feat(headers): stop redacting REST + SSE responses; scope reveal_secret_headers to MCP tool only

User feedback on the previous round: the Server Detail edit form refused
to save when any header value still contained the `***REDACTED***`
sentinel, and pushed users at the `reveal_secret_headers: true` config
flag to unblock themselves. That trade-off was wrong — it punished the
human UI to protect an agent code path.

The actual threat model:

- REST API (`/api/v1/servers`, SSE `/events`): gated by the local
  per-install API key. Same trust boundary as access to
  `~/.mcpproxy/mcp_config.json` on disk where these values are already
  stored in plaintext. Redacting in the response bought no real
  security, only broke the Web UI + macOS tray edit-and-save round-trip.

- MCP `upstream_servers` tool: invoked by AI agents, output gets
  read back to the LLM context. THIS is the agent-context exposure
  `reveal_secret_headers` was created to protect — and that redaction
  was already implemented separately in `internal/server/mcp.go:~2545`,
  unaffected by this change.

Backend changes:
- internal/httpapi/server.go: drop `redactServerHeaders` calls in
  `handleGetServers` (both code paths) and remove the now-unused method.
- internal/runtime/event_bus.go: drop the `redactServerHeaders` call on
  SSE `servers.changed` payloads and remove the now-unused method.
- internal/runtime/event_bus_payload_test.go: rewrite the redaction test
  to assert the new policy — SSE must now carry plaintext, the test name
  changes from `…_RedactsSensitiveHeaders` to `…_SendsPlaintextHeaders`.
- internal/config/config.go: update the `RevealSecretHeaders` doc to
  explicitly scope the flag to the MCP tool. REST + SSE always send
  plaintext from now on.

UI cleanup (the redaction sentinel is no longer expected on the wire):
- macOS Swift `saveEdits()`: drop the elaborate redacted-save guard
  (refused save when ***REDACTED*** literal still in textarea OR a
  redacted key was deleted). Both cases became impossible once the REST
  API serves plaintext.
- macOS Swift `kvRow()`: drop the `value != "***REDACTED***"` check
  that disabled the Convert-to-secret button.
- macOS Swift `performConvertToSecret()`: drop the matching guard.
- Vue `KVValueCell.vue`: drop the `isBackendRedacted` computed flag
  and the "Backend redacted this value, set reveal_secret_headers"
  tooltip. Reveal and Convert are always available on literal values.
- Vue `ServerDetail.vue::commitConvert()`: drop the same guard.

Verified end-to-end on macOS and Web UI:
- REST: `curl /api/v1/servers` → `Authorization: Bearer 1d386f...`
  (the real 71-char token).
- MCP tool: `upstream_servers list` → `"Authorization":"***REDACTED***"`
  (still hidden from agents).
- macOS Server Detail → synapbus → Edit → Headers textarea pre-populated
  with the real Bearer token; Save no longer blocked.
- Web UI synapbus Config → Headers row shows `••••59 (71 chars)` with
  reveal eye, Convert-to-secret 🔒, edit, delete — all functional.

OAS spec regenerated.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: claude

frontend/src/components/KVValueCell.vue

@@ -27,23 +27,22 @@
         <span class="font-mono text-xs">env var: {{ envRefName }}</span>
       </span>
     </template>
-    <!-- Literal value: redacted by default, reveal button shows the raw
-         string as returned by the API. If the backend redacted the value
-         (i.e. `reveal_secret_headers: false`), the "raw" string will be
-         `***REDACTED***` and revealing it is a no-op — we surface that
-         explicitly so the user understands why nothing changes. -->
+    <!-- Literal value: masked by default to avoid shoulder-surfing
+         leaks; click the eye to reveal the actual string returned by
+         the REST API. The REST API serves plaintext header / env
+         values (the API key is the gate at this trust boundary), so
+         reveal always shows the real thing. -->
     <template v-else>
       <code v-if="revealed" class="bg-base-200 px-1.5 py-0.5 rounded text-xs break-all">{{ rawValue }}</code>
       <code v-else class="bg-base-200 px-1.5 py-0.5 rounded text-xs text-base-content/50">{{ redactedPreview }}</code>
       <button
         class="btn btn-ghost btn-xs"
-        :title="revealed ? 'Hide value' : (isBackendRedacted ? 'Backend redacted this value. Set reveal_secret_headers: true to view.' : 'Reveal value')"
+        :title="revealed ? 'Hide value' : 'Reveal value'"
         @click="revealed ? $emit('hide') : $emit('reveal')"
       >
         <span aria-hidden="true">{{ revealed ? '🙈' : '👁' }}</span>
       </button>
       <button
-        v-if="!isBackendRedacted"
         class="btn btn-ghost btn-xs"
         title="Move value into the OS keyring and reference it as ${keyring:name}"
         @click="$emit('convert')"
@@ -115,12 +114,6 @@ const envRefName = computed(() => {
   const m = (props.rawValue ?? '').match(/^\$\{env:([^}]+)\}$/)
   return m ? m[1] : ''
 })
-// The Go backend redacts secret header values via
-// internal/httpapi/server.go:redactServerHeaders. Detect that sentinel so
-// we can disable affordances (reveal, convert) that depend on having the
-// real value in hand.
-const isBackendRedacted = computed(() => props.rawValue === '***REDACTED***')
-
 const redactedPreview = computed(() => {
   const v = props.rawValue ?? ''
   if (!v) return '(empty)'

