@posthog/mcp 0.10.0 → 0.10.2

package/dist/extensions/capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../src/extensions/capture.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAMvD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CA+DnG"}
+{"version":3,"file":"capture.d.ts","sourceRoot":"","sources":["../../src/extensions/capture.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAMvD;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,SAAS,CAkEnG"}

package/dist/extensions/capture.js

@@ -49,8 +49,8 @@ function captureEvent(server, eventInput) {
         sdkVersion: sessionInfo.sdkVersion,
         serverName: sessionInfo.serverName,
         serverVersion: sessionInfo.serverVersion,
-        clientName: sessionInfo.clientName,
-        clientVersion: sessionInfo.clientVersion,
+        clientName: eventInput.clientName ?? sessionInfo.clientName,
+        clientVersion: eventInput.clientVersion ?? sessionInfo.clientVersion,
         identifyActorGivenId: sessionInfo.identifyActorGivenId,
         identifyActorData: sessionInfo.identifyActorData,
         groups: sessionInfo.identifyActorGroups,

package/dist/extensions/capture.mjs

@@ -21,8 +21,8 @@ function captureEvent(server, eventInput) {
         sdkVersion: sessionInfo.sdkVersion,
         serverName: sessionInfo.serverName,
         serverVersion: sessionInfo.serverVersion,
-        clientName: sessionInfo.clientName,
-        clientVersion: sessionInfo.clientVersion,
+        clientName: eventInput.clientName ?? sessionInfo.clientName,
+        clientVersion: eventInput.clientVersion ?? sessionInfo.clientVersion,
         identifyActorGivenId: sessionInfo.identifyActorGivenId,
         identifyActorData: sessionInfo.identifyActorData,
         groups: sessionInfo.identifyActorGroups,

package/dist/extensions/client-identity.d.ts

@@ -0,0 +1,39 @@
+import type { McpEvent, MCPRequestLike } from '../types';
+/**
+ * Client identity under the MCP 2026-07-28 (stateless) revision.
+ *
+ * That revision removes the `initialize` handshake and the `Mcp-Session-Id`
+ * header (SEP-2575 / SEP-2567). Client name/version and the protocol version no
+ * longer arrive once at `initialize` — they travel in every request's
+ * `params._meta` under these reverse-DNS keys. We mirror the literal key strings
+ * here rather than depend on the (still beta) v2 SDK, which is not a dependency
+ * of this package.
+ */
+export declare const META_CLIENT_INFO_KEY = "io.modelcontextprotocol/clientInfo";
+export declare const META_PROTOCOL_VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
+export interface MetaClientInfo {
+    clientName?: string;
+    clientVersion?: string;
+    protocolVersion?: string;
+}
+/**
+ * Reads the client name/version and protocol version a modern client puts in
+ * `params._meta`. Returns `undefined` when the request carries none (e.g. a
+ * legacy client, which sends this on `initialize` instead). Never throws.
+ */
+export declare function readMetaClientInfo(request: MCPRequestLike): MetaClientInfo | undefined;
+/**
+ * Stamps any client identity found in `params._meta` directly onto the event
+ * being built for *this* request, so it carries `$mcp_client_name`,
+ * `$mcp_client_version`, and `$mcp_protocol_version` even when there was no
+ * `initialize` to learn them from (the modern stateless case).
+ *
+ * Writing to the event — a per-request object — rather than the server-wide
+ * `sessionInfo` keeps identity correct when one instrumented server multiplexes
+ * concurrent requests from different clients (which the stateless spec allows):
+ * a sibling request can't clobber this event's attribution between now and when
+ * it's captured. Only fields the request actually carries are set, so a request
+ * without `_meta` leaves the event's existing values untouched.
+ */
+export declare function stampMetaClientInfo(event: McpEvent, request: MCPRequestLike): void;
+//# sourceMappingURL=client-identity.d.ts.map

package/dist/extensions/client-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-identity.d.ts","sourceRoot":"","sources":["../../src/extensions/client-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,UAAU,CAAA;AAExD;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,uCAAuC,CAAA;AACxE,eAAO,MAAM,yBAAyB,4CAA4C,CAAA;AAElF,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAyBtF;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,cAAc,GAAG,IAAI,CAclF"}

