@posthog/mcp 0.21.2 → 0.21.4

package/dist/extensions/feedback.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feedback.d.ts","sourceRoot":"","sources":["../../src/extensions/feedback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EAEtB,cAAc,EAGd,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,EACX,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAO,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAG7C,eAAO,MAAM,uBAAuB,EAAG,eAAwB,CAAA;AAsF/D,KAAK,sBAAsB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtE,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,GAAG,SAAS,GACxC,sBAAsB,GAAG,SAAS,CAKpC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,sBAA2B,GAAG,sBAAsB,CA6CtG;AAkCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,OAAO,GAAE,sBAA2B,GACnC,cAAc,CAoBhB;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAElE;AAuCD,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,CAqC/E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CAS7D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,EACpC,MAAM,GAAE,QAAc,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAiBnC"}
+{"version":3,"file":"feedback.d.ts","sourceRoot":"","sources":["../../src/extensions/feedback.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EAEtB,cAAc,EAGd,qBAAqB,EACrB,wBAAwB,EACxB,uBAAuB,EACvB,UAAU,EACX,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAO,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAA;AAI7C,eAAO,MAAM,uBAAuB,EAAG,eAAwB,CAAA;AAqF/D,KAAK,sBAAsB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtE,4FAA4F;AAC5F,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,qBAAqB,GAAG,SAAS,GACxC,sBAAsB,GAAG,SAAS,CAKpC;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,GAAE,sBAA2B,GAAG,sBAAsB,CA6CtG;AAkCD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,OAAO,GAAE,sBAA2B,GACnC,cAAc,CAoBhB;AAED,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,cAAc,GAAG,MAAM,CAElE;AAuCD,uFAAuF;AACvF,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,cAAc,GAAG,UAAU,CAqC/E;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,wBAAwB,CAS7D;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,GAAE,sBAA2B,EACpC,MAAM,GAAE,QAAc,GACrB,OAAO,CAAC,wBAAwB,CAAC,CAiBnC"}

package/dist/extensions/feedback.js

@@ -40,6 +40,7 @@ __webpack_require__.d(__webpack_exports__, {
 const external_constants_js_namespaceObject = require("./constants.js");
 const external_logger_js_namespaceObject = require("./logger.js");
 const external_mcp_payloads_js_namespaceObject = require("./mcp-payloads.js");
+const external_truncation_js_namespaceObject = require("./truncation.js");
 const SEND_FEEDBACK_TOOL_NAME = 'send_feedback';
 const FEEDBACK_TYPES = [
     'missing_capability',
@@ -55,7 +56,6 @@ const SENTIMENTS = [
 ];
 const MAX_FEEDBACK_TEXT_LENGTH = 2048;
 const MAX_FEEDBACK_TOOL_NAME_LENGTH = 256;
-const TRUNCATION_SUFFIX = '...';
 const DEFAULT_FEEDBACK_DESCRIPTION = 'Send feedback about this server to its developers. Most important: report a missing capability whenever no available tool fits your task, even if you can work around it (feedback_type "missing_capability"). Also welcome: a tool that failed or confused you, an unhelpful error, or something that worked well. This records the feedback; it does not add or change tools. Do not include user PII or sensitive content.';
 const CORE_FEEDBACK_SCHEMA_PROPERTIES = {
     feedback_type: {
@@ -179,7 +179,7 @@ function buildFeedbackIntent(report) {
     ].filter(Boolean).join('\n\n');
 }
 function truncateFeedbackText(value, maxLength) {
-    return value.length > maxLength ? value.slice(0, maxLength) + TRUNCATION_SUFFIX : value;
+    return value.length > maxLength ? value.slice(0, maxLength) + external_truncation_js_namespaceObject.TRUNCATION_SUFFIX : value;
 }
 function captureFreeText(value) {
     return truncateFeedbackText((0, external_mcp_payloads_js_namespaceObject.sanitizeFreeText)(value), MAX_FEEDBACK_TEXT_LENGTH);

