@posthog/mcp 0.11.2 → 0.11.3

package/dist/extensions/client-identity.d.ts

@@ -11,7 +11,11 @@ import type { CompatibleRequestHandlerExtra, McpEvent, MCPRequestLike, MCPServer
  *      the time a handler runs they are here and `params._meta` is empty.
  *   2. `request.params._meta` — where 2026-07-28 puts them on the wire, and
  *      where they still are on any server that does not lift them.
- *   3. the server's own accessors — `getClientVersion()` from a legacy
+ *   3. the `MCP-Protocol-Version` request header, which 2025-11-25 requires a
+ *      client to send on every request after `initialize` — the only per-request
+ *      carrier a legacy-era request has, and therefore the only one that
+ *      survives a per-request server instance.
+ *   4. the server's own accessors — `getClientVersion()` from a legacy
  *      `initialize` handshake, `getNegotiatedProtocolVersion()` on v2.
  *
  * The 2026-07-28 revision removed the `initialize` handshake and the
@@ -22,6 +26,8 @@ import type { CompatibleRequestHandlerExtra, McpEvent, MCPRequestLike, MCPServer
  */
 export declare const META_CLIENT_INFO_KEY = "io.modelcontextprotocol/clientInfo";
 export declare const META_PROTOCOL_VERSION_KEY = "io.modelcontextprotocol/protocolVersion";
+/** Required on every post-`initialize` request by 2025-11-25 (and sent by modern clients too). */
+export declare const PROTOCOL_VERSION_HEADER = "mcp-protocol-version";
 export interface MetaClientInfo {
     clientName?: string;
     clientVersion?: string;
@@ -52,6 +58,16 @@ export declare function readMetaClientInfo(request: MCPRequestLike): MetaClientI
  * everything.
  */
 export declare function readEnvelopeClientInfo(extra: CompatibleRequestHandlerExtra | undefined): MetaClientInfo | undefined;
+/**
+ * Reads the protocol version off the request headers.
+ *
+ * This is what closes the gap on **2025-11-25 traffic served by a per-request
+ * server**: that era carries identity at the handshake, and the instance
+ * handling a later `tools/call` never saw it. The header rides every request, so
+ * it survives where the handshake does not. Carries no client name — that still
+ * depends on the replayed session token.
+ */
+export declare function readHeaderProtocolVersion(extra: CompatibleRequestHandlerExtra | undefined): MetaClientInfo | undefined;
 /**
  * Asks the server itself. `getClientVersion()` answers on any server that
  * handled an `initialize` (and v2 hosts such as `createMcpHandler` backfill it

package/dist/extensions/client-identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client-identity.d.ts","sourceRoot":"","sources":["../../src/extensions/client-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAGtG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,oBAAoB,uCAAuC,CAAA;AACxE,eAAO,MAAM,yBAAyB,4CAA4C,CAAA;AAElF,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,CAAC,EAAE,6BAA6B,CAAA;IACrC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAuCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAEnH;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAsBpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,CAYnH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,EACrC,MAAM,CAAC,EAAE,aAAa,GACrB,IAAI,CAcN"}
+{"version":3,"file":"client-identity.d.ts","sourceRoot":"","sources":["../../src/extensions/client-identity.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,6BAA6B,EAAE,QAAQ,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AAKtG;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,oBAAoB,uCAAuC,CAAA;AACxE,eAAO,MAAM,yBAAyB,4CAA4C,CAAA;AAClF,kGAAkG;AAClG,eAAO,MAAM,uBAAuB,yBAAyB,CAAA;AAI7D,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,8DAA8D;AAC9D,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,cAAc,CAAA;IACvB,KAAK,CAAC,EAAE,6BAA6B,CAAA;IACrC;;;;;OAKG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAuCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,GAAG,SAAS,CAEtF;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAAG,cAAc,GAAG,SAAS,CAEnH;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,6BAA6B,GAAG,SAAS,GAC/C,cAAc,GAAG,SAAS,CAS5B;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAsBpF;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,qBAAqB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,qBAAqB,GAAG,cAAc,GAAG,SAAS,CAiBnH;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,QAAQ,EACf,OAAO,EAAE,cAAc,EACvB,KAAK,CAAC,EAAE,6BAA6B,EACrC,MAAM,CAAC,EAAE,aAAa,GACrB,IAAI,CAcN"}