package/dist/extensions/client-identity.js

@@ -0,0 +1,68 @@
+"use strict";
+var __webpack_require__ = {};
+(()=>{
+    __webpack_require__.d = (exports1, definition)=>{
+        for(var key in definition)if (__webpack_require__.o(definition, key) && !__webpack_require__.o(exports1, key)) Object.defineProperty(exports1, key, {
+            enumerable: true,
+            get: definition[key]
+        });
+    };
+})();
+(()=>{
+    __webpack_require__.o = (obj, prop)=>Object.prototype.hasOwnProperty.call(obj, prop);
+})();
+(()=>{
+    __webpack_require__.r = (exports1)=>{
+        if ('undefined' != typeof Symbol && Symbol.toStringTag) Object.defineProperty(exports1, Symbol.toStringTag, {
+            value: 'Module'
+        });
+        Object.defineProperty(exports1, '__esModule', {
+            value: true
+        });
+    };
+})();
+var __webpack_exports__ = {};
+__webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    META_CLIENT_INFO_KEY: ()=>META_CLIENT_INFO_KEY,
+    META_PROTOCOL_VERSION_KEY: ()=>META_PROTOCOL_VERSION_KEY,
+    readMetaClientInfo: ()=>readMetaClientInfo,
+    stampMetaClientInfo: ()=>stampMetaClientInfo
+});
+const META_CLIENT_INFO_KEY = 'io.modelcontextprotocol/clientInfo';
+const META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+function readMetaClientInfo(request) {
+    const meta = request.params?._meta;
+    if (!meta || 'object' != typeof meta) return;
+    const record = meta;
+    const result = {};
+    const clientInfo = record[META_CLIENT_INFO_KEY];
+    if (clientInfo && 'object' == typeof clientInfo) {
+        const { name, version } = clientInfo;
+        if ('string' == typeof name && name.length > 0) result.clientName = name;
+        if ('string' == typeof version && version.length > 0) result.clientVersion = version;
+    }
+    const protocolVersion = record[META_PROTOCOL_VERSION_KEY];
+    if ('string' == typeof protocolVersion && protocolVersion.length > 0) result.protocolVersion = protocolVersion;
+    return result.clientName || result.clientVersion || result.protocolVersion ? result : void 0;
+}
+function stampMetaClientInfo(event, request) {
+    const info = readMetaClientInfo(request);
+    if (!info) return;
+    if (info.clientName) event.clientName = info.clientName;
+    if (info.clientVersion) event.clientVersion = info.clientVersion;
+    if (info.protocolVersion) event.protocolVersion = info.protocolVersion;
+}
+exports.META_CLIENT_INFO_KEY = __webpack_exports__.META_CLIENT_INFO_KEY;
+exports.META_PROTOCOL_VERSION_KEY = __webpack_exports__.META_PROTOCOL_VERSION_KEY;
+exports.readMetaClientInfo = __webpack_exports__.readMetaClientInfo;
+exports.stampMetaClientInfo = __webpack_exports__.stampMetaClientInfo;
+for(var __webpack_i__ in __webpack_exports__)if (-1 === [
+    "META_CLIENT_INFO_KEY",
+    "META_PROTOCOL_VERSION_KEY",
+    "readMetaClientInfo",
+    "stampMetaClientInfo"
+].indexOf(__webpack_i__)) exports[__webpack_i__] = __webpack_exports__[__webpack_i__];
+Object.defineProperty(exports, '__esModule', {
+    value: true
+});

package/dist/extensions/client-identity.mjs

@@ -0,0 +1,25 @@
+const META_CLIENT_INFO_KEY = 'io.modelcontextprotocol/clientInfo';
+const META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+function readMetaClientInfo(request) {
+    const meta = request.params?._meta;
+    if (!meta || 'object' != typeof meta) return;
+    const record = meta;
+    const result = {};
+    const clientInfo = record[META_CLIENT_INFO_KEY];
+    if (clientInfo && 'object' == typeof clientInfo) {
+        const { name, version } = clientInfo;
+        if ('string' == typeof name && name.length > 0) result.clientName = name;
+        if ('string' == typeof version && version.length > 0) result.clientVersion = version;
+    }
+    const protocolVersion = record[META_PROTOCOL_VERSION_KEY];
+    if ('string' == typeof protocolVersion && protocolVersion.length > 0) result.protocolVersion = protocolVersion;
+    return result.clientName || result.clientVersion || result.protocolVersion ? result : void 0;
+}
+function stampMetaClientInfo(event, request) {
+    const info = readMetaClientInfo(request);
+    if (!info) return;
+    if (info.clientName) event.clientName = info.clientName;
+    if (info.clientVersion) event.clientVersion = info.clientVersion;
+    if (info.protocolVersion) event.protocolVersion = info.protocolVersion;
+}
+export { META_CLIENT_INFO_KEY, META_PROTOCOL_VERSION_KEY, readMetaClientInfo, stampMetaClientInfo };

