@posthog/mcp 0.11.7 → 0.13.0

package/src/extensions/context-parameters.ts

@@ -4,11 +4,7 @@
 // Licensed under the MIT License: https://github.com/agentcathq/agentcat-typescript-sdk/blob/main/LICENSE
 
 import type { MCPAnalyticsOptions } from '../types'
-import {
-  canInjectAnalyticsParameter,
-  hasAnalyticsParameter,
-  type AnalyticsInjectableJsonSchema,
-} from './analytics-parameters'
+import { addAnalyticsParameterToTool, type AnalyticsInjectableJsonSchema } from './analytics-parameters'
 import { DEFAULT_CONTEXT_PARAMETER_DESCRIPTION } from './constants'
 import { log, type LoggerFn } from './logger'
 
@@ -27,8 +23,8 @@ export function getContextDescription(context: MCPAnalyticsOptions['context']):
 }
 
 /**
- * Adds a context parameter to a tool's JSON Schema.
- * This function is called AFTER the MCP SDK has converted Zod schemas to JSON Schema,
+ * Adds a context parameter to a tool's JSON Schema, via the shared injector.
+ * This is called AFTER the MCP SDK has converted Zod schemas to JSON Schema,
  * so we only need to handle JSON Schema format.
  *
  * Skips injection (with warning) for:
@@ -41,58 +37,13 @@ export function addContextParameterToTool<TTool extends ContextInjectableTool>(
   contextDescriptionOverride?: string,
   logger: LoggerFn = log
 ): TTool {
-  const modifiedTool = { ...tool }
-  const toolName = tool.name || 'unknown'
-  const schema = modifiedTool.inputSchema as AnalyticsInjectableJsonSchema | undefined
-
-  if (!canInjectAnalyticsParameter(schema, 'context')) {
-    if (hasAnalyticsParameter(schema, 'context')) {
-      logger(`WARN: Tool "${toolName}" already has 'context' parameter. Skipping context injection.`)
-    } else {
-      logger(`WARN: Tool "${toolName}" has complex schema (oneOf/allOf/anyOf/$ref). Skipping context injection.`)
-    }
-    return modifiedTool
-  }
-
-  if (!modifiedTool.inputSchema) {
-    modifiedTool.inputSchema = {
-      type: 'object',
-      properties: {},
-      required: [],
-    }
-  }
-
-  const contextDescription = contextDescriptionOverride || DEFAULT_CONTEXT_PARAMETER_DESCRIPTION
-
-  // Deep copy: the server may reuse or freeze the schema object it handed us.
-  modifiedTool.inputSchema = JSON.parse(JSON.stringify(modifiedTool.inputSchema)) as AnalyticsInjectableJsonSchema
-
-  const inputSchema = modifiedTool.inputSchema as AnalyticsInjectableJsonSchema
-
-  if (!inputSchema.properties) {
-    inputSchema.properties = {}
-  }
-
-  // The MCP SDK emits `additionalProperties: false` when converting Zod schemas;
-  // left in place it would make the injected `context` key invalid.
-  if (inputSchema.additionalProperties === false) {
-    inputSchema.additionalProperties = undefined
-  }
-
-  inputSchema.properties.context = {
-    type: 'string',
-    description: contextDescription,
-  }
-
-  if (Array.isArray(inputSchema.required)) {
-    if (!inputSchema.required.includes('context')) {
-      inputSchema.required.push('context')
-    }
-  } else {
-    inputSchema.required = ['context']
-  }
-
-  return modifiedTool
+  return addAnalyticsParameterToTool(
+    tool,
+    'context',
+    contextDescriptionOverride || DEFAULT_CONTEXT_PARAMETER_DESCRIPTION,
+    'context',
+    logger
+  )
 }
 