package/dist/extensions/feedback.mjs

@@ -1,6 +1,7 @@
 import { PostHogMCPAnalyticsProperty } from "./constants.mjs";
 import { log } from "./logger.mjs";
 import { sanitizeFreeText, sanitizeFreeTextValue } from "./mcp-payloads.mjs";
+import { TRUNCATION_SUFFIX } from "./truncation.mjs";
 const SEND_FEEDBACK_TOOL_NAME = 'send_feedback';
 const FEEDBACK_TYPES = [
     'missing_capability',
@@ -16,7 +17,6 @@ const SENTIMENTS = [
 ];
 const MAX_FEEDBACK_TEXT_LENGTH = 2048;
 const MAX_FEEDBACK_TOOL_NAME_LENGTH = 256;
-const TRUNCATION_SUFFIX = '...';
 const DEFAULT_FEEDBACK_DESCRIPTION = 'Send feedback about this server to its developers. Most important: report a missing capability whenever no available tool fits your task, even if you can work around it (feedback_type "missing_capability"). Also welcome: a tool that failed or confused you, an unhelpful error, or something that worked well. This records the feedback; it does not add or change tools. Do not include user PII or sensitive content.';
 const CORE_FEEDBACK_SCHEMA_PROPERTIES = {
     feedback_type: {

package/dist/extensions/mcp-payloads.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AAoHA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAyYzC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtD;AA6DD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAyDD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}
+{"version":3,"file":"mcp-payloads.d.ts","sourceRoot":"","sources":["../../src/extensions/mcp-payloads.ts"],"names":[],"mappings":"AA4HA,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AA2azC;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKtD;AA6DD;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7D;AAyDD,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,UAAU,CAiBvE"}

package/dist/extensions/mcp-payloads.js

@@ -27,6 +27,14 @@ var __webpack_require__ = {};
 })();
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
+__webpack_require__.d(__webpack_exports__, {
+    buildCapturedMcpParameters: ()=>buildCapturedMcpParameters,
+    redactPii: ()=>redactPii,
+    sanitizeCapturedValue: ()=>sanitizeCapturedValue,
+    sanitizeFreeText: ()=>sanitizeFreeText,
+    sanitizeFreeTextValue: ()=>sanitizeFreeTextValue
+});
+const external_truncation_js_namespaceObject = require("./truncation.js");
 const CONTEXT_ARGUMENT_NAME = 'context';
 const REDACTED_VALUE = '[redacted]';
 const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]';
@@ -36,9 +44,12 @@ const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/;
 const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i;
 const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
+const SCANNED_HEAD_LENGTH = 4 * external_truncation_js_namespaceObject.MAX_STRING_LENGTH;
+const MIN_REDACTED_HEAD_LENGTH = 2 * external_truncation_js_namespaceObject.MAX_STRING_LENGTH;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
 const URL_PATTERN = /[a-z][a-z0-9+.-]{0,63}:[^\s<>"]+/gi;
+const URL_END_PATTERN = /[\s<>"]/;
 const URL_PATTERN_ONCE = new RegExp(URL_PATTERN.source, 'i');
 const URL_AUTHORITY_SEARCH = /[a-z][a-z0-9+.-]{0,63}:\/\//i;
 const URL_AUTHORITY_PATTERN = new RegExp(`^${URL_AUTHORITY_SEARCH.source}`, 'i');
@@ -156,6 +167,7 @@ function sanitizeFragmentText(text, allowNestedUrls) {
     });
 }
 function findEmbeddedAuthorityIndexes(value) {
+    if (!value.includes('://')) return [];
     const starts = [
         ...value.matchAll(URL_AUTHORITY_SEARCH_ALL)
     ].map((match)=>match.index);
@@ -259,12 +271,24 @@ function redactUrls(value) {
         stripPunctuation: true
     });
 }
+function redactCapturedHead(value, redact) {
+    if (value.length > SCANNED_HEAD_LENGTH) {
+        const head = redact(value.slice(0, headLength(value)));
+        if (head.length >= MIN_REDACTED_HEAD_LENGTH) return head + external_truncation_js_namespaceObject.TRUNCATION_SUFFIX;
+    }
+    return redact(value);
+}
+function headLength(value) {
+    let end = SCANNED_HEAD_LENGTH;
+    while(end > 0 && !URL_END_PATTERN.test(value[end - 1]))end--;
+    return end;
+}
 function sanitizeString(value) {
-    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactUrls(redactCredentials(value));
+    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactCapturedHead(value, (head)=>redactUrls(redactCredentials(head)));
 }
 function sanitizeFreeText(value) {
     if (isBinaryBlob(value)) return BINARY_REDACTED_VALUE;
-    return redactUrls(redactPii(redactCredentials(value)));
+    return redactCapturedHead(value, (head)=>redactUrls(redactPii(redactCredentials(head))));
 }
 function passesLuhn(digits) {
     let sum = 0;
@@ -361,13 +385,6 @@ function buildCapturedMcpParameters(request) {
         request: capturedRequest
     };
 }
-__webpack_require__.d(__webpack_exports__, {
-    buildCapturedMcpParameters: ()=>buildCapturedMcpParameters,
-    redactPii: ()=>redactPii,
-    sanitizeCapturedValue: ()=>sanitizeCapturedValue,
-    sanitizeFreeText: ()=>sanitizeFreeText,
-    sanitizeFreeTextValue: ()=>sanitizeFreeTextValue
-});
 exports.buildCapturedMcpParameters = __webpack_exports__.buildCapturedMcpParameters;
 exports.redactPii = __webpack_exports__.redactPii;
 exports.sanitizeCapturedValue = __webpack_exports__.sanitizeCapturedValue;