package/dist/extensions/instrumentation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/extensions/instrumentation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,KAAK,EACV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,aAAa,EAGd,MAAM,UAAU,CAAA;AAWjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAYrD;;;;;;GAMG;AAEH,KAAK,iBAAiB,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,6BAA6B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAE7G;;;;GAIG;AACH,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAE3E,UAAU,mBAAmB;IAC3B,MAAM,EAAE,aAAa,CAAA;IACrB,IAAI,EAAE,gBAAgB,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,CAAC,EAAE,6BAA6B,CAAA;IACrC,OAAO,EAAE,YAAY,CAAA;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuCnF;AAgHD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,MAAM,EAAE,aAAa,EACrB,eAAe,EAAE,iBAAiB,EAClC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,6BAA6B,GAAG,SAAS,KAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI,CAqBvG;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,aAAa,EACrB,wBAAwB,EAAE,iBAAiB,EAC3C,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC;IAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAwC9C;AAwDD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CASnH;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CAUjH;AA8GD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,aAAa,EACrB,yBAAyB,EAAE,iBAAiB,EAC5C,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CAsClB"}
+{"version":3,"file":"instrumentation.d.ts","sourceRoot":"","sources":["../../src/extensions/instrumentation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,KAAK,EACV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,aAAa,EAGd,MAAM,UAAU,CAAA;AAYjB,OAAO,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAYrD;;;;;;GAMG;AAEH,KAAK,iBAAiB,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,CAAC,EAAE,6BAA6B,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAE7G;;;;GAIG;AACH,KAAK,YAAY,GAAG,CAAC,iBAAiB,EAAE,cAAc,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAE3E,UAAU,mBAAmB;IAC3B,MAAM,EAAE,aAAa,CAAA;IACrB,IAAI,EAAE,gBAAgB,CAAA;IACtB,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,CAAC,EAAE,6BAA6B,CAAA;IACrC,OAAO,EAAE,YAAY,CAAA;IACrB;;;;OAIG;IACH,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuCnF;AAoHD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,CACzB,MAAM,EAAE,aAAa,EACrB,eAAe,EAAE,iBAAiB,EAClC,OAAO,EAAE,cAAc,EACvB,KAAK,EAAE,6BAA6B,GAAG,SAAS,KAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;AAErB;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,IAAI,CAqBvG;AAED;;;GAGG;AACH,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,aAAa,EACrB,wBAAwB,EAAE,iBAAiB,EAC3C,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC;IAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,CAAA;CAAE,CAAC,CAyC9C;AAwDD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CASnH;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAGtE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,SAAS,GAAG,IAAI,CAUjH;AA8GD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,aAAa,EACrB,yBAAyB,EAAE,iBAAiB,EAC5C,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,OAAO,CAAC,CA0ClB"}

package/dist/extensions/instrumentation.js

@@ -34,6 +34,7 @@ __webpack_require__.d(__webpack_exports__, {
 });
 const external_context_parameters_js_namespaceObject = require("./context-parameters.js");
 const external_conversation_id_js_namespaceObject = require("./conversation-id.js");
+const external_client_identity_js_namespaceObject = require("./client-identity.js");
 const external_capture_js_namespaceObject = require("./capture.js");
 const external_event_types_js_namespaceObject = require("./event-types.js");
 const external_exceptions_js_namespaceObject = require("./exceptions.js");
@@ -79,6 +80,7 @@ async function prepareToolCallEvent(server, data, request, downstreamRequest, ex
             toolCategory: toolName ? data.toolCategories.get(toolName) : void 0,
             toolDescription: toolName ? data.toolDescriptions.get(toolName) : void 0
         };
+        (0, external_client_identity_js_namespaceObject.stampMetaClientInfo)(event, request);
         await (0, external_tracing_helpers_js_namespaceObject.applyResolvedMetadata)(event, data, request, extra);
         (0, external_intent_js_namespaceObject.setEventIntent)(event, await (0, external_intent_js_namespaceObject.resolveToolCallIntent)(data, request, extra));
         return event;
@@ -143,6 +145,7 @@ async function handleListToolsRequest(server, originalListToolsHandler, request,
         eventType: external_event_types_js_namespaceObject.MCPAnalyticsEventType.mcpToolsList,
         timestamp: startTime
     };
+    (0, external_client_identity_js_namespaceObject.stampMetaClientInfo)(event, request);
     if (data) await (0, external_tracing_helpers_js_namespaceObject.applyResolvedMetadata)(event, data, request, extra);
     const tools = await getTracedToolsList(server, originalListToolsHandler, request, extra, event);
     if (!data) {
@@ -288,6 +291,7 @@ async function handleInitializeRequest(server, originalInitializeHandler, reques
         parameters: (0, external_mcp_payloads_js_namespaceObject.buildCapturedMcpParameters)(request),
         timestamp: new Date()
     };
+    (0, external_client_identity_js_namespaceObject.stampMetaClientInfo)(event, request);
     await (0, external_tracing_helpers_js_namespaceObject.applyResolvedMetadata)(event, data, request, extra);
     const result = await originalInitializeHandler(request, extra);
     event.response = result;

