService.php
+++ b/app/Mcp/Tools/GetService.php
@@ -46,7 +46,7 @@ class GetService extends Tool
         }
 
         $service->setRelations([]);
-        $service->makeHidden(['destination', 'source', 'environment', 'applications', 'databases', 'serviceApplications', 'serviceDatabases']);
+        $service->makeHidden(['server', 'destination', 'source', 'environment', 'applications', 'databases', 'serviceApplications', 'serviceDatabases']);
 
         return $this->mcpSuccess($request, $this->respond(
             $this->scrubSensitive($service->toArray()),
diff --git a/tests/Feature/Mcp/McpReadToolsTest.php b/tests/Feature/Mcp/McpReadToolsTest.php
index 3be911b8c6..6de1fb11c5 100644
--- a/tests/Feature/Mcp/McpReadToolsTest.php
+++ b/tests/Feature/Mcp/McpReadToolsTest.php
@@ -2675,3 +2675,21 @@ test('redactLogText redacts JSON secret fields in log lines', function () {
         ->and($mixed)->not->toContain('redactme03')
         ->and($mixed)->toContain(REDACTED);
 });
+
+test('get_service does not return the server of the service', function () {
+    $service = Service::factory()->create([
+        'environment_id' => $this->environment->id,
+        'server_id' => $this->server->id,
+        'destination_id' => $this->destination->id,
+        'destination_type' => $this->destination->getMorphClass(),
+    ]);
+
+    $response = mcpReadCall('get_service', ['uuid' => $service->uuid]);
+    $response->assertOk();
+    $data = mcpReadJson($response)['data'];
+
+    expect($data['uuid'])->toBe($service->uuid)
+        ->and($data)->toHaveKey('server_status')
+        ->and($data)->not->toHaveKey('server')
+        ->and(json_encode($data))->not->toContain($this->server->ip);
+});