@posthog/mcp 0.21.2 → 0.21.3

package/dist/extensions/feedback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feedback.d.ts","sourceRoot":"","sources":["../../src/extensions/feedback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EAEtB,cAAc,EAGd,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,EACX,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAO,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAG7C,eAAO,MAAM,uBAAuB,EAAG,eAAwB,CAAA;AAsF/D,KAAK,sBAAsB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtE,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,GAAG,SAAS,GACxC,sBAAsB,GAAG,SAAS,CAKpC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,sBAA2B,GAAG,sBAAsB,CA6CtG;AAkCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,OAAO,GAAE,sBAA2B,GACnC,cAAc,CAoBhB;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAElE;AAuCD,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,CAqC/E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CAS7D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,EACpC,MAAM,GAAE,QAAc,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAiBnC"}
+{"version":3,"file":"feedback.d.ts","sourceRoot":"","sources":["../../src/extensions/feedback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EAEtB,cAAc,EAGd,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,EACX,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAO,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAI7C,eAAO,MAAM,uBAAuB,EAAG,eAAwB,CAAA;AAqF/D,KAAK,sBAAsB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtE,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,GAAG,SAAS,GACxC,sBAAsB,GAAG,SAAS,CAKpC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,sBAA2B,GAAG,sBAAsB,CA6CtG;AAkCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,OAAO,GAAE,sBAA2B,GACnC,cAAc,CAoBhB;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAElE;AAuCD,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,CAqC/E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CAS7D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,EACpC,MAAM,GAAE,QAAc,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAiBnC"}

package/dist/extensions/feedback.js

@@ -40,6 +40,7 @@ __webpack_require__.d(__webpack_exports__, {
 const external_constants_js_namespaceObject = require("./constants.js");
 const external_logger_js_namespaceObject = require("./logger.js");
 const external_mcp_payloads_js_namespaceObject = require("./mcp-payloads.js");
+const external_truncation_js_namespaceObject = require("./truncation.js");
 const SEND_FEEDBACK_TOOL_NAME = 'send_feedback';
 const FEEDBACK_TYPES = [
     'missing_capability',
@@ -55,7 +56,6 @@ const SENTIMENTS = [
 ];
 const MAX_FEEDBACK_TEXT_LENGTH = 2048;
 const MAX_FEEDBACK_TOOL_NAME_LENGTH = 256;
-const TRUNCATION_SUFFIX = '...';
 const DEFAULT_FEEDBACK_DESCRIPTION = 'Send feedback about this server to its developers. Most important: report a missing capability whenever no available tool fits your task, even if you can work around it (feedback_type "missing_capability"). Also welcome: a tool that failed or confused you, an unhelpful error, or something that worked well. This records the feedback; it does not add or change tools. Do not include user PII or sensitive content.';
 const CORE_FEEDBACK_SCHEMA_PROPERTIES = {
     feedback_type: {
@@ -179,7 +179,7 @@ function buildFeedbackIntent(report) {
     ].filter(Boolean).join('\n\n');
 }
 function truncateFeedbackText(value, maxLength) {
-    return value.length > maxLength ? value.slice(0, maxLength) + TRUNCATION_SUFFIX : value;
+    return value.length > maxLength ? value.slice(0, maxLength) + external_truncation_js_namespaceObject.TRUNCATION_SUFFIX : value;
 }
 function captureFreeText(value) {
     return truncateFeedbackText((0, external_mcp_payloads_js_namespaceObject.sanitizeFreeText)(value), MAX_FEEDBACK_TEXT_LENGTH);

package/dist/extensions/feedback.mjs

@@ -1,6 +1,7 @@
 import { PostHogMCPAnalyticsProperty } from "./constants.mjs";
 import { log } from "./logger.mjs";
 import { sanitizeFreeText, sanitizeFreeTextValue } from "./mcp-payloads.mjs";
+import { TRUNCATION_SUFFIX } from "./truncation.mjs";
 const SEND_FEEDBACK_TOOL_NAME = 'send_feedback';
 const FEEDBACK_TYPES = [
     'missing_capability',
@@ -16,7 +17,6 @@ const SENTIMENTS = [
 ];
 const MAX_FEEDBACK_TEXT_LENGTH = 2048;
 const MAX_FEEDBACK_TOOL_NAME_LENGTH = 256;
-const TRUNCATION_SUFFIX = '...';
 const DEFAULT_FEEDBACK_DESCRIPTION = 'Send feedback about this server to its developers. Most important: report a missing capability whenever no available tool fits your task, even if you can work around it (feedback_type "missing_capability"). Also welcome: a tool that failed or confused you, an unhelpful error, or something that worked well. This records the feedback; it does not add or change tools. Do not include user PII or sensitive content.';
 const CORE_FEEDBACK_SCHEMA_PROPERTIES = {
     feedback_type: {