package/dist/extensions/instrumentation.mjs

@@ -1,5 +1,6 @@
 import { addContextParameterToTools, getContextDescription, isContextEnabled } from "./context-parameters.mjs";
 import { addConversationIdToTools, canInjectConversationIdPromptBack, cloneRequestWithoutConversationId, injectConversationIdPromptBack, resolveConversationId } from "./conversation-id.mjs";
+import { stampMetaClientInfo } from "./client-identity.mjs";
 import { captureEvent } from "./capture.mjs";
 import { MCPAnalyticsEventType } from "./event-types.mjs";
 import { captureException } from "./exceptions.mjs";
@@ -45,6 +46,7 @@ async function prepareToolCallEvent(server, data, request, downstreamRequest, ex
             toolCategory: toolName ? data.toolCategories.get(toolName) : void 0,
             toolDescription: toolName ? data.toolDescriptions.get(toolName) : void 0
         };
+        stampMetaClientInfo(event, request);
         await applyResolvedMetadata(event, data, request, extra);
         setEventIntent(event, await resolveToolCallIntent(data, request, extra));
         return event;
@@ -109,6 +111,7 @@ async function handleListToolsRequest(server, originalListToolsHandler, request,
         eventType: MCPAnalyticsEventType.mcpToolsList,
         timestamp: startTime
     };
+    stampMetaClientInfo(event, request);
     if (data) await applyResolvedMetadata(event, data, request, extra);
     const tools = await getTracedToolsList(server, originalListToolsHandler, request, extra, event);
     if (!data) {
@@ -254,6 +257,7 @@ async function handleInitializeRequest(server, originalInitializeHandler, reques
         parameters: buildCapturedMcpParameters(request),
         timestamp: new Date()
     };
+    stampMetaClientInfo(event, request);
     await applyResolvedMetadata(event, data, request, extra);
     const result = await originalInitializeHandler(request, extra);
     event.response = result;

package/dist/extensions/internal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/extensions/internal.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,aAAa,EAEb,YAAY,EACb,MAAM,UAAU,CAAA;AAKjB;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,OAAO,SAAO;IAI1B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAWhD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAapD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI/B,IAAI,IAAI,MAAM;CAGf;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAEzF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CA4B5E;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,GAAG,YAAY,CAapG;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CA+Cf;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC"}
+{"version":3,"file":"internal.d.ts","sourceRoot":"","sources":["../../src/extensions/internal.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,6BAA6B,EAC7B,gBAAgB,EAChB,cAAc,EACd,aAAa,EAEb,YAAY,EACb,MAAM,UAAU,CAAA;AAMjB;;;;;GAKG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkC;IACzD,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAQ;gBAErB,OAAO,SAAO;IAI1B,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS;IAWhD,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,IAAI;IAapD,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO;IAI/B,IAAI,IAAI,MAAM;CAGf;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,GAAG,gBAAgB,GAAG,SAAS,CAEzF;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAEzF;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,YAAY,GAAG,OAAO,CA4B5E;AAED,wBAAgB,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,SAAS,EAAE,IAAI,EAAE,YAAY,GAAG,YAAY,CAapG;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,gBAAgB,EACtB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,IAAI,CAAC,CAgDf;AAED;;;;GAIG;AACH,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC"}