frontend/src/views/ServerDetail.vue

@@ -2106,14 +2106,6 @@ function closeConvertModal() {
 async function commitConvert() {
   const m = convertModal.value
   if (!m.secretName || !m.rawValue) return
-  if (m.rawValue === '***REDACTED***') {
-    systemStore.addToast({
-      type: 'error',
-      title: 'Cannot convert',
-      message: 'Backend is redacting this value (reveal_secret_headers: false). The literal cannot be read from this side; edit the value first or enable reveal_secret_headers in your config.',
-    })
-    return
-  }
   m.busy = true
   try {
     const storeResp = await api.storeSecret(m.secretName, m.rawValue)

internal/config/config.go

@@ -163,13 +163,20 @@ type Config struct {
 	// Security scanner settings (Spec 039)
 	Security *SecurityConfig `json:"security,omitempty" mapstructure:"security"`
 
-	// RevealSecretHeaders, when true, disables the redaction of sensitive
-	// header values (Authorization, X-API-Key, Cookie, …) in responses from
-	// the `upstream_servers` MCP tool and the `/api/v1/servers` REST API.
-	// Default false — sensitive header values are surfaced as
-	// `***REDACTED***` so an MCP agent cannot read Bearer tokens / API keys
-	// out of another upstream's config. Set to true if a downstream tool
-	// needs the raw values (e.g. a UI that round-trips PUT replaces).
+	// RevealSecretHeaders controls whether the `upstream_servers` MCP
+	// tool returns sensitive header values (Authorization, X-API-Key,
+	// Cookie, …) in plaintext or redacted to `***REDACTED***`.
+	//
+	// Default false — an MCP agent calling `upstream_servers list` sees
+	// `***REDACTED***` so it cannot read another upstream's Bearer token
+	// out of the config and exfiltrate it back to the LLM context.
+	//
+	// This flag DOES NOT affect the REST API (`/api/v1/servers`) or the
+	// SSE event stream. Those paths are gated by the local API key —
+	// the same trust boundary as access to `~/.mcpproxy/mcp_config.json`
+	// on disk — so redacting there bought no real security while
+	// breaking the Web UI / macOS tray edit-and-save round-trip. They
+	// always send plaintext.
 	RevealSecretHeaders bool `json:"reveal_secret_headers,omitempty" mapstructure:"reveal-secret-headers"`
 
 	// Server edition multi-user configuration (only meaningful with -tags server)

internal/httpapi/server.go

@@ -22,7 +22,6 @@ import (
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/logs"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/management"
-	"github.com/smart-mcp-proxy/mcpproxy-go/internal/oauth"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/observability"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/reqcontext"
 	internalRuntime "github.com/smart-mcp-proxy/mcpproxy-go/internal/runtime"
@@ -1057,11 +1056,15 @@ func (s *Server) handleGetServers(w http.ResponseWriter, r *http.Request) {
 			}
 		}
 
-		// Redact sensitive header values unless explicitly opted out via
-		// `reveal_secret_headers: true` in config. See config.Config field
-		// for rationale — the same redaction is applied to the
-		// `upstream_servers` MCP tool's list output.
-		s.redactServerHeaders(serverValues)
+		// NOTE: header values flow through the REST API in plaintext.
+		// The REST API is gated by the local API key — the same trust
+		// boundary as access to `~/.mcpproxy/mcp_config.json` on disk
+		// where these values are persisted. Redacting in the response
+		// bought no real security, only broke edit-and-save round-trips
+		// for the Web UI and macOS tray. Redaction is still applied at
+		// the `upstream_servers` MCP tool layer (mcp.go:~2545), which
+		// IS the agent-context exposure that motivated
+		// `reveal_secret_headers`.
 
