@posthog/mcp 0.13.0 → 0.13.1

package/README.md

@@ -150,6 +150,14 @@ instrument(server, posthog, {
 
 `intentFallback` is the third option: supply the intent yourself when the agent did not send one.
 
+Whatever the agent narrates, the SDK redacts structured personal identifiers — email addresses, phone
+numbers, IPv4/IPv6 addresses, Luhn-valid card numbers, and US SSNs — from `$mcp_intent` before it is
+sent. This is always on and needs no configuration. It is best-effort for those well-defined shapes,
+not for free-form personal data such as names or postal addresses, which a regex cannot catch without
+over-redacting ordinary prose. It also applies only to `$mcp_intent`: structured tool `arguments` and
+results are left as-is, because the same shapes are often legitimate data there. If you need a stronger
+guarantee, `context: false` and the `beforeSend` hook above remain the ways to drop the field entirely.
+
 ### What `$mcp_llm_model` records, and when it stays empty
 
 `captureModel` is **off** by default. Turn it on and the SDK adds a required `llm_model` parameter to

package/dist/extensions/constants.d.ts

@@ -1,5 +1,5 @@
 export declare const INACTIVITY_TIMEOUT_IN_MINUTES = 30;
-export declare const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = "Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): \"Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization.\"";
+export declare const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = "Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as \"a user\", \"the customer\", or \"an account\". Example: \"Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution.\"";
 export declare const DEFAULT_MODEL_PARAMETER_DESCRIPTION = "The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. \"claude-opus-4-8\", \"gpt-5.2\"). Used for analytics only. If you do not know your model identifier with certainty, pass \"unknown\" \u2014 never guess.";
 export declare const DEFAULT_CONVERSATION_ID_DESCRIPTION = "Echo the conversation_id from the server's previous response. The server provides it on the first call \u2014 never invent one, and do not issue parallel tool calls until you have it.";
 export declare const POSTHOG_MCP_ANALYTICS_SOURCE = "posthog_mcp_analytics";

package/dist/extensions/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/extensions/constants.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C,eAAO,MAAM,qCAAqC,2hBAAyhB,CAAA;AAE3kB,eAAO,MAAM,mCAAmC,gRAAqQ,CAAA;AAErT,eAAO,MAAM,mCAAmC,4LACsI,CAAA;AAEtL,eAAO,MAAM,4BAA4B,0BAA0B,CAAA;AAMnE,eAAO,MAAM,oBAAoB,qBAAqB,CAAA;AAItD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;CAY3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAA;AAE/G,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B9B,CAAA;AAEV,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAA"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/extensions/constants.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C,eAAO,MAAM,qCAAqC,onBAA4mB,CAAA;AAE9pB,eAAO,MAAM,mCAAmC,gRAAqQ,CAAA;AAErT,eAAO,MAAM,mCAAmC,4LACsI,CAAA;AAEtL,eAAO,MAAM,4BAA4B,0BAA0B,CAAA;AAMnE,eAAO,MAAM,oBAAoB,qBAAqB,CAAA;AAItD,eAAO,MAAM,wBAAwB;;;;;;;;;;;;CAY3B,CAAA;AAEV,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,OAAO,wBAAwB,CAAC,CAAA;AAE/G,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;CA0B9B,CAAA;AAEV,MAAM,MAAM,2BAA2B,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,OAAO,2BAA2B,CAAC,CAAA"}

package/dist/extensions/constants.js

@@ -28,7 +28,7 @@ var __webpack_require__ = {};
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
 const INACTIVITY_TIMEOUT_IN_MINUTES = 30;
-const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = "Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): \"Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization.\"";
+const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = 'Explain in 15-25 words, in third person, why this tool is called and how it supports the user\'s goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer\'s recent orders to investigate a billing issue and help support determine the appropriate resolution."';
 const DEFAULT_MODEL_PARAMETER_DESCRIPTION = 'The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.';
 const DEFAULT_CONVERSATION_ID_DESCRIPTION = "Echo the conversation_id from the server's previous response. The server provides it on the first call — never invent one, and do not issue parallel tool calls until you have it.";
 const POSTHOG_MCP_ANALYTICS_SOURCE = 'posthog_mcp_analytics';