package/dist/extensions/mcp-payloads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AAoHA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAyYzC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtD;AA6DD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAyDD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}
+{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AA4HA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AA2azC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtD;AA6DD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAyDD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}

package/dist/extensions/mcp-payloads.js

@@ -27,6 +27,14 @@ var __webpack_require__ = {};
 })();
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    buildCapturedMcpParameters: ()=>buildCapturedMcpParameters,
+    redactPii: ()=>redactPii,
+    sanitizeCapturedValue: ()=>sanitizeCapturedValue,
+    sanitizeFreeText: ()=>sanitizeFreeText,
+    sanitizeFreeTextValue: ()=>sanitizeFreeTextValue
+});
+const external_truncation_js_namespaceObject = require("./truncation.js");
 const CONTEXT_ARGUMENT_NAME = 'context';
 const REDACTED_VALUE = '[redacted]';
 const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]';
@@ -36,9 +44,12 @@ const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/;
 const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i;
 const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
+const SCANNED_HEAD_LENGTH = 4 * external_truncation_js_namespaceObject.MAX_STRING_LENGTH;
+const MIN_REDACTED_HEAD_LENGTH = 2 * external_truncation_js_namespaceObject.MAX_STRING_LENGTH;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
 const URL_PATTERN = /[a-z][a-z0-9+.-]{0,63}:[^\s<>"]+/gi;
+const URL_END_PATTERN = /[\s<>"]/;
 const URL_PATTERN_ONCE = new RegExp(URL_PATTERN.source, 'i');
 const URL_AUTHORITY_SEARCH = /[a-z][a-z0-9+.-]{0,63}:\/\//i;
 const URL_AUTHORITY_PATTERN = new RegExp(`^${URL_AUTHORITY_SEARCH.source}`, 'i');
@@ -156,6 +167,7 @@ function sanitizeFragmentText(text, allowNestedUrls) {
     });
 }
 function findEmbeddedAuthorityIndexes(value) {
+    if (!value.includes('://')) return [];
     const starts = [
         ...value.matchAll(URL_AUTHORITY_SEARCH_ALL)
     ].map((match)=>match.index);
@@ -259,12 +271,24 @@ function redactUrls(value) {
         stripPunctuation: true
     });
 }
+function redactCapturedHead(value, redact) {
+    if (value.length > SCANNED_HEAD_LENGTH) {
+        const head = redact(value.slice(0, headLength(value)));
+        if (head.length >= MIN_REDACTED_HEAD_LENGTH) return head + external_truncation_js_namespaceObject.TRUNCATION_SUFFIX;
+    }
+    return redact(value);
+}
+function headLength(value) {
+    let end = SCANNED_HEAD_LENGTH;
+    while(end > 0 && !URL_END_PATTERN.test(value[end - 1]))end--;
+    return end;
+}
 function sanitizeString(value) {
-    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactUrls(redactCredentials(value));
+    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactCapturedHead(value, (head)=>redactUrls(redactCredentials(head)));
 }
 function sanitizeFreeText(value) {
     if (isBinaryBlob(value)) return BINARY_REDACTED_VALUE;
-    return redactUrls(redactPii(redactCredentials(value)));
+    return redactCapturedHead(value, (head)=>redactUrls(redactPii(redactCredentials(head))));
 }
 function passesLuhn(digits) {
     let sum = 0;
@@ -361,13 +385,6 @@ function buildCapturedMcpParameters(request) {
         request: capturedRequest
     };
 }
-__webpack_require__.d(__webpack_exports__, {
-    buildCapturedMcpParameters: ()=>buildCapturedMcpParameters,
-    redactPii: ()=>redactPii,
-    sanitizeCapturedValue: ()=>sanitizeCapturedValue,
-    sanitizeFreeText: ()=>sanitizeFreeText,
-    sanitizeFreeTextValue: ()=>sanitizeFreeTextValue
-});
 exports.buildCapturedMcpParameters = __webpack_exports__.buildCapturedMcpParameters;
 exports.redactPii = __webpack_exports__.redactPii;
 exports.sanitizeCapturedValue = __webpack_exports__.sanitizeCapturedValue;

