@posthog/mcp 0.13.0 → 0.14.0

package/src/extensions/posthog-mcp.ts

@@ -27,9 +27,9 @@ import { applyMcpLibIdentity } from './lib-identity'
 import { log } from './logger'
 import {
   addModelParameterToTool,
-  getModelArgument,
   getModelDescription,
   isCaptureModelEnabled,
+  resolveModel,
   setEventModel,
 } from './model-parameters'
 import { McpEventSink } from './sink'
@@ -48,8 +48,8 @@ export interface PostHogMCPOptions extends PostHogOptions {
    */
   missingCapabilityToolName?: string
   /**
-   * Inject a required `llm_model` argument into advertised tools and capture
-   * the agent's self-reported value. Off by default.
+   * Capture the calling model from recognized client metadata, with an injected
+   * `llm_model` argument as fallback. Off by default.
    */
   captureModel?: MCPAnalyticsOptions['captureModel']
 }
@@ -118,10 +118,7 @@ export class PostHogMCP extends PostHog {
     event.isError = data.isError
     event.errorType = data.errorType
     applyIntent(event, data.intent, data.intentSource)
-    setEventModel(event, data.llmModel)
-    if (event.llmModel && data.llmModelSource) {
-      event.llmModelSource = data.llmModelSource
-    }
+    setEventModel(event, data.llmModel, data.llmModelSource)
     if (data.isError) {
       event.error = captureException(data.error ?? `Tool ${data.toolName} returned an error`)
     }
@@ -234,7 +231,7 @@ export class PostHogMCP extends PostHog {
    * @example
    * ```ts
    * const { intent, intentSource, llmModel, llmModelSource, args, isMissingCapability } =
-   *   posthog.prepareToolCall(name, rawArgs)
+   *   posthog.prepareToolCall(name, rawArgs, { requestMeta: request.params?._meta })
    * if (isMissingCapability) {
    *   posthog.captureMissingCapability({ context: intent, llmModel, llmModelSource, ...identity })
    *   return getMoreToolsResult()
@@ -255,13 +252,15 @@ export class PostHogMCP extends PostHog {
       (options.originalTool
         ? analyticsOwnsParameter(options.originalTool.inputSchema, 'llm_model')
         : this.#modelParameterOwnership.get(name) === true)
-    const llmModel = ownsModel ? getModelArgument({ params: { arguments: args } }) : undefined
+    const resolvedModel = isCaptureModelEnabled(this.#captureModel)
+      ? resolveModel({ params: { arguments: args, _meta: options.requestMeta } }, ownsModel)
+      : undefined
     const strippedArgs = stripContext(args)
     return {
       intent,
       intentSource: intent ? 'context_parameter' : undefined,
-      llmModel,
-      llmModelSource: llmModel ? 'self_reported' : undefined,
+      llmModel: resolvedModel?.model,
+      llmModelSource: resolvedModel?.source,
       args: ownsModel
         ? (stripOwnedAnalyticsArguments(strippedArgs, {
             context: false,
@@ -283,10 +282,7 @@ export class PostHogMCP extends PostHog {
     event.resourceName = this.#missingCapabilityToolName
     event.parameters = data.parameters
     applyIntent(event, data.context, 'context_parameter')
-    setEventModel(event, data.llmModel)
-    if (event.llmModel && data.llmModelSource) {
-      event.llmModelSource = data.llmModelSource
-    }
+    setEventModel(event, data.llmModel, data.llmModelSource)
     this.#emit(event)
   }
 

package/src/extensions/sanitization.ts

@@ -4,7 +4,7 @@
 // Licensed under the MIT License: https://github.com/agentcathq/agentcat-typescript-sdk/blob/main/LICENSE
 
 import type { ErrorProperties, Event, McpEvent } from '../types'
-import { sanitizeCapturedValue } from './mcp-payloads'
+import { redactPii, sanitizeCapturedValue } from './mcp-payloads'
 
 type SanitizedRecord = Record<string, unknown>
 
@@ -32,11 +32,14 @@ export function sanitizeEvent<T extends Event | McpEvent>(event: T): T {
     result.parameters = sanitizeParameters(result.parameters)
   }
 
-  // The intent comes straight from an agent-narrated `context` string, so it
-  // can contain a secret the LLM read aloud. Redact it like any other captured
-  // value rather than shipping it raw as `$mcp_intent`.
+  // The intent comes straight from an agent-narrated `context` string, so it can
+  // contain a secret the LLM read aloud or personal data it narrated about the
+  // user. Redact it like any other captured value, then strip structured PII
+  // (emails, phone numbers, IPs, cards, SSNs) rather than shipping it raw as
+  // `$mcp_intent`. PII redaction is scoped to the intent only — structured tool
+  // parameters and responses often hold the same shapes as legitimate data.
   if (result.userIntent != null) {
-    result.userIntent = sanitizeCapturedValue(result.userIntent) as string
+    result.userIntent = redactPii(sanitizeCapturedValue(result.userIntent) as string)
   }
 