package/dist/extensions/constants.mjs

@@ -1,5 +1,5 @@
 const INACTIVITY_TIMEOUT_IN_MINUTES = 30;
-const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = "Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): \"Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization.\"";
+const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = 'Explain in 15-25 words, in third person, why this tool is called and how it supports the user\'s goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer\'s recent orders to investigate a billing issue and help support determine the appropriate resolution."';
 const DEFAULT_MODEL_PARAMETER_DESCRIPTION = 'The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.';
 const DEFAULT_CONVERSATION_ID_DESCRIPTION = "Echo the conversation_id from the server's previous response. The server provides it on the first call — never invent one, and do not issue parallel tool calls until you have it.";
 const POSTHOG_MCP_ANALYTICS_SOURCE = 'posthog_mcp_analytics';

package/dist/extensions/mcp-payloads.d.ts

@@ -1,4 +1,14 @@
 type JsonRecord = Record<string, unknown>;
+/**
+ * Redacts structured personal identifiers (emails, IP addresses, credit-card
+ * numbers, US SSNs, and phone numbers) from a free-text string. Intended for the
+ * agent-narrated `$mcp_intent` value only — not for structured tool parameters or
+ * responses, where the same shapes are often legitimate data. Horizontal Unicode
+ * spaces are first normalized to an ASCII space so copy-pasted identifiers still
+ * match. Returns a new string; leaves the input's identifiers untouched when
+ * nothing matches.
+ */
+export declare function redactPii(value: string): string;
 export declare function sanitizeCapturedValue(value: unknown): unknown;
 export declare function buildCapturedMcpParameters(request: unknown): JsonRecord;
 export {};

package/dist/extensions/mcp-payloads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AAkBA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAsCzC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA0B7D;AA6BD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}
+{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AAmEA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAiGzC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CA0B7D;AA6BD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}

package/dist/extensions/mcp-payloads.js

@@ -38,6 +38,15 @@ const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
+const UNICODE_SPACE_PATTERN = /[\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000]/g;
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/g;
+const IPV4_PATTERN = /\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\b/g;
+const IPV6_PATTERN = /\b(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}\b|(?<![\w:])(?:[0-9A-Fa-f]{1,4}:){1,7}:(?![\w:])|(?<![\w:])(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,5}(?![\w])|(?<![\w:])::(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,6})(?![\w])/g;
+const US_SSN_PATTERN = /\b\d{3}[ .-]\d{2}[ .-]\d{4}\b/g;
+const CREDIT_CARD_CANDIDATE_PATTERN = /\b\d(?:[ ./-]?\d){12,}\b/g;
+const DIGIT_GROUP_PATTERN = /\d+/g;
+const PHONE_NANP_PATTERN = /(?<![\w+])(?:\+?1[ ./-]?)?(?:\(\d{3}\)[ ./-]?|\d{3}[ ./-])\d{3}[ ./-]\d{4}(?![\w])/g;
