premiere-pro-mcp 1.4.0 → 1.5.0

package/CHANGELOG.md

@@ -6,6 +6,30 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [1.5.0] - 2026-07-30
+
+### Added
+
+- Added `detect_silence` for finding dead air in local source media with FFmpeg, including
+  Docker support and clear local-install guidance.
+- Added anonymous, opt-out PostHog usage telemetry with prompt flushing for low-volume servers.
+- Added an immersive editorial landing-page experience, product demo video, changelog page, and
+  a 30-day launch plan.
+
+### Changed
+
+- Expanded the MCP surface to 279 tools and limited advertised tools to those allowed by the
+  active capability profile.
+- Documented capability-filtered discovery, remote media-path constraints, and the difference
+  between the 279 registered tools and the 277 tools available to the default profile.
+
+### Fixed
+
+- Structural timeline tools now verify razor, ripple-delete, transition, and track-targeting
+  mutations instead of reporting success when Premiere applied only part or none of an edit.
+- Server metadata now reports the package version rather than a stale hard-coded value.
+- Resolved CodeQL findings in HTTP authentication and filesystem-path handling.
+
 ## [1.4.0] - 2026-07-26
 
 ### Added

package/README.md

@@ -2,9 +2,11 @@
 
 # Premiere Pro MCP Server
 
+[![MCP Toplist](https://mcptoplist.com/badge/glama%2Fleancoderkavy%2Fpremiere-pro-mcp.svg)](https://mcptoplist.com/server/glama%2Fleancoderkavy%2Fpremiere-pro-mcp)
+
 **Give AI full control over Adobe Premiere Pro.**
 
