pattern-mcp 0.8.1 → 0.9.0

package/README.md

@@ -1644,74 +1644,96 @@ recommendations.
 Local project memory and the local call log are stored on the machine
 running Pattern. They are not sent anywhere by Pattern itself.
 
-The one exception is opt-in telemetry, off by default -- see
+The one exception is telemetry, on by default -- see
 [Telemetry](#telemetry) below for exactly what it sends and how to turn
-it on or off.
+it off.
 
 Review [SECURITY.md](./SECURITY.md) before putting sensitive information
 into fields such as `component_need`, `domain`, or project IDs.
 
 ## Telemetry
 
-Off by default. Nothing is sent anywhere for telemetry purposes unless
-you explicitly set:
+On by default, as of v0.9.0. To turn it off:
 
 ```
-PATTERN_TELEMETRY=1
+PATTERN_TELEMETRY=0
 ```
 
+(`false` and `no` also work, case-insensitively. Before v0.9.0 this was
+opt-in -- `PATTERN_TELEMETRY=1` to turn on. In practice that meant almost
+no signal: installs happened, but almost nobody set the env var. This
+release flips the default and adds a second, standard event stream, both
+described below, while keeping the same "never sent" guarantees.)
+
 **The one-time notice.** The first time you run this version of Pattern
--- whether it's a brand-new install or an upgrade from a version before
-telemetry existed -- it prints a short notice to stderr explaining all of
-this and how to opt in. It prints exactly once, ever (tracked by a marker
-file at `~/.pattern/telemetry_notice_shown`), then never again, regardless
-of whether you act on it. There's no interactive y/n prompt: Pattern's
-stdin is the MCP JSON-RPC channel the client uses to talk to it, so
-blocking on stdin for a keypress would fight the protocol handshake
-instead of showing a dialog -- a stderr notice is the safe equivalent for
-a stdio MCP server.
-
-**Why it exists.** Two things about real usage can't be answered from
+-- whether it's a brand-new install or an upgrade from an older version
+-- it prints a short notice to stderr explaining all of this and how to
+opt out. It prints exactly once, ever (tracked by a marker file at
+`~/.pattern/telemetry_notice_shown`), then never again, regardless of
+whether you act on it. There's no interactive y/n prompt: Pattern's stdin
+is the MCP JSON-RPC channel the client uses to talk to it, so blocking on
+stdin for a keypress would fight the protocol handshake instead of
+showing a dialog -- a stderr notice is the safe equivalent for a stdio
+MCP server.
+
+**Why it exists.** Three things about real usage can't be answered from
 this repo alone: whether people actually come back and use Pattern on a
-second or third project on their own, and how often a BYO Anthropic key
+second or third project on their own; how often a BYO Anthropic key
 actually hits a rate limit or runs out of credit in real sessions, not
 just the one time that happened during manual testing (see
-[Known limitations](#known-limitations)). Telemetry answers both without
-requiring anyone to fill out a survey.
-
-**What gets sent, when enabled:**
-
-- An anonymous, randomly generated install ID -- a UUID created once and
-  stored at `~/.pattern/install_id` (overridable via
-  `PATTERN_INSTALL_ID_PATH`), never derived from your machine, username,
-  or any other identifying information. This is the only thing that ties
-  two events together as "the same install."
-- A one-way SHA-256 hash of `project_id`, truncated to 16 hex characters
-  -- never the raw `project_id` string. The hash lets Pattern count how
-  many *distinct* projects one install has used, without ever seeing what
-  those projects are named.
-- On every `recommend_component` call that reaches the API or the ledger
-  cache-hit shortcut: `verdict`, `confidence`, `reason`,
-  `ensemble_triggered`, `estimated_cost_usd`, and `served_from_ledger` --
-  the same distilled shape already written to the
-  [local call log](#local-call-log), not new information.
-- On a failed Anthropic API call specifically: the HTTP status code and a
-  coarse classification (`rate_limit`, `insufficient_credit`, or `other`)
-  -- never the request or response body.
+[Known limitations](#known-limitations)); and, previously, whether
+`recommend_component` gets called at all after install -- opt-in
+telemetry couldn't answer that last one because the people who'd opt in
+are a biased, tiny sample of everyone who installs.
+
+**What gets sent, when on -- two event streams, same distinct ID:**
+
+1. Pattern's own events, sent directly to PostHog:
+   - An anonymous, randomly generated install ID -- a UUID created once
+     and stored at `~/.pattern/install_id` (overridable via
+     `PATTERN_INSTALL_ID_PATH`), never derived from your machine,
+     username, or any other identifying information. This is the distinct
+     ID both event streams use, so an install counts as the same "user"
+     in either.
+   - A one-way SHA-256 hash of `project_id`, truncated to 16 hex characters
+     -- never the raw `project_id` string. The hash lets Pattern count how
+     many *distinct* projects one install has used, without ever seeing what
+     those projects are named.
+   - On every `recommend_component` call that reaches the API or the ledger
+     cache-hit shortcut: `verdict`, `confidence`, `reason`,
+     `ensemble_triggered`, `estimated_cost_usd`, and `served_from_ledger` --
+     the same distilled shape already written to the
+     [local call log](#local-call-log), not new information.
+   - On a failed Anthropic API call specifically: the HTTP status code and a
+     coarse classification (`rate_limit`, `insufficient_credit`, or `other`)
+     -- never the request or response body.
+2. Standard MCP tool-call analytics, via
+   [`@posthog/mcp`](https://posthog.com/docs/mcp-analytics): which tool
+   was called, call duration, and success/failure, so unique installs and
+   call counts per tool (including `recommend_component`) are visible the
+   same way any other MCP server's usage would be. This SDK's defaults
+   would otherwise also capture full tool call arguments, full response
+   text, and the raw thrown error message on a failure -- Pattern
+   explicitly strips all of that (`$mcp_parameters`, `$mcp_response`,
+   `$mcp_intent`, `$mcp_error_message`) before anything leaves the process,
+   via its `beforeSend` hook. What's left is the same shape as stream 1
+   above: counts, timing, and coarse success/failure, never content.
 