package/dist/extensions/mcp-payloads.mjs

@@ -1,3 +1,4 @@
+import { MAX_STRING_LENGTH, TRUNCATION_SUFFIX } from "./truncation.mjs";
 const CONTEXT_ARGUMENT_NAME = 'context';
 const REDACTED_VALUE = '[redacted]';
 const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]';
@@ -7,9 +8,12 @@ const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/;
 const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i;
 const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
+const SCANNED_HEAD_LENGTH = 4 * MAX_STRING_LENGTH;
+const MIN_REDACTED_HEAD_LENGTH = 2 * MAX_STRING_LENGTH;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
 const URL_PATTERN = /[a-z][a-z0-9+.-]{0,63}:[^\s<>"]+/gi;
+const URL_END_PATTERN = /[\s<>"]/;
 const URL_PATTERN_ONCE = new RegExp(URL_PATTERN.source, 'i');
 const URL_AUTHORITY_SEARCH = /[a-z][a-z0-9+.-]{0,63}:\/\//i;
 const URL_AUTHORITY_PATTERN = new RegExp(`^${URL_AUTHORITY_SEARCH.source}`, 'i');
@@ -127,6 +131,7 @@ function sanitizeFragmentText(text, allowNestedUrls) {
     });
 }
 function findEmbeddedAuthorityIndexes(value) {
+    if (!value.includes('://')) return [];
     const starts = [
         ...value.matchAll(URL_AUTHORITY_SEARCH_ALL)
     ].map((match)=>match.index);
@@ -230,12 +235,24 @@ function redactUrls(value) {
         stripPunctuation: true
     });
 }
+function redactCapturedHead(value, redact) {
+    if (value.length > SCANNED_HEAD_LENGTH) {
+        const head = redact(value.slice(0, headLength(value)));
+        if (head.length >= MIN_REDACTED_HEAD_LENGTH) return head + TRUNCATION_SUFFIX;
+    }
+    return redact(value);
+}
+function headLength(value) {
+    let end = SCANNED_HEAD_LENGTH;
+    while(end > 0 && !URL_END_PATTERN.test(value[end - 1]))end--;
+    return end;
+}
 function sanitizeString(value) {
-    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactUrls(redactCredentials(value));
+    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactCapturedHead(value, (head)=>redactUrls(redactCredentials(head)));
 }
 function sanitizeFreeText(value) {
     if (isBinaryBlob(value)) return BINARY_REDACTED_VALUE;
-    return redactUrls(redactPii(redactCredentials(value)));
+    return redactCapturedHead(value, (head)=>redactUrls(redactPii(redactCredentials(head))));
 }
 function passesLuhn(digits) {
     let sum = 0;

package/dist/extensions/truncation.d.ts

@@ -3,6 +3,7 @@ export declare const MAX_DEPTH = 10;
 export declare const MAX_BREADTH = 100;
 export declare const MAX_STRING_LENGTH = 32768;
 export declare const MAX_EVENT_BYTES = 102400;
+export declare const TRUNCATION_SUFFIX = "...";
 /**
  * Recursively normalizes a value, handling:
  * - String truncation (> MAX_STRING_LENGTH)

package/dist/extensions/truncation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"truncation.d.ts","sourceRoot":"","sources":["../../src/extensions/truncation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAc,QAAQ,EAAE,MAAM,UAAU,CAAA;AAG5E,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,iBAAiB,QAAS,CAAA;AACvC,eAAO,MAAM,eAAe,SAAU,CAAA;AAgBtC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,MAAkB,EACzB,UAAU,GAAE,MAAoB,EAChC,eAAe,GAAE,MAA0B,GAC1C,OAAO,CAGT;AAqXD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2CrE"}
+{"version":3,"file":"truncation.d.ts","sourceRoot":"","sources":["../../src/extensions/truncation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAc,QAAQ,EAAE,MAAM,UAAU,CAAA;AAG5E,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,iBAAiB,QAAS,CAAA;AACvC,eAAO,MAAM,eAAe,SAAU,CAAA;AAWtC,eAAO,MAAM,iBAAiB,QAAQ,CAAA;AAKtC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,MAAkB,EACzB,UAAU,GAAE,MAAoB,EAChC,eAAe,GAAE,MAA0B,GAC1C,OAAO,CAGT;AAqXD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2CrE"}