package/dist/extensions/mcp-payloads.mjs

@@ -1,3 +1,4 @@
+import { MAX_STRING_LENGTH, TRUNCATION_SUFFIX } from "./truncation.mjs";
 const CONTEXT_ARGUMENT_NAME = 'context';
 const REDACTED_VALUE = '[redacted]';
 const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]';
@@ -7,9 +8,12 @@ const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/;
 const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i;
 const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/;
 const SIZE_GATE = 10240;
+const SCANNED_HEAD_LENGTH = 4 * MAX_STRING_LENGTH;
+const MIN_REDACTED_HEAD_LENGTH = 2 * MAX_STRING_LENGTH;
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g;
 const SENSITIVE_KEY_PATTERN = /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i;
 const URL_PATTERN = /[a-z][a-z0-9+.-]{0,63}:[^\s<>"]+/gi;
+const URL_END_PATTERN = /[\s<>"]/;
 const URL_PATTERN_ONCE = new RegExp(URL_PATTERN.source, 'i');
 const URL_AUTHORITY_SEARCH = /[a-z][a-z0-9+.-]{0,63}:\/\//i;
 const URL_AUTHORITY_PATTERN = new RegExp(`^${URL_AUTHORITY_SEARCH.source}`, 'i');
@@ -127,6 +131,7 @@ function sanitizeFragmentText(text, allowNestedUrls) {
     });
 }
 function findEmbeddedAuthorityIndexes(value) {
+    if (!value.includes('://')) return [];
     const starts = [
         ...value.matchAll(URL_AUTHORITY_SEARCH_ALL)
     ].map((match)=>match.index);
@@ -230,12 +235,24 @@ function redactUrls(value) {
         stripPunctuation: true
     });
 }
+function redactCapturedHead(value, redact) {
+    if (value.length > SCANNED_HEAD_LENGTH) {
+        const head = redact(value.slice(0, headLength(value)));
+        if (head.length >= MIN_REDACTED_HEAD_LENGTH) return head + TRUNCATION_SUFFIX;
+    }
+    return redact(value);
+}
+function headLength(value) {
+    let end = SCANNED_HEAD_LENGTH;
+    while(end > 0 && !URL_END_PATTERN.test(value[end - 1]))end--;
+    return end;
+}
 function sanitizeString(value) {
-    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactUrls(redactCredentials(value));
+    return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactCapturedHead(value, (head)=>redactUrls(redactCredentials(head)));
 }
 function sanitizeFreeText(value) {
     if (isBinaryBlob(value)) return BINARY_REDACTED_VALUE;
-    return redactUrls(redactPii(redactCredentials(value)));
+    return redactCapturedHead(value, (head)=>redactUrls(redactPii(redactCredentials(head))));
 }
 function passesLuhn(digits) {
     let sum = 0;

package/dist/extensions/truncation.d.ts

@@ -3,6 +3,7 @@ export declare const MAX_DEPTH = 10;
 export declare const MAX_BREADTH = 100;
 export declare const MAX_STRING_LENGTH = 32768;
 export declare const MAX_EVENT_BYTES = 102400;
+export declare const TRUNCATION_SUFFIX = "...";
 /**
  * Recursively normalizes a value, handling:
  * - String truncation (> MAX_STRING_LENGTH)