 		// Dereference stats pointer
 		var statsValue contracts.ServerStats
@@ -1091,8 +1094,8 @@ func (s *Server) handleGetServers(w http.ResponseWriter, r *http.Request) {
 	// Enrich with quarantine stats
 	s.enrichServersWithQuarantineStats(servers)
 
-	// See note above the management-service path for rationale.
-	s.redactServerHeaders(servers)
+	// See note above the management-service path: REST responses now
+	// send plaintext; the MCP `upstream_servers` tool still redacts.
 
 	stats := contracts.ConvertUpstreamStatsToServerStats(s.controller.GetUpstreamStats())
 
@@ -1104,22 +1107,6 @@ func (s *Server) handleGetServers(w http.ResponseWriter, r *http.Request) {
 	s.writeSuccess(w, response)
 }
 
-// redactServerHeaders walks each server in the slice and replaces sensitive
-// header values (Authorization, X-API-Key, Cookie, etc.) with `***REDACTED***`.
-// Skips redaction entirely when `reveal_secret_headers: true` is set in the
-// loaded config, matching the behaviour of the `upstream_servers` MCP tool.
-func (s *Server) redactServerHeaders(servers []contracts.Server) {
-	cfg, err := s.controller.GetConfig()
-	if err == nil && cfg != nil && cfg.RevealSecretHeaders {
-		return
-	}
-	for i := range servers {
-		if len(servers[i].Headers) > 0 {
-			servers[i].Headers = oauth.RedactStringHeaders(servers[i].Headers)
-		}
-	}
-}
-
 // enrichServersWithQuarantineStats adds quarantine metrics (pending/changed tool counts)
 // to each server in the list. This enables the frontend to show quarantine badges.
 func (s *Server) enrichServersWithQuarantineStats(servers []contracts.Server) {

internal/runtime/event_bus.go

@@ -10,7 +10,6 @@ import (
 	"go.uber.org/zap"
 
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/contracts"
-	"github.com/smart-mcp-proxy/mcpproxy-go/internal/oauth"
 	"github.com/smart-mcp-proxy/mcpproxy-go/internal/telemetry"
 )
 
@@ -174,14 +173,19 @@ func (r *Runtime) emitServersChanged(reason string, extra map[string]any) {
 				zap.String("reason", reason),
 				zap.Error(err))
 		} else {
-			redacted := make([]contracts.Server, 0, len(servers))
+			// SSE subscribers ride the same trust boundary as the REST
+			// API (API-key gated, local-host only). Send plaintext
+			// header values so the Web UI / macOS tray can round-trip
+			// edits. The MCP `upstream_servers` tool applies its own
+			// redaction for the agent-context exposure that motivated
+			// reveal_secret_headers.
+			serverList := make([]contracts.Server, 0, len(servers))
 			for _, s := range servers {
 				if s != nil {
-					redacted = append(redacted, *s)
+					serverList = append(serverList, *s)
 				}
 			}
-			r.redactServerHeaders(redacted)
-			payload["servers"] = redacted
+			payload["servers"] = serverList
 			payload["stats"] = stats
 		}
 	}
@@ -194,23 +198,6 @@ func (r *Runtime) emitServersChanged(reason string, extra map[string]any) {
 	r.publishEvent(evt)
 }
 
-// redactServerHeaders mirrors httpapi.(*Server).redactServerHeaders. It strips
-// sensitive header values (Authorization, Cookie, X-API-Key, ...) unless the
-// loaded config opts out via reveal_secret_headers: true. Centralizing this in
-// the runtime keeps SSE subscribers behind the same trust boundary as the
-// HTTP API.
-func (r *Runtime) redactServerHeaders(servers []contracts.Server) {
-	cfg := r.Config()
-	if cfg != nil && cfg.RevealSecretHeaders {
-		return
-	}
-	for i := range servers {
-		if len(servers[i].Headers) > 0 {
-			servers[i].Headers = oauth.RedactStringHeaders(servers[i].Headers)
-		}
-	}
-}
-
 func (r *Runtime) emitConfigReloaded(path string) {
 	payload := map[string]any{"path": path}
 	r.publishEvent(newEvent(EventTypeConfigReloaded, payload))

internal/runtime/event_bus_payload_test.go

@@ -120,7 +120,12 @@ func TestEmitServersChanged_NoListerStillPublishesNotifyOnly(t *testing.T) {
 	assert.False(t, hasServers, "servers key should be absent without a configured lister")
 }
 