package/dist/extensions/internal.js

@@ -35,6 +35,7 @@ __webpack_require__.d(__webpack_exports__, {
 const external_event_types_js_namespaceObject = require("./event-types.js");
 const external_logger_js_namespaceObject = require("./logger.js");
 const external_capture_js_namespaceObject = require("./capture.js");
+const external_client_identity_js_namespaceObject = require("./client-identity.js");
 class IdentityCache {
     constructor(maxSize = 1000){
         this._cache = new Map();
@@ -106,6 +107,7 @@ async function handleIdentify(server, data, sessionId, request, extra) {
         },
         timestamp: new Date()
     };
+    (0, external_client_identity_js_namespaceObject.stampMetaClientInfo)(identifyEvent, request);
     try {
         const identityResult = 'function' == typeof data.options.identify ? await data.options.identify(request, extra) : data.options.identify;
         if (identityResult) {

package/dist/extensions/internal.mjs

@@ -1,6 +1,7 @@
 import { MCPAnalyticsEventType } from "./event-types.mjs";
 import { log } from "./logger.mjs";
 import { captureEvent } from "./capture.mjs";
+import { stampMetaClientInfo } from "./client-identity.mjs";
 class IdentityCache {
     constructor(maxSize = 1000){
         this._cache = new Map();
@@ -72,6 +73,7 @@ async function handleIdentify(server, data, sessionId, request, extra) {
         },
         timestamp: new Date()
     };
+    stampMetaClientInfo(identifyEvent, request);
     try {
         const identityResult = 'function' == typeof data.options.identify ? await data.options.identify(request, extra) : data.options.identify;
         if (identityResult) {

package/dist/extensions/mcp-payloads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AAaA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAiBzC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA0B7D;AA6BD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}
+{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AAkBA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAsCzC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA0B7D;AA6BD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}

package/dist/extensions/mcp-payloads.js

@@ -29,7 +29,12 @@ __webpack_require__.d(__webpack_exports__, {
 });
 const CONTEXT_ARGUMENT_NAME = 'context';
 const REDACTED_VALUE = '[redacted]';
+const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]';
 const BASE64_PATTERN = /^[A-Za-z0-9+/\n\r]+=*$/;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+={0,2}$/;
+const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/;
+const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i;
+const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
@@ -39,8 +44,19 @@ function isRecord(value) {
 function shouldRedactKey(key) {
     return SENSITIVE_KEY_PATTERN.test(key);
 }
+function isBase64DataUrl(value) {
+    const prefix = BASE64_DATA_URL_PREFIX_PATTERN.exec(value);
+    if (!prefix) return false;
+    let payload;
+    try {
+        payload = decodeURIComponent(value.slice(prefix[0].length));
+    } catch  {
+        return false;
+    }
+    return BASE64_DATA_URL_PAYLOAD_PATTERN.test(payload.replace(/[\r\n]/g, ''));
+}
 function sanitizeString(value) {
-    if (value.length >= SIZE_GATE && BASE64_PATTERN.test(value)) return '[binary data redacted - not supported by PostHog MCP analytics]';
+    if (value.length >= SIZE_GATE && (BASE64_PATTERN.test(value) || isBase64DataUrl(value) || BASE64URL_SPECIFIC_CHAR_PATTERN.test(value) && BASE64URL_PATTERN.test(value))) return BINARY_REDACTED_VALUE;
     return value.replace(POSTHOG_TOKEN_PATTERN, REDACTED_VALUE);
 }
 function sanitizeCapturedValue(value) {

package/dist/extensions/mcp-payloads.mjs

@@ -1,6 +1,11 @@
 const CONTEXT_ARGUMENT_NAME = 'context';
 const REDACTED_VALUE = '[redacted]';
+const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]';
 const BASE64_PATTERN = /^[A-Za-z0-9+/\n\r]+=*$/;
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+={0,2}$/;
+const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/;
+const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i;
+const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
@@ -10,8 +15,19 @@ function isRecord(value) {
 function shouldRedactKey(key) {
     return SENSITIVE_KEY_PATTERN.test(key);
 }
+function isBase64DataUrl(value) {
+    const prefix = BASE64_DATA_URL_PREFIX_PATTERN.exec(value);
+    if (!prefix) return false;
+    let payload;
+    try {
+        payload = decodeURIComponent(value.slice(prefix[0].length));
+    } catch  {
+        return false;
+    }
+    return BASE64_DATA_URL_PAYLOAD_PATTERN.test(payload.replace(/[\r\n]/g, ''));
+}
 function sanitizeString(value) {
-    if (value.length >= SIZE_GATE && BASE64_PATTERN.test(value)) return '[binary data redacted - not supported by PostHog MCP analytics]';
+    if (value.length >= SIZE_GATE && (BASE64_PATTERN.test(value) || isBase64DataUrl(value) || BASE64URL_SPECIFIC_CHAR_PATTERN.test(value) && BASE64URL_PATTERN.test(value))) return BINARY_REDACTED_VALUE;
     return value.replace(POSTHOG_TOKEN_PATTERN, REDACTED_VALUE);
 }
 function sanitizeCapturedValue(value) {