+const PHONE_INTL_PATTERN = /(?<!\w)\+\d{1,3}(?:[ ./()-]{0,2}\d){7,13}(?![\w])/g;
 function isRecord(value) {
     return !!value && 'object' == typeof value && !Array.isArray(value);
 }
@@ -59,6 +68,58 @@ function sanitizeString(value) {
     if (value.length >= SIZE_GATE && (BASE64_PATTERN.test(value) || isBase64DataUrl(value) || BASE64URL_SPECIFIC_CHAR_PATTERN.test(value) && BASE64URL_PATTERN.test(value))) return BINARY_REDACTED_VALUE;
     return value.replace(POSTHOG_TOKEN_PATTERN, REDACTED_VALUE);
 }
+function passesLuhn(digits) {
+    let sum = 0;
+    let double = false;
+    for(let index = digits.length - 1; index >= 0; index--){
+        let digit = digits.charCodeAt(index) - 48;
+        if (digit < 0 || digit > 9) return false;
+        if (double) {
+            digit *= 2;
+            if (digit > 9) digit -= 9;
+        }
+        sum += digit;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+function redactCardInMatch(match) {
+    const groups = [];
+    for(let m = DIGIT_GROUP_PATTERN.exec(match); null !== m; m = DIGIT_GROUP_PATTERN.exec(match))groups.push({
+        digits: m[0],
+        start: m.index,
+        end: m.index + m[0].length
+    });
+    let output = '';
+    let cursor = 0;
+    let first = 0;
+    while(first < groups.length){
+        let digits = '';
+        let matchedLast = -1;
+        for(let last = first; last < groups.length; last++){
+            digits += groups[last].digits;
+            if (digits.length > 19) break;
+            if (digits.length >= 13 && passesLuhn(digits)) matchedLast = last;
+        }
+        if (matchedLast >= 0) {
+            output += match.slice(cursor, groups[first].start) + REDACTED_VALUE;
+            cursor = groups[matchedLast].end;
+            first = matchedLast + 1;
+        } else first++;
+    }
+    return output + match.slice(cursor);
+}
+function redactPii(value) {
+    let result = value.replace(UNICODE_SPACE_PATTERN, ' ');
+    result = result.replace(EMAIL_PATTERN, REDACTED_VALUE);
+    result = result.replace(IPV4_PATTERN, REDACTED_VALUE);
+    result = result.replace(IPV6_PATTERN, REDACTED_VALUE);
+    result = result.replace(CREDIT_CARD_CANDIDATE_PATTERN, redactCardInMatch);
+    result = result.replace(US_SSN_PATTERN, REDACTED_VALUE);
+    result = result.replace(PHONE_NANP_PATTERN, REDACTED_VALUE);
+    result = result.replace(PHONE_INTL_PATTERN, REDACTED_VALUE);
+    return result;
+}
 function sanitizeCapturedValue(value) {
     if (null == value) return value;
     if ('string' == typeof value) return sanitizeString(value);
@@ -98,12 +159,15 @@ function buildCapturedMcpParameters(request) {
 }
 __webpack_require__.d(__webpack_exports__, {
     buildCapturedMcpParameters: ()=>buildCapturedMcpParameters,
+    redactPii: ()=>redactPii,
     sanitizeCapturedValue: ()=>sanitizeCapturedValue
 });
 exports.buildCapturedMcpParameters = __webpack_exports__.buildCapturedMcpParameters;
+exports.redactPii = __webpack_exports__.redactPii;
 exports.sanitizeCapturedValue = __webpack_exports__.sanitizeCapturedValue;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
     "buildCapturedMcpParameters",
+    "redactPii",
     "sanitizeCapturedValue"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];
 Object.defineProperty(exports, '__esModule', {