-func TestEmitServersChanged_RedactsSensitiveHeaders(t *testing.T) {
+// SSE rides the same trust boundary as the REST API (API-key gated, local
+// only). Header values must come through in plaintext so Web UI / macOS
+// tray clients can round-trip edits. The `upstream_servers` MCP tool keeps
+// its own redaction for the agent-context path — that exposure is the
+// one `reveal_secret_headers` was created to protect.
+func TestEmitServersChanged_SendsPlaintextHeaders(t *testing.T) {
 	servers := []*contracts.Server{
 		{
 			Name: "alpha",
@@ -133,22 +138,23 @@ func TestEmitServersChanged_RedactsSensitiveHeaders(t *testing.T) {
 	stats := &contracts.ServerStats{TotalServers: 1}
 
 	rt := newPayloadTestRuntime(t, &fakeServersLister{servers: servers, stats: stats})
-	// Default config (RevealSecretHeaders=false). Wire a minimal config service
-	// snapshot so r.Config() returns non-nil.
+	// Default config (RevealSecretHeaders=false). The new policy is that
+	// REST + SSE responses do NOT redact, only the MCP tool does, so the
+	// SSE payload should carry plaintext regardless of the flag.
 	rt.cfg = &config.Config{}
 	ch := rt.SubscribeEvents()
 	defer rt.UnsubscribeEvents(ch)
 
-	rt.emitServersChanged("redact-check", nil)
+	rt.emitServersChanged("plaintext-check", nil)
 
 	evt := receiveServersChanged(t, ch)
 	gotServers, ok := evt.Payload["servers"].([]contracts.Server)
 	require.True(t, ok)
 	require.Len(t, gotServers, 1)
 
-	authVal := gotServers[0].Headers["Authorization"]
-	contentVal := gotServers[0].Headers["Content-Type"]
-	assert.NotEqual(t, "Bearer secret-token-value", authVal, "Authorization header must be redacted")
-	assert.Contains(t, authVal, "REDACTED")
-	assert.Equal(t, "application/json", contentVal, "Content-Type is not sensitive; must not be redacted")
+	assert.Equal(t, "Bearer secret-token-value", gotServers[0].Headers["Authorization"],
+		"Authorization must be plaintext over SSE — the API key already gates this endpoint")
+	assert.NotContains(t, gotServers[0].Headers["Authorization"], "REDACTED",
+		"the redaction sentinel must not appear in SSE payloads")
+	assert.Equal(t, "application/json", gotServers[0].Headers["Content-Type"])
 }