package/dist/extensions/truncation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"truncation.d.ts","sourceRoot":"","sources":["../../src/extensions/truncation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAc,QAAQ,EAAE,MAAM,UAAU,CAAA;AAG5E,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,iBAAiB,QAAS,CAAA;AACvC,eAAO,MAAM,eAAe,SAAU,CAAA;AAgBtC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,MAAkB,EACzB,UAAU,GAAE,MAAoB,EAChC,eAAe,GAAE,MAA0B,GAC1C,OAAO,CAGT;AAqXD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2CrE"}
+{"version":3,"file":"truncation.d.ts","sourceRoot":"","sources":["../../src/extensions/truncation.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAmB,KAAK,EAAc,QAAQ,EAAE,MAAM,UAAU,CAAA;AAG5E,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,eAAO,MAAM,iBAAiB,QAAS,CAAA;AACvC,eAAO,MAAM,eAAe,SAAU,CAAA;AAWtC,eAAO,MAAM,iBAAiB,QAAQ,CAAA;AAKtC;;;;;;;;GAQG;AACH,wBAAgB,SAAS,CACvB,KAAK,EAAE,OAAO,EACd,KAAK,GAAE,MAAkB,EACzB,UAAU,GAAE,MAAoB,EAChC,eAAe,GAAE,MAA0B,GAC1C,OAAO,CAGT;AA+XD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS,KAAK,GAAG,QAAQ,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CA2CrE"}

package/dist/extensions/truncation.js

@@ -216,26 +216,38 @@ function setNestedValue(obj, path, value) {
     const finalKey = path.at(-1);
     if (void 0 !== finalKey && null != current && 'object' == typeof current) current[finalKey] = value;
 }
+const REDUCIBLE_FIELDS = [
+    'parameters',
+    'response',
+    'identifyActorData',
+    'error'
+];
 function truncateToSize(event) {
     if (jsonByteSize(event) <= MAX_EVENT_BYTES) return event;
-    for(let depth = MAX_DEPTH - 1; depth >= 1; depth--){
-        const reduced = {
-            ...event
-        };
-        if (null != reduced.parameters) reduced.parameters = normalize(reduced.parameters, depth);
-        if (null != reduced.response) reduced.response = normalize(reduced.response, depth);
-        if (null != reduced.identifyActorData) reduced.identifyActorData = normalize(reduced.identifyActorData, depth);
-        if (null != reduced.error) reduced.error = normalize(reduced.error, depth);
+    const nesting = Math.max(...REDUCIBLE_FIELDS.map((field)=>nestingDepth(event[field])));
+    let atDepthOne;
+    for(let depth = nesting - 1; depth >= 1; depth--){
+        const reduced = normalizeReducibleFields(event, depth);
         if (jsonByteSize(reduced) <= MAX_EVENT_BYTES) return reduced;
+        if (1 === depth) atDepthOne = reduced;
+    }
+    return truncateLargestFields(atDepthOne ?? normalizeReducibleFields(event, 1), MAX_EVENT_BYTES);
+}
+function nestingDepth(value, limit = MAX_DEPTH) {
+    if (0 === limit || null === value || 'object' != typeof value) return 0;
+    let deepest = 0;
+    for (const item of Array.isArray(value) ? value : Object.values(value)){
+        deepest = Math.max(deepest, nestingDepth(item, limit - 1));
+        if (deepest === limit - 1) break;
     }
-    const minimal = {
+    return deepest + 1;
+}
+function normalizeReducibleFields(event, depth) {
+    const reduced = {
         ...event
     };
-    if (null != minimal.parameters) minimal.parameters = normalize(minimal.parameters, 1);
-    if (null != minimal.response) minimal.response = normalize(minimal.response, 1);
-    if (null != minimal.identifyActorData) minimal.identifyActorData = normalize(minimal.identifyActorData, 1);
-    if (null != minimal.error) minimal.error = normalize(minimal.error, 1);
-    return truncateLargestFields(minimal, MAX_EVENT_BYTES);
+    for (const field of REDUCIBLE_FIELDS)if (null != reduced[field]) reduced[field] = normalize(reduced[field], depth);
+    return reduced;
 }
 function truncateEvent(event) {
     const result = {
@@ -266,12 +278,14 @@ __webpack_require__.d(__webpack_exports__, {
     MAX_BREADTH: MAX_BREADTH,
     MAX_DEPTH: MAX_DEPTH,
     MAX_EVENT_BYTES: MAX_EVENT_BYTES,
-    MAX_STRING_LENGTH: MAX_STRING_LENGTH
+    MAX_STRING_LENGTH: MAX_STRING_LENGTH,
+    TRUNCATION_SUFFIX: TRUNCATION_SUFFIX
 });
 exports.MAX_BREADTH = __webpack_exports__.MAX_BREADTH;
 exports.MAX_DEPTH = __webpack_exports__.MAX_DEPTH;
 exports.MAX_EVENT_BYTES = __webpack_exports__.MAX_EVENT_BYTES;
 exports.MAX_STRING_LENGTH = __webpack_exports__.MAX_STRING_LENGTH;
+exports.TRUNCATION_SUFFIX = __webpack_exports__.TRUNCATION_SUFFIX;
 exports.normalize = __webpack_exports__.normalize;
 exports.truncateEvent = __webpack_exports__.truncateEvent;
 for(var __rspack_i in __webpack_exports__)if (-1 === [
@@ -279,6 +293,7 @@ for(var __rspack_i in __webpack_exports__)if (-1 === [
     "MAX_DEPTH",
     "MAX_EVENT_BYTES",
     "MAX_STRING_LENGTH",
+    "TRUNCATION_SUFFIX",
     "normalize",
     "truncateEvent"
 ].indexOf(__rspack_i)) exports[__rspack_i] = __webpack_exports__[__rspack_i];