package/dist/extensions/mcp-payloads.mjs

@@ -9,6 +9,15 @@ const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
+const UNICODE_SPACE_PATTERN = /[\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000]/g;
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/g;
+const IPV4_PATTERN = /\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\b/g;
+const IPV6_PATTERN = /\b(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}\b|(?<![\w:])(?:[0-9A-Fa-f]{1,4}:){1,7}:(?![\w:])|(?<![\w:])(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,5}(?![\w])|(?<![\w:])::(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,6})(?![\w])/g;
+const US_SSN_PATTERN = /\b\d{3}[ .-]\d{2}[ .-]\d{4}\b/g;
+const CREDIT_CARD_CANDIDATE_PATTERN = /\b\d(?:[ ./-]?\d){12,}\b/g;
+const DIGIT_GROUP_PATTERN = /\d+/g;
+const PHONE_NANP_PATTERN = /(?<![\w+])(?:\+?1[ ./-]?)?(?:\(\d{3}\)[ ./-]?|\d{3}[ ./-])\d{3}[ ./-]\d{4}(?![\w])/g;
+const PHONE_INTL_PATTERN = /(?<!\w)\+\d{1,3}(?:[ ./()-]{0,2}\d){7,13}(?![\w])/g;
 function isRecord(value) {
     return !!value && 'object' == typeof value && !Array.isArray(value);
 }
@@ -30,6 +39,58 @@ function sanitizeString(value) {
     if (value.length >= SIZE_GATE && (BASE64_PATTERN.test(value) || isBase64DataUrl(value) || BASE64URL_SPECIFIC_CHAR_PATTERN.test(value) && BASE64URL_PATTERN.test(value))) return BINARY_REDACTED_VALUE;
     return value.replace(POSTHOG_TOKEN_PATTERN, REDACTED_VALUE);
 }
+function passesLuhn(digits) {
+    let sum = 0;
+    let double = false;
+    for(let index = digits.length - 1; index >= 0; index--){
+        let digit = digits.charCodeAt(index) - 48;
+        if (digit < 0 || digit > 9) return false;
+        if (double) {
+            digit *= 2;
+            if (digit > 9) digit -= 9;
+        }
+        sum += digit;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+function redactCardInMatch(match) {
+    const groups = [];
+    for(let m = DIGIT_GROUP_PATTERN.exec(match); null !== m; m = DIGIT_GROUP_PATTERN.exec(match))groups.push({
+        digits: m[0],
+        start: m.index,
+        end: m.index + m[0].length
+    });
+    let output = '';
+    let cursor = 0;
+    let first = 0;
+    while(first < groups.length){
+        let digits = '';
+        let matchedLast = -1;
+        for(let last = first; last < groups.length; last++){
+            digits += groups[last].digits;
+            if (digits.length > 19) break;
+            if (digits.length >= 13 && passesLuhn(digits)) matchedLast = last;
+        }
+        if (matchedLast >= 0) {
+            output += match.slice(cursor, groups[first].start) + REDACTED_VALUE;
+            cursor = groups[matchedLast].end;
+            first = matchedLast + 1;
+        } else first++;
+    }
+    return output + match.slice(cursor);
+}
+function redactPii(value) {
+    let result = value.replace(UNICODE_SPACE_PATTERN, ' ');
+    result = result.replace(EMAIL_PATTERN, REDACTED_VALUE);
+    result = result.replace(IPV4_PATTERN, REDACTED_VALUE);
+    result = result.replace(IPV6_PATTERN, REDACTED_VALUE);
+    result = result.replace(CREDIT_CARD_CANDIDATE_PATTERN, redactCardInMatch);
+    result = result.replace(US_SSN_PATTERN, REDACTED_VALUE);
+    result = result.replace(PHONE_NANP_PATTERN, REDACTED_VALUE);
+    result = result.replace(PHONE_INTL_PATTERN, REDACTED_VALUE);
+    return result;
+}
 function sanitizeCapturedValue(value) {
     if (null == value) return value;
     if ('string' == typeof value) return sanitizeString(value);
@@ -67,4 +128,4 @@ function buildCapturedMcpParameters(request) {
         request: capturedRequest
     };
 }
-export { buildCapturedMcpParameters, sanitizeCapturedValue };
+export { buildCapturedMcpParameters, redactPii, sanitizeCapturedValue };

package/dist/extensions/sanitization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitization.d.ts","sourceRoot":"","sources":["../../src/extensions/sanitization.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAShE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2BrE"}
+{"version":3,"file":"sanitization.d.ts","sourceRoot":"","sources":["../../src/extensions/sanitization.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAA;AAShE;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA8BrE"}

package/dist/extensions/sanitization.js

@@ -40,7 +40,7 @@ function sanitizeEvent(event) {
     };
     if (null != result.response) result.response = sanitizeResponse(result.response);
     if (null != result.parameters) result.parameters = sanitizeParameters(result.parameters);
-    if (null != result.userIntent) result.userIntent = (0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(result.userIntent);
+    if (null != result.userIntent) result.userIntent = (0, external_mcp_payloads_js_namespaceObject.redactPii)((0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(result.userIntent));
     if (null != result.llmModel) result.llmModel = (0, external_mcp_payloads_js_namespaceObject.sanitizeCapturedValue)(result.llmModel);
     if (null != result.error) result.error = sanitizeExceptionValues(result.error);
     return result;

package/dist/extensions/sanitization.mjs

@@ -1,4 +1,4 @@
-import { sanitizeCapturedValue } from "./mcp-payloads.mjs";
+import { redactPii, sanitizeCapturedValue } from "./mcp-payloads.mjs";
 function isRecord(value) {
     return !!value && 'object' == typeof value && !Array.isArray(value);
 }
@@ -8,7 +8,7 @@ function sanitizeEvent(event) {
     };
     if (null != result.response) result.response = sanitizeResponse(result.response);
     if (null != result.parameters) result.parameters = sanitizeParameters(result.parameters);
-    if (null != result.userIntent) result.userIntent = sanitizeCapturedValue(result.userIntent);
+    if (null != result.userIntent) result.userIntent = redactPii(sanitizeCapturedValue(result.userIntent));
     if (null != result.llmModel) result.llmModel = sanitizeCapturedValue(result.llmModel);
     if (null != result.error) result.error = sanitizeExceptionValues(result.error);
     return result;