 export function addContextParameterToTools<TTool extends ContextInjectableTool>(

package/src/extensions/instrument-highlevel.ts

@@ -17,6 +17,7 @@ import {
   stripOwnedAnalyticsArguments,
 } from './analytics-parameters'
 import { isContextEnabled } from './context-parameters'
+import { isCaptureModelEnabled } from './model-parameters'
 import { MCPAnalyticsEventType } from './event-types'
 import { getServerTrackingData } from './internal'
 import type { LoggerFn } from './logger'
@@ -27,6 +28,7 @@ import {
   handleListToolsRequest,
   patchRequestHandlers,
   captureToolCall,
+  getVirtualToolParameterOwnership,
   isToolAdvertised,
   readToolMetaCategory,
   type HandlerPatch,
@@ -189,6 +191,7 @@ function addTracingToToolCallbackInternal(
     const cleanedArgs = stripOwnedAnalyticsArguments(args, {
       context: isContextEnabled(options?.context) && analyticsOwnsParameter(inputSchema, 'context'),
       conversationId: options?.enableConversationId === true && analyticsOwnsParameter(inputSchema, 'conversation_id'),
+      llmModel: isCaptureModelEnabled(options?.captureModel) && analyticsOwnsParameter(inputSchema, 'llm_model'),
     })
     try {
       if (cleanedArgs === undefined) {
@@ -247,6 +250,7 @@ async function handleToolCallRequest(
       extra,
       eventType: MCPAnalyticsEventType.mcpMissingCapability,
       explicitContextIntent: context,
+      parameterOwnership: getVirtualToolParameterOwnership(data, toolName),
       execute: async () => handleReportMissing({ context }, data.logger),
     })
   }

package/src/extensions/instrument-lowlevel.ts

@@ -14,6 +14,7 @@ import {
   patchRequestHandlers,
   registerFallbackRequestHandler,
   captureToolCall,
+  getVirtualToolParameterOwnership,
   isToolAdvertised,
   type HandlerPatch,
 } from './instrumentation'
@@ -90,6 +91,7 @@ async function handleToolCallRequest(
       extra,
       eventType: MCPAnalyticsEventType.mcpMissingCapability,
       explicitContextIntent: context,
+      parameterOwnership: getVirtualToolParameterOwnership(data, toolName),
       execute: async () => handleReportMissing({ context }, data.logger),
     })
   }

package/src/extensions/instrumentation.ts

@@ -16,6 +16,13 @@ import type {
 } from '../types'
 import { getAnalyticsParameterOwnership, stripOwnedAnalyticsArguments } from './analytics-parameters'
 import { addContextParameterToTools, getContextDescription, isContextEnabled } from './context-parameters'
+import {
+  addModelParameterToTools,
+  getModelArgument,
+  getModelDescription,
+  isCaptureModelEnabled,
+  setEventModel,
+} from './model-parameters'
 import {
   addConversationIdToTools,
   type ConversationIdResolution,
@@ -179,6 +186,7 @@ function getActiveAnalyticsParameterOwnership(
     contextOwnershipKnown: ownership !== undefined,
     context: !isMissingCapabilityTool && isContextEnabled(data.options.context) && ownership?.context === true,
     conversationId: data.options.enableConversationId === true && ownership?.conversationId === true,
+    llmModel: isCaptureModelEnabled(data.options.captureModel) && ownership?.llmModel === true,
     // Deliberately read off `listed`, never the override: only the advertised
     // JSON Schema can say whether `tools/list` declared `_mcp_instructions` (an
     // override is built from the live registry, which holds Zod on the
@@ -263,6 +271,13 @@ async function prepareToolCallEvent(
 
     await applyResolvedMetadata(event, data, request, extra)
     setEventIntent(event, await resolveToolCallIntent(data, request, canCaptureContextIntent, extra))
+    // Unlike intent, the model is only read under positive ownership: with
+    // ownership unresolved, `llm_model` may be the application's own argument,
+    // and recording a customer value as the calling agent's model is worse
+    // than a gap in coverage.
+    if (ownership.llmModel) {
+      setEventModel(event, getModelArgument(request))
+    }
     return { event, requestAttribution }
   } catch (error) {
     data.logger(
@@ -493,6 +508,31 @@ export function patchRequestHandlers(server: MCPServerLike, patches: Record<stri
   }) as MCPServerLike['setRequestHandler']
 }
 
+/**
+ * Ownership for the `get_more_tools` virtual tool, resolved without the
+ * `tools/list` cache.
+ *
+ * The missing-capability branch is only entered when the application does not
+ * advertise a tool by this name, so the descriptor is the SDK's own and what it
+ * declares is known statically. An instance that never served a listing — a
+ * per-request `McpServer`/`Server`, the topology in ADR-0011 — would otherwise
+ * read every injected parameter as not-ours and neither capture nor strip it.
+ *
+ * `conversation_id` still comes from the cache on purpose: resolving it here too
+ * would start minting a handle, and appending its prompt-back block, on
+ * instances that today mint none. That changes session anchoring (ADR-0004)
+ * rather than closing this gap.
+ */
+export function getVirtualToolParameterOwnership(
+  data: MCPAnalyticsData,
+  toolName: string
+): AnalyticsParameterOwnership {
+  return {
+    ...getAnalyticsParameterOwnership(getReportMissingToolDescriptor(toolName).inputSchema),
+    conversationId: data.toolAnalyticsParameterOwnership.get(toolName)?.conversationId === true,
+  }
+}
+
 /**
  * Checks the server's raw listing for a real owner of a candidate virtual tool.
  * This does not depend on a previous client request and does not call the
@@ -664,6 +704,17 @@ async function getTracedToolsList(
         }
       }
 