package/dist/extensions/sanitization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitization.d.ts","sourceRoot":"","sources":["../../src/extensions/sanitization.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAS/C;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAmBrE"}
+{"version":3,"file":"sanitization.d.ts","sourceRoot":"","sources":["../../src/extensions/sanitization.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAShE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAuBrE"}

package/dist/extensions/sanitization.js

@@ -37,8 +37,19 @@ function sanitizeEvent(event) {
     if (null != result.response) result.response = sanitizeResponse(result.response);
     if (null != result.parameters) result.parameters = sanitizeParameters(result.parameters);
     if (null != result.userIntent) result.userIntent = (0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(result.userIntent);
+    if (null != result.error) result.error = sanitizeExceptionValues(result.error);
     return result;
 }
+function sanitizeExceptionValues(error) {
+    if (!Array.isArray(error.$exception_list)) return error;
+    return {
+        ...error,
+        $exception_list: error.$exception_list.map((exception)=>({
+                ...exception,
+                value: (0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(exception.value)
+            }))
+    };
+}
 function sanitizeResponse(response) {
     if (null == response || 'object' != typeof response) return (0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(response);
     const sanitized = (0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(response);

package/dist/extensions/sanitization.mjs

@@ -9,8 +9,19 @@ function sanitizeEvent(event) {
     if (null != result.response) result.response = sanitizeResponse(result.response);
     if (null != result.parameters) result.parameters = sanitizeParameters(result.parameters);
     if (null != result.userIntent) result.userIntent = sanitizeCapturedValue(result.userIntent);
+    if (null != result.error) result.error = sanitizeExceptionValues(result.error);
     return result;
 }
+function sanitizeExceptionValues(error) {
+    if (!Array.isArray(error.$exception_list)) return error;
+    return {
+        ...error,
+        $exception_list: error.$exception_list.map((exception)=>({
+                ...exception,
+                value: sanitizeCapturedValue(exception.value)
+            }))
+    };
+}
 function sanitizeResponse(response) {
     if (null == response || 'object' != typeof response) return sanitizeCapturedValue(response);
     const sanitized = sanitizeCapturedValue(response);

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.10.0";
+export declare const version = "0.10.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -26,7 +26,7 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
     version: ()=>version
 });
-const version = '0.10.0';
+const version = '0.10.2';
 exports.version = __webpack_exports__.version;
 for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "version"

package/dist/version.mjs

@@ -1,2 +1,2 @@
-const version = '0.10.0';
+const version = '0.10.2';
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/mcp",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -28,7 +28,7 @@
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@posthog/core": "^1.44.0"
+    "@posthog/core": "^1.46.1"
   },
   "devDependencies": {
     "@babel/preset-env": "^7.27.1",
@@ -39,7 +39,7 @@
     "@types/node": "^20.0.0",
     "jest": "29.7.0",
     "zod": "^3.25.0",
-    "posthog-node": "^5.46.0",
+    "posthog-node": "^5.47.2",
     "@posthog-tooling/tsconfig-base": "1.1.1"
   },
   "peerDependencies": {

package/src/extensions/capture.ts

@@ -48,8 +48,11 @@ export function captureEvent(server: MCPServerLike, eventInput: McpEvent): Promi
     sdkVersion: sessionInfo.sdkVersion,
     serverName: sessionInfo.serverName,
     serverVersion: sessionInfo.serverVersion,
-    clientName: sessionInfo.clientName,
-    clientVersion: sessionInfo.clientVersion,
+    // Prefer identity the event captured for *this* request (from `_meta`, see
+    // stampMetaClientInfo) over the server-wide sessionInfo, so a concurrent
+    // request from another client can't misattribute this one.
+    clientName: eventInput.clientName ?? sessionInfo.clientName,
+    clientVersion: eventInput.clientVersion ?? sessionInfo.clientVersion,
     identifyActorGivenId: sessionInfo.identifyActorGivenId,
     identifyActorData: sessionInfo.identifyActorData,
     groups: sessionInfo.identifyActorGroups,