package/dist/extensions/truncation.mjs

@@ -187,26 +187,38 @@ function setNestedValue(obj, path, value) {
     const finalKey = path.at(-1);
     if (void 0 !== finalKey && null != current && 'object' == typeof current) current[finalKey] = value;
 }
+const REDUCIBLE_FIELDS = [
+    'parameters',
+    'response',
+    'identifyActorData',
+    'error'
+];
 function truncateToSize(event) {
     if (jsonByteSize(event) <= MAX_EVENT_BYTES) return event;
-    for(let depth = MAX_DEPTH - 1; depth >= 1; depth--){
-        const reduced = {
-            ...event
-        };
-        if (null != reduced.parameters) reduced.parameters = normalize(reduced.parameters, depth);
-        if (null != reduced.response) reduced.response = normalize(reduced.response, depth);
-        if (null != reduced.identifyActorData) reduced.identifyActorData = normalize(reduced.identifyActorData, depth);
-        if (null != reduced.error) reduced.error = normalize(reduced.error, depth);
+    const nesting = Math.max(...REDUCIBLE_FIELDS.map((field)=>nestingDepth(event[field])));
+    let atDepthOne;
+    for(let depth = nesting - 1; depth >= 1; depth--){
+        const reduced = normalizeReducibleFields(event, depth);
         if (jsonByteSize(reduced) <= MAX_EVENT_BYTES) return reduced;
+        if (1 === depth) atDepthOne = reduced;
+    }
+    return truncateLargestFields(atDepthOne ?? normalizeReducibleFields(event, 1), MAX_EVENT_BYTES);
+}
+function nestingDepth(value, limit = MAX_DEPTH) {
+    if (0 === limit || null === value || 'object' != typeof value) return 0;
+    let deepest = 0;
+    for (const item of Array.isArray(value) ? value : Object.values(value)){
+        deepest = Math.max(deepest, nestingDepth(item, limit - 1));
+        if (deepest === limit - 1) break;
     }
-    const minimal = {
+    return deepest + 1;
+}
+function normalizeReducibleFields(event, depth) {
+    const reduced = {
         ...event
     };
-    if (null != minimal.parameters) minimal.parameters = normalize(minimal.parameters, 1);
-    if (null != minimal.response) minimal.response = normalize(minimal.response, 1);
-    if (null != minimal.identifyActorData) minimal.identifyActorData = normalize(minimal.identifyActorData, 1);
-    if (null != minimal.error) minimal.error = normalize(minimal.error, 1);
-    return truncateLargestFields(minimal, MAX_EVENT_BYTES);
+    for (const field of REDUCIBLE_FIELDS)if (null != reduced[field]) reduced[field] = normalize(reduced[field], depth);
+    return reduced;
 }
 function truncateEvent(event) {
     const result = {
@@ -230,4 +242,4 @@ function truncateEvent(event) {
     if (null != result.error) result.error = normalize(result.error);
     return truncateToSize(result);
 }
-export { MAX_BREADTH, MAX_DEPTH, MAX_EVENT_BYTES, MAX_STRING_LENGTH, normalize, truncateEvent };
+export { MAX_BREADTH, MAX_DEPTH, MAX_EVENT_BYTES, MAX_STRING_LENGTH, TRUNCATION_SUFFIX, normalize, truncateEvent };