package/dist/extensions/client-identity.js

@@ -24,17 +24,23 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
-    resolveClientIdentity: ()=>resolveClientIdentity,
     readMetaClientInfo: ()=>readMetaClientInfo,
-    readServerClientIdentity: ()=>readServerClientIdentity,
-    readEnvelopeClientInfo: ()=>readEnvelopeClientInfo,
+    readHeaderProtocolVersion: ()=>readHeaderProtocolVersion,
     META_PROTOCOL_VERSION_KEY: ()=>META_PROTOCOL_VERSION_KEY,
+    PROTOCOL_VERSION_HEADER: ()=>PROTOCOL_VERSION_HEADER,
     stampClientIdentity: ()=>stampClientIdentity,
+    resolveClientIdentity: ()=>resolveClientIdentity,
+    readServerClientIdentity: ()=>readServerClientIdentity,
+    readEnvelopeClientInfo: ()=>readEnvelopeClientInfo,
     META_CLIENT_INFO_KEY: ()=>META_CLIENT_INFO_KEY
 });
 const external_detect_js_namespaceObject = require("./detect.js");
+const external_headers_js_namespaceObject = require("./headers.js");
+const external_request_headers_js_namespaceObject = require("./request-headers.js");
 const META_CLIENT_INFO_KEY = 'io.modelcontextprotocol/clientInfo';
 const META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+const PROTOCOL_VERSION_HEADER = 'mcp-protocol-version';
+const MAX_PROTOCOL_VERSION_LENGTH = 64;
 function nonEmptyString(value) {
     return 'string' == typeof value && value.length > 0 ? value : void 0;
 }
@@ -64,6 +70,13 @@ function readMetaClientInfo(request) {
 function readEnvelopeClientInfo(extra) {
     return readReservedKeys(extra?.mcpReq?.envelope);
 }
+function readHeaderProtocolVersion(extra) {
+    const protocolVersion = (0, external_headers_js_namespaceObject.readHeaderValue)((0, external_request_headers_js_namespaceObject.getRequestHeaders)(extra), PROTOCOL_VERSION_HEADER);
+    if (!protocolVersion || protocolVersion.length > MAX_PROTOCOL_VERSION_LENGTH) return;
+    return {
+        protocolVersion
+    };
+}
 function readServerClientIdentity(server) {
     if (!server) return;
     const result = {};
@@ -81,6 +94,7 @@ function resolveClientIdentity({ request, extra, server }) {
     const chain = [
         readEnvelopeClientInfo(extra),
         readMetaClientInfo(request),
+        readHeaderProtocolVersion(extra),
         readServerClientIdentity(server)
     ];
     const result = {};
@@ -104,7 +118,9 @@ function stampClientIdentity(event, request, extra, server) {
 }
 exports.META_CLIENT_INFO_KEY = __webpack_exports__.META_CLIENT_INFO_KEY;
 exports.META_PROTOCOL_VERSION_KEY = __webpack_exports__.META_PROTOCOL_VERSION_KEY;
+exports.PROTOCOL_VERSION_HEADER = __webpack_exports__.PROTOCOL_VERSION_HEADER;
 exports.readEnvelopeClientInfo = __webpack_exports__.readEnvelopeClientInfo;
+exports.readHeaderProtocolVersion = __webpack_exports__.readHeaderProtocolVersion;
 exports.readMetaClientInfo = __webpack_exports__.readMetaClientInfo;
 exports.readServerClientIdentity = __webpack_exports__.readServerClientIdentity;
 exports.resolveClientIdentity = __webpack_exports__.resolveClientIdentity;
@@ -112,7 +128,9 @@ exports.stampClientIdentity = __webpack_exports__.stampClientIdentity;
 for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "META_CLIENT_INFO_KEY",
     "META_PROTOCOL_VERSION_KEY",
+    "PROTOCOL_VERSION_HEADER",
     "readEnvelopeClientInfo",
+    "readHeaderProtocolVersion",
     "readMetaClientInfo",
     "readServerClientIdentity",
     "resolveClientIdentity",