 **What never gets sent, telemetry on or off:** `component_need`,
 `domain`, `framework`, `existing_stack`, `requirements_checked` evidence,
-the raw `project_id`, or your Anthropic API key.
+the raw `project_id`, a failed API call's request or response body, or
+your Anthropic API key. This is a claim about both event streams above,
+not just the first one.
 
-**Where it goes.** Events go to Pattern's PostHog project via its public,
-write-only project key (safe to ship in source -- it can send events, it
-cannot read data back). Set `PATTERN_POSTHOG_KEY` /
+**Where it goes.** Both streams go to Pattern's PostHog project via its
+public, write-only project key (safe to ship in source -- it can send
+events, it cannot read data back). Set `PATTERN_POSTHOG_KEY` /
 `PATTERN_POSTHOG_HOST` to point at a different project, e.g. for
 self-hosting.
 
-**Turning it off** is the default -- just don't set `PATTERN_TELEMETRY`.
-If you'd previously enabled it, unset the variable (or set it to `0`) to
-go back to fully local.
+**Turning it off:** `PATTERN_TELEMETRY=0` disables both streams entirely
+-- when it's off, `instrument()` (stream 2) is never even called, and
+stream 1's `capture()` calls are no-ops.
 
 ## Cost
 

package/dist/index.js

@@ -30,12 +30,13 @@
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { instrument } from "@posthog/mcp";
 import { execFileSync } from "node:child_process";
 import { createHash, randomUUID } from "node:crypto";
 import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, extname, isAbsolute, join, relative, resolve } from "node:path";
-import { captureApiError, captureRecommendation, printTelemetryNoticeOnce, shutdownTelemetry, } from "./telemetry.js";
+import { captureApiError, captureRecommendation, getClient as getPostHogClient, installId, printTelemetryNoticeOnce, shutdownTelemetry, TELEMETRY_ENABLED, } from "./telemetry.js";
 export const ANTHROPIC_API_KEY = process.env.ANTHROPIC_API_KEY;
 // Configurable so Sonnet vs. Haiku can be A/B tested without a code change.
 // Defaults to Sonnet 5. Try MODEL=claude-haiku-4-5-20251001 to test the
@@ -3338,6 +3339,45 @@ export function extractJson(text) {
     return text.slice(start, end + 1);
 }
 const server = new Server({ name: "pattern-mcp", version: "0.1.0" }, { capabilities: { tools: {} } });
+// Standard MCP tool-call analytics (tool name, duration, success/failure,
+// unique installs/sessions) via PostHog's own MCP SDK -- separate from
+// this file's captureRecommendation()/captureApiError() calls, which carry
+// the distilled verdict shape. Both are gated by the same TELEMETRY_ENABLED
+// flag (see telemetry.ts) and share installId() as the distinct_id so an
+// install counts as the same "user" across both event streams.
+//
+// context: false skips injecting an extra `context` argument into every
+// tool's schema. beforeSend strips $mcp_parameters/$mcp_response/$mcp_intent/
+// $mcp_error_message before anything is sent -- by default this SDK
+// captures full tool call arguments, response text, AND the raw thrown
+// error message (which for a failed Anthropic call is the full HTTP
+// response body -- verified live: a 401 test call shipped the entire
+// JSON error body in $mcp_error_message before this strip was added).
+// SECURITY.md and README.md both promise component_need/domain/framework/
+// existing_stack are never sent and that a failed API call never sends its
+// response body; this is what keeps both true for this event stream too.
+// enableExceptionAutocapture is off for the same reason -- it would also
+// fan the same raw message out to a separate $exception event.
+if (TELEMETRY_ENABLED) {
+    const posthogClient = getPostHogClient();
+    if (posthogClient) {
+        instrument(server, posthogClient, {
+            context: false,
+            enableExceptionAutocapture: false,
+            identify: async () => ({ distinctId: installId() }),
+            beforeSend: (event) => {
+                if (event.properties) {
+                    delete event.properties["$mcp_parameters"];
+                    delete event.properties["$mcp_response"];
+                    delete event.properties["$mcp_intent"];
+                    delete event.properties["$mcp_intent_source"];
+                    delete event.properties["$mcp_error_message"];
+                }
+                return event;
+            },
+        });
+    }
+}
 server.setRequestHandler(ListToolsRequestSchema, async () => ({
     tools: [
         {