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const version = "0.21.2";
+export declare const version = "0.21.4";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -27,7 +27,7 @@ var __webpack_require__ = {};
 })();
 var __webpack_exports__ = {};
 __webpack_require__.r(__webpack_exports__);
-const version = "0.21.2";
+const version = "0.21.4";
 __webpack_require__.d(__webpack_exports__, {}, {
     version: version
 });

package/dist/version.mjs

@@ -1,2 +1,2 @@
-const version = "0.21.2";
+const version = "0.21.4";
 export { version };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@posthog/mcp",
-  "version": "0.21.2",
+  "version": "0.21.4",
   "bugs": {
     "url": "https://github.com/PostHog/posthog-js/issues"
   },
@@ -28,7 +28,7 @@
   "module": "dist/index.mjs",
   "types": "dist/index.d.ts",
   "dependencies": {
-    "@posthog/core": "^1.55.2"
+    "@posthog/core": "^1.55.3"
   },
   "devDependencies": {
     "@babel/preset-env": "^7.27.1",
@@ -53,8 +53,8 @@
     "zod4": "npm:zod@^4.4.3",
     "@vitest/coverage-v8": "^1.6.1",
     "vitest": "^1.6.1",
-    "@posthog-tooling/tsconfig-base": "1.1.1",
-    "posthog-node": "^5.55.0"
+    "posthog-node": "^5.55.0",
+    "@posthog-tooling/tsconfig-base": "1.1.1"
   },
   "peerDependencies": {
     "@modelcontextprotocol/sdk": ">=1.26.0",

package/src/extensions/feedback.ts

@@ -12,6 +12,7 @@ import type {
 import { PostHogMCPAnalyticsProperty } from './constants'
 import { log, type LoggerFn } from './logger'
 import { sanitizeFreeText, sanitizeFreeTextValue } from './mcp-payloads'
+import { TRUNCATION_SUFFIX } from './truncation'
 
 export const SEND_FEEDBACK_TOOL_NAME = 'send_feedback' as const
 
@@ -21,7 +22,6 @@ const SENTIMENTS: readonly FeedbackSentiment[] = ['positive', 'neutral', 'negati
 // Free-text fields are agent-narrated, like `$mcp_intent`; bound them the same way.
 const MAX_FEEDBACK_TEXT_LENGTH = 2048
 const MAX_FEEDBACK_TOOL_NAME_LENGTH = 256
-const TRUNCATION_SUFFIX = '...'
 
 const DEFAULT_FEEDBACK_DESCRIPTION =
   'Send feedback about this server to its developers. Most important: report a missing capability whenever no ' +

package/src/extensions/mcp-payloads.ts

@@ -3,6 +3,8 @@
 // Copyright (c) 2025 AgentCat, Inc. (formerly MCPcat)
 // Licensed under the MIT License: https://github.com/agentcathq/agentcat-typescript-sdk/blob/main/LICENSE
 
