Query log at ~/.cache/graphify-queries.log is default-on and undocumented

[adam-pond-agent]

Summary

graphify_mcp's query-log helper (graphify/querylog.py) writes a default-on, unbounded, fail-silent log of every query / path / explain call to ~/.cache/graphify-queries.log. The log records the question text and corpus path for every call, and — if GRAPHIFY_QUERY_LOG_RESPONSES is ever set — the full response body too.

We noticed this while wiring graphify-mcp into an internal multi-repo dev workflow: nothing in the CLI/MCP docs or --help output mentions that this log exists, so it's easy to have it silently accumulating without realising.

Why this matters for org use

• The questions we send to graphify query / explain / path routinely reference proprietary internal service names, ticket numbers, and pasted code fragments from private repositories.
• The log lives outside every repo (~/.cache/, not <repo>/graphify-out/), so it's outside our repos' .gitignore conventions, retention windows, and cleanup tooling — nothing in our workflow expects a plaintext record of agent queries to be sitting in the user's home directory.
• It's unbounded (append-only, no rotation) and fails silently on write errors (except Exception: pass), so there's no visible signal that it's growing or that logging is even happening.
• If ~/.cache is ever backed up, synced to cloud storage, or the machine is shared, this log — and the proprietary context embedded in it — leaks with it.

Version observed

graphifyy 0.8.44 (PyPI), graphify/querylog.py:

def _log_path() -> Path | None:
    if os.environ.get("GRAPHIFY_QUERY_LOG_DISABLE", "").lower() in ("1", "true", "yes"):
        return None
    override = os.environ.get("GRAPHIFY_QUERY_LOG", "").strip()
    if override:
        return Path(override).expanduser()
    return Path.home() / ".cache" / "graphify-queries.log"

What we found (and what we're doing locally in the meantime)

There's already a GRAPHIFY_QUERY_LOG_DISABLE env var that turns the log off entirely — thank you, that made it easy for us to disable it fleet-wide once we found it by reading the source. We've set GRAPHIFY_QUERY_LOG_DISABLE=1 on our graphify-mcp server registration as a workaround.

Request

Could this be:

1. Documented — a line in the README / MCP tool docs naming the log's location, contents, and the GRAPHIFY_QUERY_LOG_DISABLE / GRAPHIFY_QUERY_LOG / GRAPHIFY_QUERY_LOG_RESPONSES env vars, so users don't have to read querylog.py to discover it exists, or
2. Default-off — opt-in (GRAPHIFY_QUERY_LOG_ENABLE=1) rather than opt-out, given the log can capture proprietary query text and full response bodies from private codebases by default?

Either would resolve this for us; (2) is our preference since it removes the "undiscovered plaintext log of your work" surprise entirely, but we understand there may be reasons (e.g. supporting your own debugging/telemetry workflows) to keep it default-on and just document it well instead.

Happy to send a PR for either approach if that's useful — let us know which direction you'd prefer.

[safishamsi]

Fixed on v8 (0.9.13) — went with your preferred option (2): the query log is now opt-in, off by default, and (1) documented too.

Nothing is written unless you explicitly enable it:

• GRAPHIFY_QUERY_LOG_ENABLE=1 → log to ~/.cache/graphify-queries.log
• GRAPHIFY_QUERY_LOG=<path> → log to a path of your choosing
• GRAPHIFY_QUERY_LOG_DISABLE=1 still forces it off (wins over the enable vars, so your fleet-wide workaround keeps working)

A default-on plaintext record of proprietary queries didn't fit graphify's on-device / no-telemetry posture, so this removes the surprise entirely. All four env vars are now in the README's Environment variables table, and there are regression tests pinning default-off. Thanks for the clear writeup and for offering a PR — turned out to be a small, clean flip.