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.13.0";
+export declare const version = "0.13.1";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -27,7 +27,7 @@ var __webpack_require__ = {};
 })();
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
-const version = '0.13.0';
+const version = '0.13.1';
 __webpack_require__.d(__webpack_exports__, {}, {
     version: version
 });

package/dist/version.mjs

@@ -1,2 +1,2 @@
-const version = '0.13.0';
+const version = '0.13.1';
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/mcp",
-  "version": "0.13.0",
+  "version": "0.13.1",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -28,7 +28,7 @@
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@posthog/core": "^1.50.3"
+    "@posthog/core": "^1.50.6"
   },
   "devDependencies": {
     "@babel/preset-env": "^7.27.1",
@@ -52,8 +52,8 @@
     "zod4": "npm:zod@^4.4.3",
     "@vitest/coverage-v8": "^1.6.1",
     "vitest": "^1.6.1",
-    "@posthog-tooling/tsconfig-base": "1.1.1",
-    "posthog-node": "^5.51.6"
+    "posthog-node": "^5.51.7",
+    "@posthog-tooling/tsconfig-base": "1.1.1"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": ">=1.26.0",

package/src/extensions/constants.ts

@@ -5,7 +5,7 @@
 
 export const INACTIVITY_TIMEOUT_IN_MINUTES = 30
 
-export const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = `Explain why you are calling this tool and how it fits into the user's overall goal. This parameter is used for analytics and user intent tracking. YOU MUST provide 15-25 words (count carefully). NEVER use first person ('I', 'we', 'you') - maintain third-person perspective. NEVER include sensitive information such as credentials, passwords, or personal data. Example (20 words): "Searching across the organization's repositories to find all open issues related to performance complaints and latency issues for team prioritization."`
+export const DEFAULT_CONTEXT_PARAMETER_DESCRIPTION = `Explain in 15-25 words, in third person, why this tool is called and how it supports the user's goal. For analytics only. You MUST describe only the abstract purpose of the tool call. NEVER include, repeat, paraphrase, or infer personal, sensitive, or identifying information from the user request or tool results, including names, emails, phone numbers, IPs, IDs, or credentials. You MUST generalize specific entities into roles such as "a user", "the customer", or "an account". Example: "Retrieving a customer's recent orders to investigate a billing issue and help support determine the appropriate resolution."`
 
 export const DEFAULT_MODEL_PARAMETER_DESCRIPTION = `The exact model identifier you (the assistant) are running as, taken from your system prompt or environment (e.g. "claude-opus-4-8", "gpt-5.2"). Used for analytics only. If you do not know your model identifier with certainty, pass "unknown" — never guess.`
 

package/src/extensions/mcp-payloads.ts

@@ -16,6 +16,55 @@ const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g
 const SENSITIVE_KEY_PATTERN =
   /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i
 
