<digits>@c.us. The MCP redaction hook matches on shape, so an account's own id came back as [REDACTED_EMAIL] and a self-chat protocol could not find its own target. Measured live on alpha.85, 2026-09-06.One Set.has on the full tool name. That is deliberate: a prefix or substring test would let one exempted status tool quietly exempt every tool on the same server, which is the failure mode an allowlist exists to prevent.
// src/hooks/src/posttool/mcp-output-transform.ts, this branch function redactExemptTools(): ReadonlySet<string> { const raw = process.env.ORK_MCP_REDACT_EXEMPT_TOOLS; if (!raw) return EMPTY_EXEMPT_SET; return new Set(raw.split(',').map(n => n.trim()).filter(n => n.length > 0)); } // Phase 1: redaction runs unless this exact tool name is listed. const redactionExempt = redactExemptTools().has(toolName); const { text: redacted, redactionCount } = redactionExempt ? { text: outputStr, redactionCount: 0 } : redactPII(outputStr);
| Behaviour | With the tool exempted |
|---|---|
| Phase 1 redaction on that one tool | skipped, whole result |
| Phase 2 truncation on that one tool | unchanged, still truncates |
Reversible stash (ORK_HEADROOM_REVERSIBLE) | unchanged |
| Every other tool on the same server | still redacts |
| Default with the env var unset | byte-identical to before |
| Per-field control inside an exempt tool | none: exempt is whole-result, so opt in one tool name at a time |