native/macos/MCPProxy/MCPProxy/Views/ServerDetailView.swift

@@ -54,12 +54,9 @@ struct ServerDetailView: View {
     @State private var editWorkingDir = ""
     @State private var editEnvVars = ""
     /// HTTP servers only — KEY=VALUE per line. Pre-populated from
-    /// `server.headers` on enter-edit. Sensitive values may show as
-    /// `***REDACTED***` if the backend redacted them; saving redacted
-    /// content unchanged is a no-op (the PATCH endpoint preserves whatever
-    /// arrives but a `***REDACTED***` literal is meaningless to upstream),
-    /// so users editing redacted headers should either edit the value or
-    /// enable `reveal_secret_headers: true` in their config first.
+    /// `server.headers` on enter-edit. The REST API now serves plaintext
+    /// header values (the API key gates that endpoint), so the textarea
+    /// always contains the real strings the user can edit and save back.
     @State private var editHeaders = ""
     @State private var editEnabled = true
     @State private var editQuarantined = false
@@ -1046,47 +1043,11 @@ struct ServerDetailView: View {
         // Parse headers (HTTP / streamable-http only). Same all-or-nothing
         // semantics as env: we always send the parsed map so deletes
         // propagate. The backend handler treats `headers: {}` as "clear",
-        // not "ignore".
+        // not "ignore". The REST API now serves plaintext header values
+        // (the API key gates this endpoint), so the textarea is always
+        // pre-populated with the real values and a straight save is safe.
         if server.protocol == "http" || server.protocol == "sse" || server.protocol == "streamable-http" {
-            let headers = parseKVTextarea(editHeaders)
-
-            // Defense against two distinct destructive edits when the
-            // backend has redacted secret values (reveal_secret_headers
-            // is off):
-            //
-            // 1. The user leaves a `***REDACTED***` literal in the
-            //    textarea and clicks Save — we'd persist the literal
-            //    sentinel as the new value, breaking the upstream.
-            //
-            // 2. The user *removes* a redacted line (perhaps to add a
-            //    new header alongside it) without realising they're
-            //    also wiping out the real secret behind the redaction.
-            //    The new map has no `***REDACTED***` so guard #1 misses
-            //    it, but the original key has silently vanished and the
-            //    real Authorization header is gone from the saved config.
-            //
-            // Compare against the original `server.headers` keys whose
-            // value is the redaction sentinel and refuse the save if any
-            // of them are still ***REDACTED*** OR have been dropped
-            // entirely. Either way the user needs to enable
-            // reveal_secret_headers in their config first so they can
-            // see and explicitly carry the value forward (or use the
-            // Web UI's per-row affordances).
-            let redactedKeysInOriginal: Set<String> = Set(
-                (server.headers ?? [:])
-                    .filter { $0.value == "***REDACTED***" }
-                    .map { $0.key }
-            )
-            let stillRedacted = headers.filter { $0.value == "***REDACTED***" }.map { $0.key }
-            let droppedFromOriginal = redactedKeysInOriginal.subtracting(headers.keys)
-
-            if !stillRedacted.isEmpty || !droppedFromOriginal.isEmpty {
-                let offenders = (stillRedacted + Array(droppedFromOriginal)).sorted().joined(separator: ", ")
-                editError = "Cannot save: the backend redacted these headers and the real values are not visible here: \(offenders). Set `reveal_secret_headers: true` in your config to view + edit them, then try again."
-                isSavingEdit = false
-                return
-            }
-            updates["headers"] = headers
+            updates["headers"] = parseKVTextarea(editHeaders)
         }
 
         // Boolean toggles
@@ -1259,13 +1220,6 @@ struct ServerDetailView: View {
 
     private func performConvertToSecret(_ ctx: ConvertToSecretContext) async {
         guard let client = apiClient else { return }
-        // Refuse to convert if the value is the backend redaction
-        // sentinel — that means the real value is not in our hands and
-        // would be uploaded literally to the keyring.
-        if ctx.value == "***REDACTED***" {
-            convertSheetError = "Cannot convert a redacted value. Set `reveal_secret_headers: true` in your config to view + convert."
-            return
-        }
         let name = convertSheetSecretName.trimmingCharacters(in: .whitespaces)
         if name.isEmpty { return }
         convertSheetBusy = true
@@ -1322,7 +1276,7 @@ struct ServerDetailView: View {
                     .font(.scaledMonospaced(.subheadline, scale: fontScale))
                     .textSelection(.enabled)
 
-                if value != "***REDACTED***" && !value.isEmpty {
+                if !value.isEmpty {
                     Button {
                         openConvertSheet(scope: scope, key: key, value: value)
                     } label: {

oas/docs.go

@@ -108,13 +108,20 @@ components:
           type: boolean
         reveal_secret_headers:
           description: |-
-            RevealSecretHeaders, when true, disables the redaction of sensitive
-            header values (Authorization, X-API-Key, Cookie, …) in responses from
-            the `upstream_servers` MCP tool and the `/api/v1/servers` REST API.
-            Default false — sensitive header values are surfaced as
-            `***REDACTED***` so an MCP agent cannot read Bearer tokens / API keys
-            out of another upstream's config. Set to true if a downstream tool
-            needs the raw values (e.g. a UI that round-trips PUT replaces).
+            RevealSecretHeaders controls whether the `upstream_servers` MCP
+            tool returns sensitive header values (Authorization, X-API-Key,
+            Cookie, …) in plaintext or redacted to `***REDACTED***`.
+
+            Default false — an MCP agent calling `upstream_servers list` sees
+            `***REDACTED***` so it cannot read another upstream's Bearer token
+            out of the config and exfiltrate it back to the LLM context.
+
+            This flag DOES NOT affect the REST API (`/api/v1/servers`) or the
+            SSE event stream. Those paths are gated by the local API key —
+            the same trust boundary as access to `~/.mcpproxy/mcp_config.json`
+            on disk — so redacting there bought no real security while
+            breaking the Web UI / macOS tray edit-and-save round-trip. They
+            always send plaintext.
           type: boolean
         routing_mode:
           description: |-