+import { MAX_STRING_LENGTH, TRUNCATION_SUFFIX } from './truncation'
+
 const CONTEXT_ARGUMENT_NAME = 'context'
 const REDACTED_VALUE = '[redacted]'
 const BINARY_REDACTED_VALUE = '[binary data redacted - not supported by PostHog MCP analytics]'
@@ -12,6 +14,10 @@ const BASE64URL_SPECIFIC_CHAR_PATTERN = /[-_]/
 const BASE64_DATA_URL_PREFIX_PATTERN = /^data:[^,\s]*;base64,/i
 const BASE64_DATA_URL_PAYLOAD_PATTERN = /^[A-Za-z0-9+/_-]+={0,2}$/
 const SIZE_GATE = 10_240
+const SCANNED_HEAD_LENGTH = 4 * MAX_STRING_LENGTH
+// Twice what truncation keeps, so a match split where the head was cut sits past
+// the part truncation keeps.
+const MIN_REDACTED_HEAD_LENGTH = 2 * MAX_STRING_LENGTH
 const POSTHOG_TOKEN_PATTERN = /\bph[a-z]_[A-Za-z0-9_-]{20,}\b/g
 const SENSITIVE_KEY_PATTERN =
   /^(authorization|cookie|set-cookie|x-api-key|api[-_]?key|api[-_]?token|access[-_]?token|refresh[-_]?token|token|password|secret|client[-_]?secret|private[-_]?key)$/i
@@ -33,6 +39,8 @@ const SENSITIVE_KEY_PATTERN =
 // harmless: a match with nothing to redact is returned byte-for-byte, so the
 // text around it is never rewritten.
 const URL_PATTERN = /[a-z][a-z0-9+.-]{0,63}:[^\s<>"]+/gi
+// A character no URL match can contain, so a cut just after one splits no URL.
+const URL_END_PATTERN = /[\s<>"]/
 /** The same pattern without `g`, for asking whether a value holds a URL at all. */
 const URL_PATTERN_ONCE = new RegExp(URL_PATTERN.source, 'i')
 /** Finds the first scheme that brings a real authority, i.e. what the pattern required before it went authority-less. */
@@ -315,6 +323,11 @@ function sanitizeFragmentText(text: string, allowNestedUrls: boolean): string {
  * addresses together, because every one of them scanned back to the same `?`.
  */
 function findEmbeddedAuthorityIndexes(value: string): number[] {
+  // The search tries up to 64 scheme characters at every position, which a long
+  // base64 `data:` URI turns into seconds; without `://` it cannot match at all.
+  if (!value.includes('://')) {
+    return []
+  }
   const starts = [...value.matchAll(URL_AUTHORITY_SEARCH_ALL)].map((match) => match.index)
   const indexes: number[] = []
   const delimiters = { query: false, fragment: false, fragmentQuery: false }
@@ -503,8 +516,37 @@ function redactUrls(value: string): string {
   return sanitizeUrlsInString(value, { allowNestedUrls: true, stripPunctuation: true })
 }
 
+/**
+ * Runs `redact` over only the head of `value` that truncation can keep, so a
+ * multi-megabyte tool result costs about the same as the part captured. The head
+ * ends where no URL crosses it, because a URL is redacted or kept on the whole
+ * address. Redaction shrinks text, so a head that ends up too short to cover
+ * truncation's cut falls back to the whole string. Either way the kept part
+ * reads exactly as if the whole string were redacted.
+ */
+function redactCapturedHead(value: string, redact: (value: string) => string): string {
+  if (value.length > SCANNED_HEAD_LENGTH) {
+    const head = redact(value.slice(0, headLength(value)))
+    if (head.length >= MIN_REDACTED_HEAD_LENGTH) {
+      return head + TRUNCATION_SUFFIX
+    }
+  }
+  return redact(value)
+}
+
+/** The scanned head, shortened to end just after the last character that ends a URL. */
+function headLength(value: string): number {
+  let end = SCANNED_HEAD_LENGTH
+  while (end > 0 && !URL_END_PATTERN.test(value[end - 1])) {
+    end--
+  }
+  return end
+}
+
 function sanitizeString(value: string): string {
-  return isBinaryBlob(value) ? BINARY_REDACTED_VALUE : redactUrls(redactCredentials(value))
+  return isBinaryBlob(value)
+    ? BINARY_REDACTED_VALUE
+    : redactCapturedHead(value, (head) => redactUrls(redactCredentials(head)))
 }
 
 /**
@@ -523,7 +565,7 @@ export function sanitizeFreeText(value: string): string {
   if (isBinaryBlob(value)) {
     return BINARY_REDACTED_VALUE
   }
-  return redactUrls(redactPii(redactCredentials(value)))
+  return redactCapturedHead(value, (head) => redactUrls(redactPii(redactCredentials(head))))
 }
 
 function passesLuhn(digits: string): boolean {

package/src/extensions/truncation.ts

@@ -20,7 +20,7 @@ const MAX_STACK_FRAMES = 50
 const MAX_CONTENT_TEXT_LENGTH = 32_768
 
