solace-broker-mcp: Skill for Claude Code

Check Logs

Scan Go code for logging security violations and compliance issues. Invoked with /check-logs.

When to use

• Before committing code
• After adding logging to a file
• As a periodic audit of the codebase
• When reviewing someone else's changes

Usage

• /check-logs — scan the entire codebase
• /check-logs <file_path> — scan a specific file
• /check-logs staged — scan only git-staged files

Steps

Step 1: Read the rules

Read the secure logging rules at docs/secure-logging-rules.md in the project root. These are the rules you're checking against.

Step 2: Identify files to scan

Based on the invocation:

• No args: scan all .go files under cmd/ and internal/
• File path: scan that file
• staged: run git diff --cached --name-only -- '*.go' and scan those files

Step 3: Run violation checks

For each file, check for the following violations in order of severity:

CRITICAL — Credential exposure

• C-01: Credentials in log calls — Any log call that includes Password, Username, Token, Secret, or Authorization field values
• C-02: Raw struct logging — slog.Any("key", someStruct) or log.Printf("%+v", someStruct) where the struct is or contains a credential-carrying type (BrokerConfig, AuthConfig, ServerConfig, HTTPClient)
• C-03: Config map logging — Logging map[string]*BrokerConfig or the full ServerConfig.Brokers map
• C-04: Raw Authorization header — Logging the value of an Authorization HTTP header
• C-05: URL with credentials — Logging a URL that matches ://.*:.*@ pattern

HIGH — Missing protections

• H-01: Missing LogValuer — Credential-carrying types (AuthConfig, BrokerConfig, and any struct with password/token/secret fields) that don't implement slog.LogValuer
• H-02: Missing ReplaceAttr — slog handler created without ReplaceAttr safety net
• H-03: Stdout logging — Any log output directed to os.Stdout instead of os.Stderr
• H-04: Old log package — Usage of log.Printf, log.Println, log.Fatalf, log.Fatal instead of slog