+// PII redaction for the agent-narrated intent string only. `$mcp_intent` is free
+// text the calling LLM writes into the injected `context` argument, so it can
+// carry personal data the model read aloud despite being told not to. We redact
+// well-defined *structured identifiers* — the kind regex can match with high
+// precision. Person names and postal addresses are deliberately out of scope:
+// they need an NER model that a client SDK cannot ship, and naive patterns would
+// over-redact ordinary prose. Patterns are ordered so an earlier pass never eats
+// digits a later pass needs (email before phone, IPs before phone, cards before
+// the generic phone pass). See `redactPii`.
+// Horizontal Unicode spaces (NBSP, narrow NBSP, ideographic space, ...) are what
+// appear when text is copied from web pages or PDFs. `redactPii` normalizes them
+// to an ASCII space first so the separator-based card/phone/SSN candidates match
+// them instead of leaking the identifier they group.
+const UNICODE_SPACE_PATTERN = /[\u00A0\u1680\u2000-\u200A\u202F\u205F\u3000]/g
+// Quantifiers are bounded to RFC-ish limits (local-part <=64, domain <=255,
+// TLD <=24) rather than open-ended `+`. Unbounded `+` here is quadratic: on a
+// long run of local-part chars with no valid `.tld`, `replace` rescans from
+// every start position. `$mcp_intent` is attacker-influenceable free text seen
+// before truncation, so an open-ended pattern is a reachable event-loop stall.
+const EMAIL_PATTERN = /[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,255}\.[A-Za-z]{2,24}/g
+const IPV4_PATTERN = /\b(?:(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d\d|[1-9]?\d)\b/g
+// Four forms: full 8-group, `::`-terminated (`2001:db8::`), a middle `::`
+// (`2001:db8::8a2e:1`), and a leading `::` (`::1`). The compressed branches use a
+// `(?<![\w:])` boundary so a hex-looking C++ scope like `std::bad` — whose left
+// side is not a valid hex group — is not mistaken for an address, while a
+// genuinely address-shaped `dead::beef` still matches.
+const IPV6_PATTERN =
+  /\b(?:[0-9A-Fa-f]{1,4}:){7}[0-9A-Fa-f]{1,4}\b|(?<![\w:])(?:[0-9A-Fa-f]{1,4}:){1,7}:(?![\w:])|(?<![\w:])(?:[0-9A-Fa-f]{1,4}:){1,6}:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,5}(?![\w])|(?<![\w:])::(?:[0-9A-Fa-f]{1,4}(?::[0-9A-Fa-f]{1,4}){0,6})(?![\w])/g
+// A separator (space, dot, or dash) is required between the 3-2-4 groups so bare
+// 9-digit IDs are never mistaken for an SSN.
+const US_SSN_PATTERN = /\b\d{3}[ .-]\d{2}[ .-]\d{4}\b/g
+// A run of >=13 digits optionally grouped by a single space, dot, dash, or
+// slash. This only marks the numeric region; `redactCardInMatch` then looks for
+// the actual card as a run of whole separator-delimited groups that passes Luhn,
+// so an adjacent field such as an expiry (`4111 1111 1111 1111 12/30`) is not
+// absorbed into a failing check that would leak the card.
+const CREDIT_CARD_CANDIDATE_PATTERN = /\b\d(?:[ ./-]?\d){12,}\b/g
+// Matches each separator-delimited digit group inside a card candidate.
+const DIGIT_GROUP_PATTERN = /\d+/g
+// Phone matching is structural rather than "any 10–15 digits", so dates
+// (`2024-01-15 12:30`) and dotted versions are not mistaken for numbers. Two
+// forms: a North-American 3-3-4 grouping, and an international number that must
+// start with `+` and a country code. The area code is either `(415)` (the
+// separator after it is optional, so `(415)555-0142` matches) or a bare `415`
+// that must be followed by a separator (space, dot, dash, or slash) — so a bare
+// digit run is never taken for a phone number.
+const PHONE_NANP_PATTERN = /(?<![\w+])(?:\+?1[ ./-]?)?(?:\(\d{3}\)[ ./-]?|\d{3}[ ./-])\d{3}[ ./-]\d{4}(?![\w])/g
+const PHONE_INTL_PATTERN = /(?<!\w)\+\d{1,3}(?:[ ./()-]{0,2}\d){7,13}(?![\w])/g
+
 type JsonRecord = Record<string, unknown>
 
 function isRecord(value: unknown): value is JsonRecord {
@@ -54,6 +103,86 @@ function sanitizeString(value: string): string {
   return value.replace(POSTHOG_TOKEN_PATTERN, REDACTED_VALUE)
 }
 