+      // After the virtual tool is appended, so it advertises `llm_model` too.
+      // Its ownership was cached above from the un-injected descriptor, so the
+      // SDK already strips and captures the argument on its calls — without
+      // injecting here the agent would never be asked for one, and
+      // missing-capability reports would be the only calls with no model.
+      // `context` is deliberately not injected into it: the virtual tool
+      // declares its own, and that argument is the report itself.
+      if (isCaptureModelEnabled(data.options.captureModel)) {
+        tools = addModelParameterToTools(tools, getModelDescription(data.options.captureModel), data.logger)
+      }
+
       if (data.options.enableConversationId) {
         tools = addConversationIdToTools(tools, data.logger)
         tools = addInstructionsToOutputSchemas(tools, data.logger)

package/src/extensions/model-parameters.ts

@@ -0,0 +1,98 @@
+import type { MCPAnalyticsOptions, MCPRequestLike, McpEvent } from '../types'
+import { addAnalyticsParameterToTool, type AnalyticsInjectableJsonSchema } from './analytics-parameters'
+import { DEFAULT_MODEL_PARAMETER_DESCRIPTION } from './constants'
+import { log, type LoggerFn } from './logger'
+
+/**
+ * Self-reported model capture (`captureModel`).
+ *
+ * MCP keeps servers deliberately model-ignorant: the wire carries client
+ * name/version and protocol version, never the LLM behind the client, and no
+ * spec revision changes that. The one place the information exists on the
+ * server side of the connection is the agent itself — harnesses inject the
+ * model id into the system prompt, so the agent can state it the same way it
+ * states its intent through the `context` parameter.
+ *
+ * This module injects a required `llm_model` string parameter into every tool
+ * (mirroring `context-parameters.ts`), strips it before the tool runs, and
+ * captures it as `$mcp_llm_model` with `$mcp_llm_model_source = "self_reported"`.
+ * The source property is deliberate: like `clientInfo` in the MCP spec, the
+ * value is self-reported and unverified — right for degradation analytics
+ * ("does our MCP get worse on model X?"), never for billing or security.
+ *
+ * Reasoning effort is deliberately NOT captured: it never crosses the wire,
+ * and models cannot reliably self-report it (harnesses apply it as a sampling
+ * parameter the model never sees), so any captured value would be noise.
+ */
+
+export interface ModelInjectableTool {
+  inputSchema?: AnalyticsInjectableJsonSchema
+  name?: string
+  [key: string]: unknown
+}
+
+/** Unlike `context`, model capture is opt-in: off unless explicitly enabled. */
+export function isCaptureModelEnabled(captureModel: MCPAnalyticsOptions['captureModel']): boolean {
+  return captureModel === true || (typeof captureModel === 'object' && captureModel !== null)
+}
+
+export function getModelDescription(captureModel: MCPAnalyticsOptions['captureModel']): string | undefined {
+  return typeof captureModel === 'object' && captureModel !== null ? captureModel.description : undefined
+}
+
+/**
+ * Adds an `llm_model` parameter to a tool's JSON Schema, via the shared
+ * injector so schema handling stays identical to `context`: a tool that already
+ * declares `llm_model` owns it, and complex schemas can't safely gain keys.
+ */
+export function addModelParameterToTool<TTool extends ModelInjectableTool>(
+  tool: TTool,
+  modelDescriptionOverride?: string,
+  logger: LoggerFn = log
+): TTool {
+  return addAnalyticsParameterToTool(
+    tool,
+    'llm_model',
+    modelDescriptionOverride || DEFAULT_MODEL_PARAMETER_DESCRIPTION,
+    'model',
+    logger
+  )
+}
+
+export function addModelParameterToTools<TTool extends ModelInjectableTool>(
+  tools: TTool[],
+  modelDescriptionOverride?: string,
+  logger: LoggerFn = log
+): TTool[] {
+  return tools.map((tool) => addModelParameterToTool(tool, modelDescriptionOverride, logger))
+}
+
+/**
+ * Reads the self-reported model off a tool-call request. Returns `undefined`
+ * for a missing, blank, or `"unknown"` value — the parameter description asks
+ * agents to pass `unknown` when uncertain, and an honest "I don't know" must
+ * not become a property value queries would group by.
+ */
+export function getModelArgument(request: MCPRequestLike): string | undefined {
+  return normalizeModel(request.params?.arguments?.llm_model)
+}
+
+function normalizeModel(model: unknown): string | undefined {
+  if (typeof model !== 'string') {
+    return undefined
+  }
+  const trimmed = model.trim()
+  if (!trimmed || trimmed.toLowerCase() === 'unknown') {
+    return undefined
+  }
+  return trimmed
+}
+
+export function setEventModel(event: McpEvent, model: string | undefined): void {
+  const normalizedModel = normalizeModel(model)
+  if (!normalizedModel) {
+    return
+  }
+  event.llmModel = normalizedModel
+  event.llmModelSource = 'self_reported'
+}