package/dist/extensions/client-identity.mjs

@@ -1,6 +1,10 @@
 import { hasClientVersionAccessor, hasNegotiatedProtocolVersionAccessor } from "./detect.mjs";
+import { readHeaderValue } from "./headers.mjs";
+import { getRequestHeaders } from "./request-headers.mjs";
 const META_CLIENT_INFO_KEY = 'io.modelcontextprotocol/clientInfo';
 const META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion';
+const PROTOCOL_VERSION_HEADER = 'mcp-protocol-version';
+const MAX_PROTOCOL_VERSION_LENGTH = 64;
 function nonEmptyString(value) {
     return 'string' == typeof value && value.length > 0 ? value : void 0;
 }
@@ -30,6 +34,13 @@ function readMetaClientInfo(request) {
 function readEnvelopeClientInfo(extra) {
     return readReservedKeys(extra?.mcpReq?.envelope);
 }
+function readHeaderProtocolVersion(extra) {
+    const protocolVersion = readHeaderValue(getRequestHeaders(extra), PROTOCOL_VERSION_HEADER);
+    if (!protocolVersion || protocolVersion.length > MAX_PROTOCOL_VERSION_LENGTH) return;
+    return {
+        protocolVersion
+    };
+}
 function readServerClientIdentity(server) {
     if (!server) return;
     const result = {};
@@ -47,6 +58,7 @@ function resolveClientIdentity({ request, extra, server }) {
     const chain = [
         readEnvelopeClientInfo(extra),
         readMetaClientInfo(request),
+        readHeaderProtocolVersion(extra),
         readServerClientIdentity(server)
     ];
     const result = {};
@@ -68,4 +80,4 @@ function stampClientIdentity(event, request, extra, server) {
     if (info.clientVersion) event.clientVersion = info.clientVersion;
     if (info.protocolVersion) event.protocolVersion = info.protocolVersion;
 }
-export { META_CLIENT_INFO_KEY, META_PROTOCOL_VERSION_KEY, readEnvelopeClientInfo, readMetaClientInfo, readServerClientIdentity, resolveClientIdentity, stampClientIdentity };
+export { META_CLIENT_INFO_KEY, META_PROTOCOL_VERSION_KEY, PROTOCOL_VERSION_HEADER, readEnvelopeClientInfo, readHeaderProtocolVersion, readMetaClientInfo, readServerClientIdentity, resolveClientIdentity, stampClientIdentity };

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.11.2";
+export declare const version = "0.11.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -26,7 +26,7 @@ __webpack_require__.r(__webpack_exports__);
 __webpack_require__.d(__webpack_exports__, {
     version: ()=>version
 });
-const version = '0.11.2';
+const version = '0.11.3';
 exports.version = __webpack_exports__.version;
 for(var __webpack_i__ in __webpack_exports__)if (-1 === [
     "version"

package/dist/version.mjs

@@ -1,2 +1,2 @@
-const version = '0.11.2';
+const version = '0.11.3';
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/mcp",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -40,8 +40,8 @@
     "@types/node": "^20.0.0",
     "jest": "29.7.0",
     "zod": "^3.25.0",
-    "posthog-node": "^5.48.1",
-    "@posthog-tooling/tsconfig-base": "1.1.1"
+    "@posthog-tooling/tsconfig-base": "1.1.1",
+    "posthog-node": "^5.48.1"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": ">=1.26.0",

package/src/extensions/client-identity.ts

@@ -1,5 +1,7 @@
 import type { CompatibleRequestHandlerExtra, McpEvent, MCPRequestLike, MCPServerLike } from '../types'
 import { hasClientVersionAccessor, hasNegotiatedProtocolVersionAccessor } from './detect'
+import { readHeaderValue } from './headers'
+import { getRequestHeaders } from './request-headers'
 
