Log without breaking stdio

A stdio client launches the server as a child process. It writes protocol messages to the server’s stdin and reads protocol messages from its stdout.

That makes stdout part of the wire contract. One console.log() can corrupt the stream.

Use console.error() for local diagnostics:

console.error(JSON.stringify({
  event: 'server_start',
  server: 'project-notes'
}))

Use stderr for local diagnostics. A client may display, capture, or ignore it, so do not depend on a person seeing the message.

Do not log note bodies, authorization headers, tokens, or full tool arguments. Record the event, safe identifiers, and an incident ID when needed.

Be careful with dependencies too. A library that logs a startup banner to stdout breaks stdio even when your own source is clean.

Test both channels:

npm run dev 1>protocol.log 2>diagnostics.log

When a real client is connected, protocol.log must contain only protocol messages. diagnostics.log may contain safe operational events.

Search the project for console.log before testing the stdio server. There should be none in its execution path.