package/src/extensions/posthog-events.ts

@@ -170,6 +170,14 @@ function addCommonEventProperties(event: Event, properties: Record<string, unkno
   if (event.userIntentSource) {
     properties[PostHogMCPAnalyticsProperty.IntentSource] = event.userIntentSource
   }
+  // Self-reported by the calling agent (`captureModel`), so present only on the
+  // requests where the agent supplied a definite value — never inferred.
+  if (event.llmModel) {
+    properties[PostHogMCPAnalyticsProperty.LlmModel] = event.llmModel
+  }
+  if (event.llmModelSource) {
+    properties[PostHogMCPAnalyticsProperty.LlmModelSource] = event.llmModelSource
+  }
   if (event.isError !== undefined) {
     properties[PostHogMCPAnalyticsProperty.IsError] = event.isError
   }

package/src/extensions/posthog-mcp.ts

@@ -3,14 +3,17 @@ import { PostHog, type PostHogOptions } from 'posthog-node'
 import type {
   InitializeCaptureData,
   JsonRecord,
+  MCPAnalyticsOptions,
   McpCaptureCommon,
   McpEvent,
   MissingCapabilityCaptureData,
   PreparedToolCall,
+  PrepareToolCallOptions,
   PrepareToolListOptions,
   ToolCallCaptureData,
   ToolsListCaptureData,
 } from '../types'
+import { analyticsOwnsParameter, stripOwnedAnalyticsArguments } from './analytics-parameters'
 import {
   addContextParameterToTools,
   getContextDescription,
@@ -22,6 +25,13 @@ import { captureException } from './exceptions'
 import { normalizeHeaderString } from './headers'
 import { applyMcpLibIdentity } from './lib-identity'
 import { log } from './logger'
+import {
+  addModelParameterToTool,
+  getModelArgument,
+  getModelDescription,
+  isCaptureModelEnabled,
+  setEventModel,
+} from './model-parameters'
 import { McpEventSink } from './sink'
 import { GET_MORE_TOOLS_NAME, getReportMissingToolDescriptor } from './tools'
 
@@ -37,6 +47,11 @@ export interface PostHogMCPOptions extends PostHogOptions {
    * can't drift. Defaults to `get_more_tools`.
    */
   missingCapabilityToolName?: string
+  /**
+   * Inject a required `llm_model` argument into advertised tools and capture
+   * the agent's self-reported value. Off by default.
+   */
+  captureModel?: MCPAnalyticsOptions['captureModel']
 }
 
