Mastra•2mo ago

Step-start includes System prompt in payload

Hello, im not sure if this a normal behavior or a misconfiguration on our part, but when ver we use the stream API, the first step (step-start) inlcudes the full system prompt + working memory + tool list in its payload.
this sensitive information is therefore visible to anyone inspecting the console.

Mastra Triager•11/10/25, 11:23 AM

Created GitHub issue: https://github.com/mastra-ai/mastra/issues/9915

GitHub

Step-start includes System prompt in payload · Issue #9915 · mast...

This issue was created from Discord post 1437327100116729959: Hello, im not sure if this a normal behavior or a misconfiguration on our part, but when ver we use the stream API, the first step (ste...

_roamin_•11/10/25, 9:15 PM

Hi @avidal_arya ! It is currently the expected behaviour because this endpoint provides a full stream of all the events happening during the agentic loop, but I need to check with the team if that is really what we want.

avidal_aryaOP•11/11/25, 6:37 AM

Hi @roamin yes please it would be great if there was a parameter for the stream endpoint to hide the payload request of the Step-start. available in client-js too. thanks!

Abhi Aiyer•12/1/25, 4:22 AM

We are going to fix this! We made another issue for tracking https://github.com/mastra-ai/mastra/issues/10363

GitHub

[BUG] Mastra server's agent `stream` API endpoint is leaking sensit...

Describe the Bug There are steps, like step-start and step-finish that basically provide the raw request info that were sent to the model providers which is leaking a lot of info that end users sho...

avidal_aryaOP•12/1/25, 4:57 PM

Awesome thanks for the update

Abhi Aiyer•12/1/25, 5:29 PM

We merged the fix today and itll be released in the weekly tmrw

Step-start includes System prompt in payload

Similar Threads

Similar Threads

Similar Threads