MCP tool-call traces, with no access to conversation content, let attacker LLMs infer user profile attributes at a 26.25% success rate vs. 17.97% for prior-based guessing, measured on the new PrivacyTrace benchmark (1,000 synthetic profiles, 4,000 trajectories, 25 real MCP servers). Tool arguments and returned results carry most of the signal, and linking traces across sessions amplifies the risk — a concrete privacy design constraint for any agent that logs its tool use.