+function passesLuhn(digits: string): boolean {
+  let sum = 0
+  let double = false
+  for (let index = digits.length - 1; index >= 0; index--) {
+    let digit = digits.charCodeAt(index) - 48
+    if (digit < 0 || digit > 9) {
+      return false
+    }
+    if (double) {
+      digit *= 2
+      if (digit > 9) {
+        digit -= 9
+      }
+    }
+    sum += digit
+    double = !double
+  }
+  return sum % 10 === 0
+}
+
+// A card candidate can span more than one card plus adjacent fields (e.g. an
+// expiry, or a second card). This redacts every card in it: scanning
+// left-to-right over the whole separator-delimited digit groups, at each start it
+// takes the longest run whose joined digits are 13–19 long and pass Luhn, redacts
+// just that span, and resumes after it; a group that begins no valid run is kept
+// and skipped. Checking group-aligned runs rather than arbitrary digit windows
+// keeps the false-positive rate at Luhn's own ~1-in-10, instead of letting a
+// chance-valid sub-window of an ordinary long ID trigger redaction.
+function redactCardInMatch(match: string): string {
+  const groups: { digits: string; start: number; end: number }[] = []
+  for (let m = DIGIT_GROUP_PATTERN.exec(match); m !== null; m = DIGIT_GROUP_PATTERN.exec(match)) {
+    groups.push({ digits: m[0], start: m.index, end: m.index + m[0].length })
+  }
+  let output = ''
+  let cursor = 0
+  let first = 0
+  while (first < groups.length) {
+    let digits = ''
+    let matchedLast = -1
+    for (let last = first; last < groups.length; last++) {
+      digits += groups[last].digits
+      if (digits.length > 19) {
+        break
+      }
+      if (digits.length >= 13 && passesLuhn(digits)) {
+        matchedLast = last
+      }
+    }
+    if (matchedLast >= 0) {
+      output += match.slice(cursor, groups[first].start) + REDACTED_VALUE
+      cursor = groups[matchedLast].end
+      first = matchedLast + 1
+    } else {
+      first++
+    }
+  }
+  return output + match.slice(cursor)
+}
+
+/**
+ * Redacts structured personal identifiers (emails, IP addresses, credit-card
+ * numbers, US SSNs, and phone numbers) from a free-text string. Intended for the
+ * agent-narrated `$mcp_intent` value only — not for structured tool parameters or
+ * responses, where the same shapes are often legitimate data. Horizontal Unicode
+ * spaces are first normalized to an ASCII space so copy-pasted identifiers still
+ * match. Returns a new string; leaves the input's identifiers untouched when
+ * nothing matches.
+ */
+export function redactPii(value: string): string {
+  let result = value.replace(UNICODE_SPACE_PATTERN, ' ')
+  result = result.replace(EMAIL_PATTERN, REDACTED_VALUE)
+  result = result.replace(IPV4_PATTERN, REDACTED_VALUE)
+  result = result.replace(IPV6_PATTERN, REDACTED_VALUE)
+  result = result.replace(CREDIT_CARD_CANDIDATE_PATTERN, redactCardInMatch)
+  result = result.replace(US_SSN_PATTERN, REDACTED_VALUE)
+  result = result.replace(PHONE_NANP_PATTERN, REDACTED_VALUE)
+  result = result.replace(PHONE_INTL_PATTERN, REDACTED_VALUE)
+  return result
+}
+
 export function sanitizeCapturedValue(value: unknown): unknown {
   if (value == null) {
     return value

package/src/extensions/sanitization.ts

@@ -4,7 +4,7 @@
 // Licensed under the MIT License: https://github.com/agentcathq/agentcat-typescript-sdk/blob/main/LICENSE
 
 import type { ErrorProperties, Event, McpEvent } from '../types'
-import { sanitizeCapturedValue } from './mcp-payloads'
+import { redactPii, sanitizeCapturedValue } from './mcp-payloads'
 
 type SanitizedRecord = Record<string, unknown>
 
@@ -32,11 +32,14 @@ export function sanitizeEvent<T extends Event | McpEvent>(event: T): T {
     result.parameters = sanitizeParameters(result.parameters)
   }
 
-  // The intent comes straight from an agent-narrated `context` string, so it
-  // can contain a secret the LLM read aloud. Redact it like any other captured
-  // value rather than shipping it raw as `$mcp_intent`.
+  // The intent comes straight from an agent-narrated `context` string, so it can
+  // contain a secret the LLM read aloud or personal data it narrated about the
+  // user. Redact it like any other captured value, then strip structured PII
+  // (emails, phone numbers, IPs, cards, SSNs) rather than shipping it raw as
+  // `$mcp_intent`. PII redaction is scoped to the intent only — structured tool
+  // parameters and responses often hold the same shapes as legitimate data.
   if (result.userIntent != null) {
-    result.userIntent = sanitizeCapturedValue(result.userIntent) as string
+    result.userIntent = redactPii(sanitizeCapturedValue(result.userIntent) as string)
   }
 
   if (result.llmModel != null) {

package/src/version.ts

@@ -1 +1 @@
-export const version = '0.13.0'
+export const version = '0.13.1'