   if (result.llmModel != null) {

package/src/types.ts

@@ -67,6 +67,7 @@ export interface CompatibleTextToolResult {
 }
 
 export interface MCPRequestParamsLike {
+  _meta?: JsonRecord
   arguments?: JsonRecord
   name?: string
   [key: string]: unknown
@@ -130,17 +131,15 @@ export interface MCPAnalyticsOptions {
   /** Inject a required `context` parameter on every tool to capture user intent. */
   context?: boolean | MCPAnalyticsContextOptions
   /**
-   * Inject a required `llm_model` parameter on every tool so the calling agent
-   * self-reports the model it runs as, captured as `$mcp_llm_model` with
-   * `$mcp_llm_model_source = "self_reported"`. Off by default.
+   * Capture the calling model as `$mcp_llm_model`. Recognized client metadata
+   * takes precedence, with an injected `llm_model` parameter as the fallback.
+   * Off by default.
    *
-   * The MCP wire deliberately carries no model identity, so self-report is the
-   * only capture path — harnesses inject the model id into the agent's system
-   * prompt, and agents restate it accurately. Like `clientInfo` in the MCP
-   * spec, the value is unverified: use it for per-model quality analytics, not
-   * billing or security. An honest `"unknown"` from the agent is dropped
-   * rather than captured. Reasoning effort is intentionally not collected —
-   * agents don't reliably know it, so it would only ever be noise.
+   * MCP does not standardize model identity. Some clients expose it through
+   * vendor metadata; other harnesses inject it into the agent's system prompt
+   * so the agent can restate it. `$mcp_llm_model_source` records which path won.
+   * Both paths are unverified: use them for quality analytics, not billing or
+   * security. Missing, blank, and `"unknown"` values are dropped.
    */
   captureModel?: boolean | MCPAnalyticsModelOptions
   /**
@@ -192,7 +191,7 @@ export interface MCPAnalyticsModelOptions {
 
 export type MaybePromise<T> = T | Promise<T>
 export type MCPAnalyticsIntentSource = 'context_parameter' | 'inferred'
-export type MCPAnalyticsModelSource = 'self_reported'
+export type MCPAnalyticsModelSource = 'client_metadata' | 'self_reported'
 
 export type ToolCallback =
   | ((
@@ -245,12 +244,11 @@ export interface Event {
   eventType: MCPAnalyticsEventType
   groups?: Record<string, string>
   /**
-   * The calling agent's self-reported model id → `$mcp_llm_model`. Read off
-   * the SDK-injected `llm_model` argument (`captureModel` option); unverified
-   * by design, like the MCP spec's own `clientInfo`.
+   * The calling model id → `$mcp_llm_model`. Resolved from recognized client
+   * metadata first, then the SDK-injected `llm_model` argument; unverified.
    */
   llmModel?: string
-  /** How the model id was obtained → `$mcp_llm_model_source`. Always `self_reported` today. */
+  /** How the model id was obtained → `$mcp_llm_model_source`. */
   llmModelSource?: MCPAnalyticsModelSource
   /**
    * Explicit PostHog event name. When set (via `capture(server, { event })`) it
@@ -512,8 +510,8 @@ export interface ToolCallCaptureData extends McpCaptureCommon {
    */
   intentSource?: MCPAnalyticsIntentSource
   /**
-   * The calling agent's self-reported model id -> `$mcp_llm_model`. On the
-   * custom-dispatcher path, read it from {@link PostHogMCP.prepareToolCall}.
+   * The calling model id -> `$mcp_llm_model`. On the custom-dispatcher path,
+   * read it from {@link PostHogMCP.prepareToolCall}.
    */
   llmModel?: string
   /** How the model id was obtained -> `$mcp_llm_model_source`. */
@@ -600,6 +598,8 @@ export interface PrepareToolCallOptions {
    * multi-replica servers so SDK argument ownership is resolved per request.
    */
   originalTool?: { inputSchema?: unknown }
+  /** The incoming `tools/call` request's `_meta`, used for recognized client model metadata. */
+  requestMeta?: JsonRecord
 }
 
 /**
@@ -612,9 +612,9 @@ export interface PreparedToolCall {
   intent?: string
   /** Where the intent came from. Always `context_parameter` here when set. */
   intentSource?: MCPAnalyticsIntentSource
-  /** The agent's self-reported model id, when `captureModel` is enabled and owned by the SDK. */
+  /** The calling model id, when `captureModel` is enabled and a supported source provides it. */
   llmModel?: string
-  /** How the model id was obtained. Always `self_reported` when present. */
+  /** How the model id was obtained. */
   llmModelSource?: MCPAnalyticsModelSource
   /** The call arguments with SDK-owned `context` and `llm_model` keys removed. */
   args?: Record<string, unknown>
@@ -629,7 +629,7 @@ export interface MissingCapabilityCaptureData extends McpCaptureCommon {
    * on the `get_more_tools` call) → `$mcp_intent`.
    */
   context?: string
-  /** The calling agent's self-reported model id -> `$mcp_llm_model`. */
+  /** The calling model id -> `$mcp_llm_model`. */
   llmModel?: string
   /** How the model id was obtained -> `$mcp_llm_model_source`. */
   llmModelSource?: MCPAnalyticsModelSource

package/src/version.ts

@@ -1 +1 @@
-export const version = '0.13.0'
+export const version = '0.14.0'