package/dist/extensions/truncation.js

@@ -266,12 +266,14 @@ __webpack_require__.d(__webpack_exports__, {
     MAX_BREADTH: MAX_BREADTH,
     MAX_DEPTH: MAX_DEPTH,
     MAX_EVENT_BYTES: MAX_EVENT_BYTES,
-    MAX_STRING_LENGTH: MAX_STRING_LENGTH
+    MAX_STRING_LENGTH: MAX_STRING_LENGTH,
+    TRUNCATION_SUFFIX: TRUNCATION_SUFFIX
 });
 exports.MAX_BREADTH = __webpack_exports__.MAX_BREADTH;
 exports.MAX_DEPTH = __webpack_exports__.MAX_DEPTH;
 exports.MAX_EVENT_BYTES = __webpack_exports__.MAX_EVENT_BYTES;
 exports.MAX_STRING_LENGTH = __webpack_exports__.MAX_STRING_LENGTH;
+exports.TRUNCATION_SUFFIX = __webpack_exports__.TRUNCATION_SUFFIX;
 exports.normalize = __webpack_exports__.normalize;
 exports.truncateEvent = __webpack_exports__.truncateEvent;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
@@ -279,6 +281,7 @@ for(var __rspack_i in __webpack_exports__)if (-1 === [
     "MAX_DEPTH",
     "MAX_EVENT_BYTES",
     "MAX_STRING_LENGTH",
+    "TRUNCATION_SUFFIX",
     "normalize",
     "truncateEvent"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];

package/dist/extensions/truncation.mjs

@@ -230,4 +230,4 @@ function truncateEvent(event) {
     if (null != result.error) result.error = normalize(result.error);
     return truncateToSize(result);
 }
-export { MAX_BREADTH, MAX_DEPTH, MAX_EVENT_BYTES, MAX_STRING_LENGTH, normalize, truncateEvent };
+export { MAX_BREADTH, MAX_DEPTH, MAX_EVENT_BYTES, MAX_STRING_LENGTH, TRUNCATION_SUFFIX, normalize, truncateEvent };

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.21.2";
+export declare const version = "0.21.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -27,7 +27,7 @@ var __webpack_require__ = {};
 })();
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
-const version = "0.21.2";
+const version = "0.21.3";
 __webpack_require__.d(__webpack_exports__, {}, {
     version: version
 });

package/dist/version.mjs

@@ -1,2 +1,2 @@
-const version = "0.21.2";
+const version = "0.21.3";
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/mcp",
-  "version": "0.21.2",
+  "version": "0.21.3",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -28,7 +28,7 @@
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@posthog/core": "^1.55.2"
+    "@posthog/core": "^1.55.3"
   },
   "devDependencies": {
     "@babel/preset-env": "^7.27.1",

package/src/extensions/feedback.ts

@@ -12,6 +12,7 @@ import type {
 import { PostHogMCPAnalyticsProperty } from './constants'
 import { log, type LoggerFn } from './logger'
 import { sanitizeFreeText, sanitizeFreeTextValue } from './mcp-payloads'
+import { TRUNCATION_SUFFIX } from './truncation'
 
 export const SEND_FEEDBACK_TOOL_NAME = 'send_feedback' as const
 
@@ -21,7 +22,6 @@ const SENTIMENTS: readonly FeedbackSentiment[] = ['positive', 'neutral', 'negati
 // Free-text fields are agent-narrated, like `$mcp_intent`; bound them the same way.
 const MAX_FEEDBACK_TEXT_LENGTH = 2048
 const MAX_FEEDBACK_TOOL_NAME_LENGTH = 256
-const TRUNCATION_SUFFIX = '...'
 
 const DEFAULT_FEEDBACK_DESCRIPTION =
   'Send feedback about this server to its developers. Most important: report a missing capability whenever no ' +

package/src/extensions/mcp-payloads.ts

@@ -3,6 +3,8 @@
 // Copyright (c) 2025 AgentCat, Inc. (formerly MCPcat)
 // Licensed under the MIT License: https://github.com/agentcathq/agentcat-typescript-sdk/blob/main/LICENSE
 
