@metrone-io/mcp 1.0.2 → 1.0.3

package/README.md

@@ -37,7 +37,7 @@ Optionally set `METRONE_ENDPOINT` to override the default API base URL (`https:/
 | `metrone_get_pages` | Top pages by views |
 | `metrone_get_sources` | Traffic sources breakdown |
 | `metrone_get_live` | Current live visitors |
-| `metrone_track_event` | Track a custom event |
+| `metrone_track_event` | Track a custom event (query strings and `mailto:` local-parts are stripped) |
 | `metrone_track_ai_call` | Track an AI call or chat session |
 
 ## Example

package/dist/index.js

@@ -123,8 +123,13 @@ var TOOLS = [
         source: str(args.source) ?? "assistant"
       };
       if (str(args.event_name)) body.event_name = args.event_name;
-      if (str(args.page_url)) body.page_url = args.page_url;
-      if (args.properties && typeof args.properties === "object") body.properties = args.properties;
+      const pageUrl = str(args.page_url);
+      if (pageUrl) body.page_url = sanitizePublicUrl(pageUrl);
+      if (args.properties && typeof args.properties === "object") {
+        const props = { ...args.properties };
+        if (typeof props.url === "string") props.url = sanitizePublicUrl(props.url);
+        body.properties = props;
+      }
       return { method: "POST", path: "/v1/api/events", body };
     }
   },
@@ -192,6 +197,20 @@ async function dispatch(toolName, args, executor) {
   validateArgs(tool, args);
   return executor(tool.buildRequest(args));
 }
+function sanitizePublicUrl(url) {
+  if (!url) return url;
+  if (url.startsWith("mailto:")) {
+    const rest = url.slice(7).split("?")[0].split("#")[0];
+    const at = rest.lastIndexOf("@");
+    return at >= 0 ? `mailto:@${rest.slice(at + 1)}` : "mailto:";
+  }
+  const q = url.indexOf("?");
+  const h = url.indexOf("#");
+  let cut = url.length;
+  if (q >= 0) cut = q;
+  if (h >= 0 && h < cut) cut = h;
+  return url.slice(0, cut);
+}
 
 // src/index.ts
 var API_KEY = process.env.METRONE_API_KEY;

package/dist/tools.js

@@ -116,8 +116,13 @@ var TOOLS = [
         source: str(args.source) ?? "assistant"
       };
       if (str(args.event_name)) body.event_name = args.event_name;
-      if (str(args.page_url)) body.page_url = args.page_url;
-      if (args.properties && typeof args.properties === "object") body.properties = args.properties;
+      const pageUrl = str(args.page_url);
+      if (pageUrl) body.page_url = sanitizePublicUrl(pageUrl);
+      if (args.properties && typeof args.properties === "object") {
+        const props = { ...args.properties };
+        if (typeof props.url === "string") props.url = sanitizePublicUrl(props.url);
+        body.properties = props;
+      }
       return { method: "POST", path: "/v1/api/events", body };
     }
   },
@@ -185,6 +190,20 @@ async function dispatch(toolName, args, executor) {
   validateArgs(tool, args);
   return executor(tool.buildRequest(args));
 }
+function sanitizePublicUrl(url) {
+  if (!url) return url;
+  if (url.startsWith("mailto:")) {
+    const rest = url.slice(7).split("?")[0].split("#")[0];
+    const at = rest.lastIndexOf("@");
+    return at >= 0 ? `mailto:@${rest.slice(at + 1)}` : "mailto:";
+  }
+  const q = url.indexOf("?");
+  const h = url.indexOf("#");
+  let cut = url.length;
+  if (q >= 0) cut = q;
+  if (h >= 0 && h < cut) cut = h;
+  return url.slice(0, cut);
+}
 export {
   TOOLS,
   ToolValidationError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metrone-io/mcp",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Metrone MCP server — expose analytics to AI agents via Model Context Protocol",
   "type": "module",
   "main": "./dist/index.js",