package/dist/telemetry.js

@@ -1,8 +1,9 @@
 /**
- * Opt-in, anonymous product telemetry.
+ * Anonymous product telemetry.
  *
- * Off by default. Enabling it (PATTERN_TELEMETRY=1) answers two questions
- * the product can't answer any other way without asking users directly:
+ * On by default. Disabling it (PATTERN_TELEMETRY=0) turns off both halves
+ * described below. It answers two questions the product can't answer any
+ * other way without asking users directly:
  *
  *  - Do people come back and use Pattern on a second or third project on
  *    their own, unprompted? (tracked via distinct project hashes seen per
@@ -11,16 +12,27 @@
  *    limited in real sessions, not just the one time it happened during
  *    manual testing? (tracked via captureApiError)
  *
- * What gets sent, when enabled: an anonymous, randomly generated install
- * ID (see installId() below); a one-way SHA-256 hash of project_id,
- * truncated to 16 hex chars -- never the raw project_id string; the verdict
- * shape already written to the local call log (verdict, confidence,
- * ensemble_triggered, estimated cost); and, on a failed Anthropic API call,
- * only the HTTP status and a coarse error classification (rate_limit /
- * insufficient_credit / other) -- never the request or response body.
+ * There are two halves to what ships, both gated by the same flag:
+ *
+ *  1. This file's own capture() calls: an anonymous, randomly generated
+ *     install ID (see installId() below); a one-way SHA-256 hash of
+ *     project_id, truncated to 16 hex chars -- never the raw project_id
+ *     string; the verdict shape already written to the local call log
+ *     (verdict, confidence, ensemble_triggered, estimated cost); and, on a
+ *     failed Anthropic API call, only the HTTP status and a coarse error
+ *     classification (rate_limit / insufficient_credit / other) -- never
+ *     the request or response body.
+ *  2. `@posthog/mcp`'s standard MCP instrumentation, wired up in index.ts:
+ *     tool name, call duration, error/success, and the same anonymous
+ *     install ID as the distinct_id (via its `identify` option), so both
+ *     halves count the same "user." Its `beforeSend` hook strips
+ *     `$mcp_parameters`, `$mcp_response`, and `$mcp_intent`/
+ *     `$mcp_intent_source` before anything leaves the process -- those
+ *     would otherwise carry tool call arguments and output text.
+ *
  * component_need text, requirements_checked evidence, and the API key
- * itself are never sent. See SECURITY.md and README.md for the full
- * disclosure and the exact opt-in instructions.
+ * itself are never sent, by either half. See SECURITY.md and README.md for
+ * the full disclosure and how to opt out.
  *
  * Reuses Pattern's existing PostHog project (the same one the marketing
  * site sends browser events to) with its public, write-only project key --
@@ -34,12 +46,13 @@ import { createHash, randomUUID } from "node:crypto";
 import { mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-// Opt-in, not opt-out -- deliberate, given who this tool is for. See
-// README's telemetry section: a local-first tool aimed at developers who
-// notice and care about silent tracking is exactly the audience §06 of the
-// product brief already flags as sensitive to "no paper trail" trust gaps.
-// Any of "1", "true", "yes" (case-insensitive) turns it on.
-const TELEMETRY_ENABLED = /^(1|true|yes)$/i.test(process.env.PATTERN_TELEMETRY ?? "");
+// Opt-out, not opt-in. Previously opt-in; changed because opt-in meant
+// near-zero real signal in practice (installs happened, but almost no one
+// ever set the env var) -- see the one-time notice below, which is the
+// disclosure mechanism that replaces an interactive consent prompt for a
+// stdio MCP server. Any of "0", "false", "no" (case-insensitive) turns it