 // --- Truncation markers ---
-const TRUNCATION_SUFFIX = '...'
+export const TRUNCATION_SUFFIX = '...'
 
 type MutableEvent = Partial<Event | McpEvent> & Record<string, unknown>
 type MutableRecord = Record<string, unknown>
@@ -366,6 +366,8 @@ function setNestedValue(obj: unknown, path: string[], value: unknown): void {
   }
 }
 
+const REDUCIBLE_FIELDS = ['parameters', 'response', 'identifyActorData', 'error'] as const
+
 /**
  * Ensures an event fits within MAX_EVENT_BYTES by progressively reducing
  * normalization depth, then truncating largest string fields as a last resort.
@@ -376,43 +378,51 @@ function truncateToSize(event: MutableEvent): MutableEvent {
     return event
   }
 
-  // Progressive depth reduction
-  for (let depth = MAX_DEPTH - 1; depth >= 1; depth--) {
-    const reduced: MutableEvent = { ...event }
-    if (reduced.parameters != null) {
-      reduced.parameters = normalize(reduced.parameters, depth)
-    }
-    if (reduced.response != null) {
-      reduced.response = normalize(reduced.response, depth)
-    }
-    if (reduced.identifyActorData != null) {
-      reduced.identifyActorData = normalize(reduced.identifyActorData, depth) as Event['identifyActorData']
-    }
-    if (reduced.error != null) {
-      reduced.error = normalize(reduced.error, depth) as Event['error']
-    }
-
+  // Progressive depth reduction, from the first depth that collapses anything.
+  // Any deeper depth leaves the event as it is, and it is already too large.
+  const nesting = Math.max(...REDUCIBLE_FIELDS.map((field) => nestingDepth(event[field])))
+  let atDepthOne: MutableEvent | undefined
+  for (let depth = nesting - 1; depth >= 1; depth--) {
+    const reduced = normalizeReducibleFields(event, depth)
     if (jsonByteSize(reduced) <= MAX_EVENT_BYTES) {
       return reduced
     }
+    if (depth === 1) {
+      atDepthOne = reduced
+    }
   }
 
-  // Last resort: truncate largest string fields
-  const minimal: MutableEvent = { ...event }
-  if (minimal.parameters != null) {
-    minimal.parameters = normalize(minimal.parameters, 1)
-  }
-  if (minimal.response != null) {
-    minimal.response = normalize(minimal.response, 1)
-  }
-  if (minimal.identifyActorData != null) {
-    minimal.identifyActorData = normalize(minimal.identifyActorData, 1) as Event['identifyActorData']
-  }
-  if (minimal.error != null) {
-    minimal.error = normalize(minimal.error, 1) as Event['error']
+  // Last resort: truncate largest string fields. Reuse the loop's depth-1
+  // result when it already computed one, instead of normalizing again.
+  return truncateLargestFields(atDepthOne ?? normalizeReducibleFields(event, 1), MAX_EVENT_BYTES)
+}
+
+/**
+ * The number of object and array levels in `value`, up to `limit`. `normalize`
+ * at this depth or deeper collapses nothing.
+ */
+function nestingDepth(value: unknown, limit: number = MAX_DEPTH): number {
+  if (limit === 0 || value === null || typeof value !== 'object') {
+    return 0
+  }
+  let deepest = 0
+  for (const item of Array.isArray(value) ? value : Object.values(value)) {
+    deepest = Math.max(deepest, nestingDepth(item, limit - 1))
+    if (deepest === limit - 1) {
+      break
+    }
   }
+  return deepest + 1
+}
 
-  return truncateLargestFields(minimal, MAX_EVENT_BYTES)
+function normalizeReducibleFields(event: MutableEvent, depth: number): MutableEvent {
+  const reduced: MutableEvent = { ...event }
+  for (const field of REDUCIBLE_FIELDS) {
+    if (reduced[field] != null) {
+      ;(reduced as MutableRecord)[field] = normalize(reduced[field], depth)
+    }
+  }
+  return reduced
 }
 
 /**

package/src/version.ts

@@ -1 +1 @@
-export const version = "0.21.2"
+export const version = "0.21.4"