 /**
@@ -57,7 +72,10 @@ export interface PostHogMCPOptions extends PostHogOptions {
  * ```ts
  * import { PostHogMCP } from "@posthog/mcp"
  *
- * const posthog = new PostHogMCP("phc_your_project_token", { host: "https://us.i.posthog.com" })
+ * const posthog = new PostHogMCP("phc_your_project_token", {
+ *   host: "https://us.i.posthog.com",
+ *   captureModel: true,
+ * })
  *
  * posthog.captureToolCall({
  *   toolName: "search_docs",
@@ -78,10 +96,13 @@ export class PostHogMCP extends PostHog {
   // The get_more_tools name lives here (not on the per-call options) so that
   // prepareToolList (inject) and prepareToolCall (detect) always agree.
   readonly #missingCapabilityToolName: string
+  readonly #captureModel: MCPAnalyticsOptions['captureModel']
+  readonly #modelParameterOwnership = new Map<string, boolean>()
 
   constructor(apiKey: string, options: PostHogMCPOptions = {}) {
     super(apiKey, options)
     this.#missingCapabilityToolName = options.missingCapabilityToolName ?? GET_MORE_TOOLS_NAME
+    this.#captureModel = options.captureModel
     applyMcpLibIdentity(this)
   }
 
@@ -97,6 +118,10 @@ export class PostHogMCP extends PostHog {
     event.isError = data.isError
     event.errorType = data.errorType
     applyIntent(event, data.intent, data.intentSource)
+    setEventModel(event, data.llmModel)
+    if (event.llmModel && data.llmModelSource) {
+      event.llmModelSource = data.llmModelSource
+    }
     if (data.isError) {
       event.error = captureException(data.error ?? `Tool ${data.toolName} returned an error`)
     }
@@ -137,9 +162,9 @@ export class PostHogMCP extends PostHog {
   /**
    * Decorate your `tools/list` response with PostHog's analytics affordances:
    * injects the `context` argument into every tool (so agents state their intent,
-   * captured as `$mcp_intent`) and, when `reportMissing` is on, appends the
-   * `get_more_tools` virtual tool (rename it via the `missingCapabilityToolName`
-   * constructor option). Returns a new array; your tools are untouched.
+   * captured as `$mcp_intent`), injects `llm_model` when the constructor's
+   * `captureModel` option is enabled, and appends `get_more_tools` when
+   * `reportMissing` is on. Returns a new array; your tools are untouched.
    *
    * The appended `get_more_tools` descriptor carries only the base MCP tool fields
    * (name, description, input schema) — not any framework-specific fields your
@@ -165,18 +190,41 @@ export class PostHogMCP extends PostHog {
     if (options.reportMissing && !prepared.some((tool) => tool?.name === this.#missingCapabilityToolName)) {
       prepared = [...prepared, getReportMissingToolDescriptor(this.#missingCapabilityToolName) as TTool]
     }
+
+    if (isCaptureModelEnabled(this.#captureModel)) {
+      this.#modelParameterOwnership.clear()
+      const ownershipByName = new Map<string, boolean>()
+      for (const tool of prepared) {
+        if (typeof tool.name !== 'string') {
+          continue
+        }
+        const ownsModel = analyticsOwnsParameter(tool.inputSchema, 'llm_model')
+        ownershipByName.set(tool.name, (ownershipByName.get(tool.name) ?? true) && ownsModel)
+      }
+      for (const [toolName, ownsModel] of ownershipByName) {
+        this.#modelParameterOwnership.set(toolName, ownsModel)
+      }
+      const modelDescription = getModelDescription(this.#captureModel)
+      prepared = prepared.map((tool) =>
+        typeof tool.name === 'string' && ownershipByName.get(tool.name) === false
+          ? tool
+          : addModelParameterToTool(tool, modelDescription)
+      )
+    }
     return prepared
   }
 
   /**
-   * Read an incoming `tools/call` before you dispatch it: pulls the agent's
-   * intent off the injected `context` argument, strips `context` from the
-   * arguments (so your handler and its schema validation never see it), and flags
+   * Read an incoming `tools/call` before you dispatch it: pulls analytics values
+   * from SDK-owned arguments, strips those arguments before validation, and flags
    * whether the call targeted the `get_more_tools` virtual tool.
    *
-   * Pass the returned `intent` / `intentSource` to {@link captureToolCall}, and
+   * Pass the returned intent and model fields to {@link captureToolCall}, and
    * dispatch the returned `args` to your tool.
    *
+   * On stateless or multi-replica servers, pass the original tool descriptor
+   * so ownership does not depend on which process served `tools/list`.
+   *
    * This only extracts the explicit `context` argument (`intentSource:
    * 'context_parameter'`); it does not infer intent. If you run your own
