From 08d077605a404af8eeddb18e44af04b2ad4f067d Mon Sep 17 00:00:00 2001
From: Jason Woltje <jason.woltje@uscllc.com>
Date: Fri, 6 Feb 2026 15:11:41 -0600
Subject: [PATCH] fix(SEC-API-28): Replace MCP console.error with NestJS Logger

Replace all console.error calls in MCP services with NestJS Logger
instances for consistent structured logging in production.

- mcp-hub.service.ts: Add Logger instance, replace console.error in
  onModuleDestroy cleanup
- stdio-transport.ts: Add Logger instance, replace console.error for
  stderr output (as warn) and JSON parse failures (as error)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 apps/api/src/mcp/mcp-hub.service.ts | 5 +++--
 apps/api/src/mcp/stdio-transport.ts | 6 ++++--
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/apps/api/src/mcp/mcp-hub.service.ts b/apps/api/src/mcp/mcp-hub.service.ts
index 84384dd..0002a59 100644
--- a/apps/api/src/mcp/mcp-hub.service.ts
+++ b/apps/api/src/mcp/mcp-hub.service.ts
@@ -1,4 +1,4 @@
-import { Injectable, OnModuleDestroy } from "@nestjs/common";
+import { Injectable, Logger, OnModuleDestroy } from "@nestjs/common";
 import { StdioTransport } from "./stdio-transport";
 import { ToolRegistryService } from "./tool-registry.service";
 import type { McpServer, McpServerConfig, McpRequest, McpResponse } from "./interfaces";
@@ -16,6 +16,7 @@ interface McpServerWithTransport extends McpServer {
  */
 @Injectable()
 export class McpHubService implements OnModuleDestroy {
+  private readonly logger = new Logger(McpHubService.name);
   private servers = new Map<string, McpServerWithTransport>();
 
   constructor(private readonly toolRegistry: ToolRegistryService) {}
@@ -161,7 +162,7 @@ export class McpHubService implements OnModuleDestroy {
   async onModuleDestroy(): Promise<void> {
     const stopPromises = Array.from(this.servers.keys()).map((serverId) =>
       this.stopServer(serverId).catch((error: unknown) => {
-        console.error(`Failed to stop server ${serverId}:`, error);
+        this.logger.error(`Failed to stop server ${serverId}:`, error);
       })
     );
 
diff --git a/apps/api/src/mcp/stdio-transport.ts b/apps/api/src/mcp/stdio-transport.ts
index eb5f380..8a53df9 100644
--- a/apps/api/src/mcp/stdio-transport.ts
+++ b/apps/api/src/mcp/stdio-transport.ts
@@ -1,4 +1,5 @@
 import { spawn, type ChildProcess } from "node:child_process";
+import { Logger } from "@nestjs/common";
 import type { McpRequest, McpResponse } from "./interfaces";
 
 /**
@@ -6,6 +7,7 @@ import type { McpRequest, McpResponse } from "./interfaces";
  * Spawns a child process and communicates via stdin/stdout using JSON-RPC 2.0
  */
 export class StdioTransport {
+  private readonly logger = new Logger(StdioTransport.name);
   private process?: ChildProcess;
   private pendingRequests = new Map<
     string | number,
@@ -39,7 +41,7 @@ export class StdioTransport {
         });
 
         this.process.stderr?.on("data", (data: Buffer) => {
-          console.error(`MCP stderr: ${data.toString()}`);
+          this.logger.warn(`MCP stderr: ${data.toString()}`);
         });
 
         this.process.on("error", (error) => {
@@ -130,7 +132,7 @@ export class StdioTransport {
           const response = JSON.parse(message) as McpResponse;
           this.handleResponse(response);
         } catch (error) {
-          console.error("Failed to parse MCP response:", error);
+          this.logger.error("Failed to parse MCP response:", error);
         }
       }
     }