 /**
  * Client identity — who is calling, and which spec revision they speak.
@@ -13,7 +15,11 @@ import { hasClientVersionAccessor, hasNegotiatedProtocolVersionAccessor } from '
  *      the time a handler runs they are here and `params._meta` is empty.
  *   2. `request.params._meta` — where 2026-07-28 puts them on the wire, and
  *      where they still are on any server that does not lift them.
- *   3. the server's own accessors — `getClientVersion()` from a legacy
+ *   3. the `MCP-Protocol-Version` request header, which 2025-11-25 requires a
+ *      client to send on every request after `initialize` — the only per-request
+ *      carrier a legacy-era request has, and therefore the only one that
+ *      survives a per-request server instance.
+ *   4. the server's own accessors — `getClientVersion()` from a legacy
  *      `initialize` handshake, `getNegotiatedProtocolVersion()` on v2.
  *
  * The 2026-07-28 revision removed the `initialize` handshake and the
@@ -24,6 +30,10 @@ import { hasClientVersionAccessor, hasNegotiatedProtocolVersionAccessor } from '
  */
 export const META_CLIENT_INFO_KEY = 'io.modelcontextprotocol/clientInfo'
 export const META_PROTOCOL_VERSION_KEY = 'io.modelcontextprotocol/protocolVersion'
+/** Required on every post-`initialize` request by 2025-11-25 (and sent by modern clients too). */
+export const PROTOCOL_VERSION_HEADER = 'mcp-protocol-version'
+/** A version string is a date-like token; anything longer is junk we should not record. */
+const MAX_PROTOCOL_VERSION_LENGTH = 64
 
 export interface MetaClientInfo {
   clientName?: string
@@ -100,6 +110,28 @@ export function readEnvelopeClientInfo(extra: CompatibleRequestHandlerExtra | un
   return readReservedKeys((extra as { mcpReq?: { envelope?: unknown } } | undefined)?.mcpReq?.envelope)
 }
 
+/**
+ * Reads the protocol version off the request headers.
+ *
+ * This is what closes the gap on **2025-11-25 traffic served by a per-request
+ * server**: that era carries identity at the handshake, and the instance
+ * handling a later `tools/call` never saw it. The header rides every request, so
+ * it survives where the handshake does not. Carries no client name — that still
+ * depends on the replayed session token.
+ */
+export function readHeaderProtocolVersion(
+  extra: CompatibleRequestHandlerExtra | undefined
+): MetaClientInfo | undefined {
+  // `getRequestHeaders` answers *where* the headers are on either SDK major;
+  // `readHeaderValue` answers how to read one value out of the bag it returns —
+  // repeated values, mixed case, blank strings. Two questions, one place each.
+  const protocolVersion = readHeaderValue(getRequestHeaders(extra), PROTOCOL_VERSION_HEADER)
+  if (!protocolVersion || protocolVersion.length > MAX_PROTOCOL_VERSION_LENGTH) {
+    return undefined
+  }
+  return { protocolVersion }
+}
+
 /**
  * Asks the server itself. `getClientVersion()` answers on any server that
  * handled an `initialize` (and v2 hosts such as `createMcpHandler` backfill it
@@ -148,7 +180,12 @@ export function readServerClientIdentity(server: unknown): MetaClientInfo | unde
  * keeps it a fallback: any request that identifies itself wins outright.
  */
 export function resolveClientIdentity({ request, extra, server }: ClientIdentitySources): MetaClientInfo | undefined {
-  const chain = [readEnvelopeClientInfo(extra), readMetaClientInfo(request), readServerClientIdentity(server)]
+  const chain = [
+    readEnvelopeClientInfo(extra),
+    readMetaClientInfo(request),
+    readHeaderProtocolVersion(extra),
+    readServerClientIdentity(server),
+  ]
   const result: MetaClientInfo = {}
   for (const source of chain) {
     if (!source) {

package/src/version.ts

@@ -1 +1 @@
-export const version = '0.11.2'
+export const version = '0.11.3'