+import { MAX_STRING_LENGTH, TRUNCATION_SUFFIX } from './truncation'
+
 const CONTEXT_ARGUMENT_NAME = 'context'
 const REDACTED_VALUE = '[redacted]'
 const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]'
@@ -12,6 +14,10 @@ const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/
 const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i
 const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/
 const SIZE_GATE = 10_240
+const SCANNED_HEAD_LENGTH = 4 * MAX_STRING_LENGTH
+// Twice what truncation keeps, so a match split where the head was cut sits past
+// the part truncation keeps.
+const MIN_REDACTED_HEAD_LENGTH = 2 * MAX_STRING_LENGTH
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g
 const SENSITIVE_KEY_PATTERN =
   /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i
@@ -33,6 +39,8 @@ const SENSITIVE_KEY_PATTERN =
 // harmless: a match with nothing to redact is returned byte-for-byte, so the
 // text around it is never rewritten.
 const URL_PATTERN = /[a-z][a-z0-9+.-]{0,63}:[^\s<>"]+/gi
+// A character no URL match can contain, so a cut just after one splits no URL.
+const URL_END_PATTERN = /[\s<>"]/
 /** The same pattern without `g`, for asking whether a value holds a URL at all. */
 const URL_PATTERN_ONCE = new RegExp(URL_PATTERN.source, 'i')
 /** Finds the first scheme that brings a real authority, i.e. what the pattern required before it went authority-less. */
@@ -315,6 +323,11 @@ function sanitizeFragmentText(text: string, allowNestedUrls: boolean): string {
  * addresses together, because every one of them scanned back to the same `?`.
  */
 function findEmbeddedAuthorityIndexes(value: string): number[] {
+  // The search tries up to 64 scheme characters at every position, which a long
+  // base64 `data:` URI turns into seconds; without `://` it cannot match at all.
+  if (!value.includes('://')) {
+    return []
+  }
   const starts = [...value.matchAll(URL_AUTHORITY_SEARCH_ALL)].map((match) => match.index)
   const indexes: number[] = []
   const delimiters = { query: false, fragment: false, fragmentQuery: false }
@@ -503,8 +516,37 @@ function redactUrls(value: string): string {
   return sanitizeUrlsInString(value, { allowNestedUrls: true, stripPunctuation: true })
 }
 
+/**
+ * Runs `redact` over only the head of `value` that truncation can keep, so a
+ * multi-megabyte tool result costs about the same as the part captured. The head
+ * ends where no URL crosses it, because a URL is redacted or kept on the whole
+ * address. Redaction shrinks text, so a head that ends up too short to cover
+ * truncation's cut falls back to the whole string. Either way the kept part
+ * reads exactly as if the whole string were redacted.
+ */
+function redactCapturedHead(value: string, redact: (value: string) => string): string {
+  if (value.length > SCANNED_HEAD_LENGTH) {
+    const head = redact(value.slice(0, headLength(value)))
+    if (head.length >= MIN_REDACTED_HEAD_LENGTH) {
+      return head + TRUNCATION_SUFFIX
+    }
+  }
+  return redact(value)
+}
+
+/** The scanned head, shortened to end just after the last character that ends a URL. */
+function headLength(value: string): number {
+  let end = SCANNED_HEAD_LENGTH
+  while (end > 0 && !URL_END_PATTERN.test(value[end - 1])) {
+    end--
+  }
+  return end
+}
+
 function sanitizeString(value: string): string {
-  return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactUrls(redactCredentials(value))
+  return isBinaryBlob(value)
+    ? BINARY_REDACTED_VALUE
+    : redactCapturedHead(value, (head) => redactUrls(redactCredentials(head)))
 }
 
 /**
@@ -523,7 +565,7 @@ export function sanitizeFreeText(value: string): string {
   if (isBinaryBlob(value)) {
     return BINARY_REDACTED_VALUE
   }
-  return redactUrls(redactPii(redactCredentials(value)))
+  return redactCapturedHead(value, (head) => redactUrls(redactPii(redactCredentials(head))))
 }
 
 function passesLuhn(digits: string): boolean {

package/src/extensions/truncation.ts

@@ -20,7 +20,7 @@ const MAX_STACK_FRAMES = 50
 const MAX_CONTENT_TEXT_LENGTH = 32_768
 
 // --- Truncation markers ---
-const TRUNCATION_SUFFIX = '...'
+export const TRUNCATION_SUFFIX = '...'
 
 type MutableEvent = Partial<Event | McpEvent> & Record<string, unknown>
 type MutableRecord = Record<string, unknown>

package/src/version.ts

@@ -1 +1 @@
-export const version = "0.21.2"
+export const version = "0.21.3"