package/src/extensions/client-identity.ts

@@ -0,0 +1,81 @@
+import type { McpEvent, MCPRequestLike } from '../types'
+
+/**
+ * Client identity under the MCP 2026-07-28 (stateless) revision.
+ *
+ * That revision removes the `initialize` handshake and the `Mcp-Session-Id`
+ * header (SEP-2575 / SEP-2567). Client name/version and the protocol version no
+ * longer arrive once at `initialize` — they travel in every request's
+ * `params._meta` under these reverse-DNS keys. We mirror the literal key strings
+ * here rather than depend on the (still beta) v2 SDK, which is not a dependency
+ * of this package.
+ */
+export const META_CLIENT_INFO_KEY = 'io.modelcontextprotocol/clientInfo'
+export const META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion'
+
+export interface MetaClientInfo {
+  clientName?: string
+  clientVersion?: string
+  protocolVersion?: string
+}
+
+/**
+ * Reads the client name/version and protocol version a modern client puts in
+ * `params._meta`. Returns `undefined` when the request carries none (e.g. a
+ * legacy client, which sends this on `initialize` instead). Never throws.
+ */
+export function readMetaClientInfo(request: MCPRequestLike): MetaClientInfo | undefined {
+  const meta = request.params?._meta
+  if (!meta || typeof meta !== 'object') {
+    return undefined
+  }
+  const record = meta as Record<string, unknown>
+  const result: MetaClientInfo = {}
+
+  const clientInfo = record[META_CLIENT_INFO_KEY]
+  if (clientInfo && typeof clientInfo === 'object') {
+    const { name, version } = clientInfo as Record<string, unknown>
+    if (typeof name === 'string' && name.length > 0) {
+      result.clientName = name
+    }
+    if (typeof version === 'string' && version.length > 0) {
+      result.clientVersion = version
+    }
+  }
+
+  const protocolVersion = record[META_PROTOCOL_VERSION_KEY]
+  if (typeof protocolVersion === 'string' && protocolVersion.length > 0) {
+    result.protocolVersion = protocolVersion
+  }
+
+  return result.clientName || result.clientVersion || result.protocolVersion ? result : undefined
+}
+
+/**
+ * Stamps any client identity found in `params._meta` directly onto the event
+ * being built for *this* request, so it carries `$mcp_client_name`,
+ * `$mcp_client_version`, and `$mcp_protocol_version` even when there was no
+ * `initialize` to learn them from (the modern stateless case).
+ *
+ * Writing to the event — a per-request object — rather than the server-wide
+ * `sessionInfo` keeps identity correct when one instrumented server multiplexes
+ * concurrent requests from different clients (which the stateless spec allows):
+ * a sibling request can't clobber this event's attribution between now and when
+ * it's captured. Only fields the request actually carries are set, so a request
+ * without `_meta` leaves the event's existing values untouched.
+ */
+export function stampMetaClientInfo(event: McpEvent, request: MCPRequestLike): void {
+  const info = readMetaClientInfo(request)
+  if (!info) {
+    return
+  }
+  if (info.clientName) {
+    event.clientName = info.clientName
+  }
+  if (info.clientVersion) {
+    event.clientVersion = info.clientVersion
+  }
+  if (info.protocolVersion) {
+    event.protocolVersion = info.protocolVersion
+  }
+}

package/src/extensions/instrumentation.ts

@@ -21,6 +21,7 @@ import {
   injectConversationIdPromptBack,
   resolveConversationId,
 } from './conversation-id'
+import { stampMetaClientInfo } from './client-identity'
 import { captureEvent } from './capture'
 import { MCPAnalyticsEventType } from './event-types'
 import { captureException } from './exceptions'
@@ -152,6 +153,10 @@ async function prepareToolCallEvent(
       toolCategory: toolName ? data.toolCategories.get(toolName) : undefined,
       toolDescription: toolName ? data.toolDescriptions.get(toolName) : undefined,
     }
+    // Modern (stateless) clients carry client name/version + protocol version in
+    // `_meta` on every request rather than at `initialize`; stamp them onto this
+    // event now so concurrent requests can't cross-attribute it.
+    stampMetaClientInfo(event, request)
 
     await applyResolvedMetadata(event, data, request, extra)
     setEventIntent(event, await resolveToolCallIntent(data, request, extra))
@@ -297,6 +302,7 @@ export async function handleListToolsRequest(
     eventType: MCPAnalyticsEventType.mcpToolsList,
     timestamp: startTime,
   }
+  stampMetaClientInfo(event, request)
 