+// off; anything else, including unset, leaves it on.
+export const TELEMETRY_ENABLED = !/^(0|false|no)$/i.test(process.env.PATTERN_TELEMETRY ?? "");
 // One-time startup notice, printed to stderr -- the closest thing to an
 // opt-in prompt an MCP stdio server can safely show. stdin is the JSON-RPC
 // channel the client uses to talk to this process; blocking on it to read
@@ -60,23 +73,24 @@ export function printTelemetryNoticeOnce() {
         // No marker yet -- fall through and show it.
     }
     const status = TELEMETRY_ENABLED
-        ? "ON, because PATTERN_TELEMETRY is set"
-        : "OFF (the default -- nothing is sent unless you opt in)";
+        ? "ON (the default)"
+        : "OFF, because PATTERN_TELEMETRY is set to 0/false/no";
     console.error([
         "",
         "Pattern -- one-time telemetry notice (this will not print again)",
         `Anonymous usage telemetry is currently ${status}.`,
         "",
-        "When enabled, Pattern sends an anonymous per-install ID, a one-way",
-        "hash of project_id (never the raw string), and the same verdict",
-        "summary already written to ~/.pattern/calls.log (verdict,",
-        "confidence, reason, estimated cost). component_need, domain,",
-        "framework, existing_stack, and your API key are never sent.",
+        "When on, Pattern sends an anonymous per-install ID, a one-way hash",
+        "of project_id (never the raw string), the same verdict summary",
+        "already written to ~/.pattern/calls.log (verdict, confidence,",
+        "reason, estimated cost), and standard MCP tool-call analytics (tool",
+        "name, duration, success/failure) via PostHog's MCP SDK. Tool call",
+        "arguments and responses are stripped before sending -- component_need,",
+        "domain, framework, existing_stack, and your API key are never sent.",
         "Full field list: https://github.com/donaldrichard19-LVD/pattern-mcp#telemetry",
         "",
-        "To help improve Pattern by sharing anonymous usage data, opt in:",
-        "  PATTERN_TELEMETRY=1",
-        "Already on and want it off instead? Unset PATTERN_TELEMETRY (or set it to 0).",
+        "To opt out: PATTERN_TELEMETRY=0",
+        "Already off and want it back on? Unset PATTERN_TELEMETRY (or set it to 1).",
         "",
     ].join("\n"));
     try {
@@ -109,7 +123,7 @@ let cachedInstallId;
 // would look like a brand-new anonymous user. Never derived from anything
 // that identifies a person or machine (no hostname, no MAC, no username) --
 // purely a random UUID with no way to reverse it to an identity.
-function installId() {
+export function installId() {
     if (cachedInstallId)
         return cachedInstallId;
     try {
@@ -155,7 +169,10 @@ export function classifyApiError(message) {
     return { type: "other", status };
 }
 let client;
-function getClient() {
+// Exported so index.ts's @posthog/mcp instrument() call shares this same
+// client/project instead of standing up a second PostHog connection --
+// same reason both halves share installId() as their distinct_id.
+export function getClient() {
     if (!TELEMETRY_ENABLED || !POSTHOG_KEY)
         return undefined;
     if (!client) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pattern-mcp",
-  "version": "0.8.1",
+  "version": "0.9.0",
   "description": "MCP server that turns your design guidance into a checkable process -- evaluates UI components from external libraries (shadcn/ui, 21st.dev, ReUI) or your own registered design system against a requirements checklist, then tells the agent whether to reuse an existing component or build one from a concrete design reference.",
   "type": "module",
   "main": "dist/index.js",
@@ -37,6 +37,7 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
+    "@posthog/mcp": "^0.13.0",
     "posthog-node": "^5.51.4"
   },
   "devDependencies": {