    * inference, pass that string with `intentSource: 'inferred'` straight to
@@ -185,22 +233,42 @@ export class PostHogMCP extends PostHog {
    *
    * @example
    * ```ts
-   * const { intent, intentSource, args, isMissingCapability } = posthog.prepareToolCall(name, rawArgs)
+   * const { intent, intentSource, llmModel, llmModelSource, args, isMissingCapability } =
+   *   posthog.prepareToolCall(name, rawArgs)
    * if (isMissingCapability) {
-   *   posthog.captureMissingCapability({ context: intent, ...identity })
+   *   posthog.captureMissingCapability({ context: intent, llmModel, llmModelSource, ...identity })
    *   return getMoreToolsResult()
    * }
    * const result = await runTool(name, args)
    * posthog.captureToolCall({ toolName: name, intent, intentSource, ...identity })
    * ```
    */
-  prepareToolCall(name: string, args?: Record<string, unknown>): PreparedToolCall {
+  prepareToolCall(
+    name: string,
+    args?: Record<string, unknown>,
+    options: PrepareToolCallOptions = {}
+  ): PreparedToolCall {
     const rawContext = args?.context
     const intent = typeof rawContext === 'string' && rawContext.trim() ? rawContext.trim() : undefined
+    const ownsModel =
+      isCaptureModelEnabled(this.#captureModel) &&
+      (options.originalTool
+        ? analyticsOwnsParameter(options.originalTool.inputSchema, 'llm_model')
+        : this.#modelParameterOwnership.get(name) === true)
+    const llmModel = ownsModel ? getModelArgument({ params: { arguments: args } }) : undefined
+    const strippedArgs = stripContext(args)
     return {
       intent,
       intentSource: intent ? 'context_parameter' : undefined,
-      args: stripContext(args),
+      llmModel,
+      llmModelSource: llmModel ? 'self_reported' : undefined,
+      args: ownsModel
+        ? (stripOwnedAnalyticsArguments(strippedArgs, {
+            context: false,
+            conversationId: false,
+            llmModel: true,
+          }) as Record<string, unknown> | undefined)
+        : strippedArgs,
       isMissingCapability: name === this.#missingCapabilityToolName,
     }
   }
@@ -215,6 +283,10 @@ export class PostHogMCP extends PostHog {
     event.resourceName = this.#missingCapabilityToolName
     event.parameters = data.parameters
     applyIntent(event, data.context, 'context_parameter')
+    setEventModel(event, data.llmModel)
+    if (event.llmModel && data.llmModelSource) {
+      event.llmModelSource = data.llmModelSource
+    }
     this.#emit(event)
   }
 

package/src/extensions/sanitization.ts

@@ -15,8 +15,8 @@ function isRecord(value: unknown): value is SanitizedRecord {
 /**
  * Sanitizes an event by redacting non-text content blocks from responses
  * and large base64-encoded strings from parameters, and applying the same
- * string redaction (PostHog tokens, base64 blobs, sensitive keys) to the
- * agent-supplied intent.
+ * string redaction (PostHog tokens, base64 blobs, sensitive keys) to values
+ * supplied by the agent.
  *
  * This is a synchronous operation that returns a new object without mutating the original.
  * It should run after customer redaction in the event pipeline.
@@ -39,6 +39,10 @@ export function sanitizeEvent<T extends Event | McpEvent>(event: T): T {
     result.userIntent = sanitizeCapturedValue(result.userIntent) as string
   }
 
+  if (result.llmModel != null) {
+    result.llmModel = sanitizeCapturedValue(result.llmModel) as string
+  }
+
   if (result.error != null) {
     result.error = sanitizeExceptionValues(result.error)
   }

package/src/extensions/truncation.ts

@@ -435,6 +435,9 @@ export function truncateEvent<T extends Event | McpEvent>(event: T): T {
   result.clientUserAgent = truncateString(result.clientUserAgent, MAX_METADATA_LENGTH)
   result.vendorClient = truncateString(result.vendorClient, MAX_METADATA_LENGTH)
   result.errorType = truncateString(result.errorType, MAX_METADATA_LENGTH)
+  // Agent-supplied free text, same trust level as a header. Real model ids are
+  // tens of characters; anything past the metadata cap is junk, not a model.
+  result.llmModel = truncateString(result.llmModel, MAX_METADATA_LENGTH)
 
   // Error field limits — operate on the core `$exception_list` shape
   if (result.error != null && typeof result.error === 'object') {

package/src/index.ts

@@ -228,9 +228,12 @@ export type {
   McpCaptureCommon,
   MCPAnalyticsContextOptions,
   MCPAnalyticsIntentSource,
+  MCPAnalyticsModelOptions,
+  MCPAnalyticsModelSource,
   MCPAnalyticsOptions,
   MissingCapabilityCaptureData,
   PreparedToolCall,
+  PrepareToolCallOptions,
   PrepareToolListOptions,
   RequestHeaderBag,
   ToolCallCaptureData,