fix(mcp): honor TRACELOOP_TRACE_CONTENT in transport instrumentation

[pacocartones]

The transport-level MCP instrumentation (packages/opentelemetry-instrumentation-mcp) recorded tool call arguments, tool results and MCP response values onto spans unconditionally, ignoring TRACELOOP_TRACE_CONTENT.

That content is third-party data — tool call arguments and results may contain end-user PII — and every other instrumentation in this repo, including the FastMCP wrapper in this same package (_should_send_prompts()), honors the flag. The transport-level path was the one place that did not, so operators who set TRACELOOP_TRACE_CONTENT=false still had tool inputs/outputs captured on spans.

This adds a should_send_prompts() helper to utils.py (mirroring the FastMCP one) and gates the three content attributes (TRACELOOP_ENTITY_INPUT, TRACELOOP_ENTITY_OUTPUT, MCP_RESPONSE_VALUE) behind it. Error/status handling (isError) stays outside the gate.

Adds tests/test_content_privacy.py: with TRACELOOP_TRACE_CONTENT=false no secret leaks onto any span; with it enabled the content is still captured. RED before the fix, GREEN after; no regression.

Summary by CodeRabbit

• New Features

  • Added privacy controls for MCP telemetry content capture.
  • Prompt and response content can now be enabled or disabled using TRACELOOP_TRACE_CONTENT.
  • Content capture remains enabled by default when the setting is not specified.

• Bug Fixes

  • Prevented tool inputs, outputs, and response values from being recorded when content capture is disabled.
  • Preserved existing span error reporting behavior.

[CLAassistant]

All committers have signed the CLA.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 484ae096-26d2-40f4-a2ae-fc75453d7508

📥 Commits

Reviewing files that changed from the base of the PR and between 62e24c2 and eb8bf21.

📒 Files selected for processing (3)

• packages/opentelemetry-instrumentation-mcp/opentelemetry/instrumentation/mcp/instrumentation.py
• packages/opentelemetry-instrumentation-mcp/opentelemetry/instrumentation/mcp/utils.py
• packages/opentelemetry-instrumentation-mcp/tests/test_content_privacy.py

Included review availability: Your plan provides up to 8 included reviews per hour; 7 remain after this review.

---

📝 Walkthrough

Walkthrough

MCP instrumentation now gates prompt and response content attributes with TRACELOOP_TRACE_CONTENT. Content capture remains enabled by default. Tests cover disabled and enabled capture for tool arguments and results.

Changes

MCP prompt privacy

Layer / File(s)	Summary
Content capture policy packages/opentelemetry-instrumentation-mcp/opentelemetry/instrumentation/mcp/utils.py	Added should_send_prompts(). The helper reads TRACELOOP_TRACE_CONTENT and enables capture only when the value is case-insensitively true; an unset variable enables capture.
Instrumentation content gating packages/opentelemetry-instrumentation-mcp/opentelemetry/instrumentation/mcp/instrumentation.py, packages/opentelemetry-instrumentation-mcp/tests/test_content_privacy.py	MCP input attributes, output attributes, and response stream values are recorded only when prompt capture is enabled. Privacy tests verify disabled and enabled capture behavior.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to eb8bf

The change gates transport-level MCP content attributes on TRACELOOP_TRACE_CONTENT, but the enabled regression test may be satisfied by a separate FastMCP span rather than the transport span, leaving the privacy fix insufficiently verified. The PR is mergeable with explicit follow-up to scope assertions to transport spans.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: honoring TRACELOOP_TRACE_CONTENT in MCP transport instrumentation.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}