   if (data) {
     await applyResolvedMetadata(event, data, request, extra)
@@ -555,6 +561,10 @@ export async function handleInitializeRequest(
     parameters: buildCapturedMcpParameters(request),
     timestamp: new Date(),
   }
+  // Harmless for a legacy `initialize` (client info rides the body there, and the
+  // negotiated protocol version below overrides any `_meta` one); picks up client
+  // info if a client also sends it in `_meta`.
+  stampMetaClientInfo(event, request)
 
   await applyResolvedMetadata(event, data, request, extra)
 

package/src/extensions/internal.ts

@@ -14,6 +14,7 @@ import type {
 import { MCPAnalyticsEventType } from './event-types'
 import { log } from './logger'
 import { captureEvent } from './capture'
+import { stampMetaClientInfo } from './client-identity'
 
 /**
  * Bounded LRU cache for session identities, capped at `maxSize` entries so a
@@ -141,6 +142,7 @@ export async function handleIdentify(
     parameters: { request, extra },
     timestamp: new Date(),
   }
+  stampMetaClientInfo(identifyEvent, request)
 
   try {
     const identityResult =

package/src/extensions/mcp-payloads.ts

@@ -5,7 +5,12 @@
 
 const CONTEXT_ARGUMENT_NAME = 'context'
 const REDACTED_VALUE = '[redacted]'
+const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]'
 const BASE64_PATTERN = /^[A-Za-z0-9+/\n\r]+=*$/
+const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+={0,2}$/
+const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/
+const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i
+const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/
 const SIZE_GATE = 10_240
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g
 const SENSITIVE_KEY_PATTERN =
@@ -21,9 +26,30 @@ function shouldRedactKey(key: string): boolean {
   return SENSITIVE_KEY_PATTERN.test(key)
 }
 
+function isBase64DataUrl(value: string): boolean {
+  const prefix = BASE64_DATA_URL_PREFIX_PATTERN.exec(value)
+  if (!prefix) {
+    return false
+  }
+
+  let payload: string
+  try {
+    payload = decodeURIComponent(value.slice(prefix[0].length))
+  } catch {
+    return false
+  }
+
+  return BASE64_DATA_URL_PAYLOAD_PATTERN.test(payload.replace(/[\r\n]/g, ''))
+}
+
 function sanitizeString(value: string): string {
-  if (value.length >= SIZE_GATE && BASE64_PATTERN.test(value)) {
-    return '[binary data redacted - not supported by PostHog MCP analytics]'
+  if (
+    value.length >= SIZE_GATE &&
+    (BASE64_PATTERN.test(value) ||
+      isBase64DataUrl(value) ||
+      (BASE64URL_SPECIFIC_CHAR_PATTERN.test(value) && BASE64URL_PATTERN.test(value)))
+  ) {
+    return BINARY_REDACTED_VALUE
   }
   return value.replace(POSTHOG_TOKEN_PATTERN, REDACTED_VALUE)
 }

package/src/extensions/sanitization.ts

@@ -3,7 +3,7 @@
 // Copyright (c) 2025 AgentCat, Inc. (formerly MCPcat)
 // Licensed under the MIT License: https://github.com/agentcathq/agentcat-typescript-sdk/blob/main/LICENSE
 
-import type { Event, McpEvent } from '../types'
+import type { ErrorProperties, Event, McpEvent } from '../types'
 import { sanitizeCapturedValue } from './mcp-payloads'
 
 type SanitizedRecord = Record<string, unknown>
@@ -39,9 +39,31 @@ export function sanitizeEvent<T extends Event | McpEvent>(event: T): T {
     result.userIntent = sanitizeCapturedValue(result.userIntent) as string
   }
 
+  if (result.error != null) {
+    result.error = sanitizeExceptionValues(result.error)
+  }
+
   return result
 }
 
+/**
+ * Sanitizes exception messages before they fan out to both the primary MCP
+ * event's error-message property and the `$exception` sibling.
+ */
+function sanitizeExceptionValues(error: ErrorProperties): ErrorProperties {
+  if (!Array.isArray(error.$exception_list)) {
+    return error
+  }
+
+  return {
+    ...error,
+    $exception_list: error.$exception_list.map((exception) => ({
+      ...exception,
+      value: sanitizeCapturedValue(exception.value) as string,
+    })),
+  }
+}
+
 /**
  * Sanitizes response content blocks by replacing non-text content types
  * with informative redaction messages.

package/src/version.ts

@@ -1 +1 @@
-export const version = '0.10.0'
+export const version = '0.10.2'