-278 tools across 31 modules, 3 resources, and 4 guided workflows.
+279 tools across 31 modules, 3 resources, and 4 guided workflows.
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![Node.js](https://img.shields.io/badge/Node.js-20.19%2B-green.svg)](https://nodejs.org)
@@ -25,7 +27,7 @@ An [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that l
 "Add the B-roll clips to V2, apply a cross dissolve between each, color correct them to match the A-roll, and export a 1080p ProRes."
 ```
 
-The AI handles the entire workflow through 278 tools spanning the supported ExtendScript, QE DOM, and safe edit-planning surfaces.
+The AI handles the entire workflow through 279 tools spanning the supported ExtendScript, QE DOM, local media analysis, and safe edit-planning surfaces.
 
 ### What's new in 1.3.1
 
@@ -49,6 +51,14 @@ The AI handles the entire workflow through 278 tools spanning the supported Exte
 
 ## Quick Start
 
+### Before you begin
+
+- Node.js **20.19 or newer** on Windows or macOS.
+- Adobe Premiere Pro **2020–2026**. Keep Premiere, the CEP bridge, and your MCP client on the same computer for the recommended local setup.
+- Optional: [ffmpeg](https://ffmpeg.org/download.html) on `PATH` for `detect_silence`
+  (`brew install ffmpeg` on macOS or `winget install Gyan.FFmpeg` on Windows).
+  The production Docker image already includes it.
+
 ### 1. Install
 
 **Option A — npm (recommended):**
@@ -138,6 +148,20 @@ done
 
 ### 3. Configure your MCP client
 
+If you installed from npm, configure the client to run the global command:
+
+```json
+{
+  "mcpServers": {
+    "premiere-pro": {
+      "command": "premiere-pro-mcp"
+    }
+  }
+}
+```
+
+If you cloned the repository instead, use the source-build configuration shown below for your client.
+
 <details>
 <summary><strong>Claude Desktop</strong></summary>
 
@@ -213,7 +237,8 @@ Add to your VS Code MCP server configuration:
 1. Open (or restart) Premiere Pro
 2. The bridge starts automatically using the default temp directory (or its previously saved setting)
 3. Optionally go to **Window > Extensions > MCP Bridge** to confirm the green "Running" status or change the **Temp Directory** to match your MCP client config
-4. Ask your AI assistant: *"What's my current Premiere Pro project?"*
+4. Ask your AI assistant to run `get_capabilities`, then `ping`, with Premiere open.
+5. For a safe first request, ask: *"What is my current Premiere Pro project and active sequence? Do not make changes."*
 
 The default bridge directory is derived from the operating system on both sides, so most local setups should not set `PREMIERE_TEMP_DIR`. If you override it, use the same absolute path in the MCP server and CEP panel; Windows and macOS paths are not interchangeable.
 
@@ -276,9 +301,9 @@ installed separately.
 | CEP production bridge | Premiere Pro 2020–2026 | Premiere Pro 2020–2026 | Run `get_capabilities`, then `ping` with Premiere open |
 | UXP preview bridge | Premiere Pro 25.6+ | Premiere Pro 25.6+ | Live loopback WebSocket and host API verification required |
 | npm CEP installer | Copies plugin and verifies `REG_SZ` debug keys | Copies plugin and verifies the installed manifest/debug settings | Restart Premiere after installation |
-| CI build and unit tests | Node 18 and 22 | Node 18 and 22 | GitHub-hosted OS runners; no Adobe host is available in CI |
+| CI build and unit tests | Node 20, 22, and 24 | Node 20, 22, and 24 | GitHub-hosted OS runners; no Adobe host is available in CI |
 
-`get_capabilities` reports the current operating system, temp directory, CEP/UXP coverage, enabled authority profile, and any live-host verification still required. It also includes a `tools` catalog generated from the tools actually registered by the server. Every entry identifies:
+`get_capabilities` reports the current operating system, temp directory, CEP/UXP coverage, enabled authority profile, and any live-host verification still required. It also includes the full `tools` catalog generated from the tools registered by the server, including tools disabled by the active profile. Every entry identifies:
 
 - the execution backend (`local`, CEP/ExtendScript, QE, or orchestrator);
 - static support status (`supported`, `limited`, `experimental`, or `unsupported`);
@@ -289,6 +314,18 @@ installed separately.
 
 QE-backed tools are reported as `experimental` because QE is undocumented and can vary between Premiere builds. Authority availability is reported separately from implementation support, so disabling `edit`, for example, does not incorrectly label editing tools as unsupported. Static metadata never claims that a Premiere operation succeeded; use `ping` and inspect each tool result for runtime evidence.
 
+MCP `tools/list` is filtered to the active authority profile. The default
+`inspect,edit,export,filesystem` profile advertises 277 of the 279 registered
+tools and omits `execute_extendscript` and `evaluate_expression`, which require
+explicit `unsafe-script` authority. `ping` and `get_capabilities` remain visible
+under every profile so a restricted or misconfigured server can still explain
+its state. The call-time capability guard remains authoritative even if listing
+metadata is wrong.
+
+The MCP handshake reads `serverInfo.version` from the installed `package.json`,
+so clients receive the package version that is actually running rather than a
+separately maintained literal.
+
 Tools with mixed execution boundaries can provide explicit operational metadata at registration. This is used for local file verification, static feature-support reports, and hybrid local-plus-Premiere validation so the capability catalog does not infer a host dependency from naming alone.
 
 ### Collaboration and AI feature boundaries
@@ -373,7 +410,7 @@ The file-based IPC bridge is simple, reliable, and works across macOS and Window
 
 ---
 
-## Tools (278)
+## Tools (279 total; 277 under the default profile)
 
 ### Discovery & Inspection (10 + 10)
 
@@ -507,13 +544,12 @@ than presenting UI-only operations as available tools.
 | `get_workspaces` / `set_workspace` | Switch workspace layouts |
 | `create_caption_track` | Create caption/subtitle tracks |
 
-### Scripting (6)
+### Scripting (2)
 
 | Tool | Description |
 | :--- | :----------- |
-| `execute_extendscript` | Run arbitrary ExtendScript (ES3) |
-| `evaluate_expression` | Quick one-line eval |
-| `send_raw_script` | Bypass security validation (advanced) |
+| `execute_extendscript` | Run arbitrary ExtendScript (ES3); requires explicit `unsafe-script` authority |
+| `evaluate_expression` | Evaluate a one-line expression; requires explicit `unsafe-script` authority |
 
 ### ...and 100+ more
 
@@ -581,6 +617,7 @@ Then connect with:
 ```
 
 > **Note:** The file bridge still requires the CEP plugin to share the same `PREMIERE_TEMP_DIR`. For cloud deployments this means running a sync agent or using `fly proxy` / WireGuard to reach your local machine.
+> `detect_silence` can analyze only media paths available inside the server filesystem; a desktop-only path is not automatically available to a remote Fly machine.
 
 ---
 
@@ -596,6 +633,16 @@ Then connect with:
 | `PORT` | HTTP port (HTTP/SSE transport only) | `3000` |
 | `MCP_AUTH_TOKEN` | Bearer token required by the HTTP transport | unset |
 | `ALLOW_UNAUTHENTICATED` | Set to `1` to run HTTP without auth (unsafe; throwaway instances only) | unset |
+| `POSTHOG_API_KEY` | PostHog project token; enables privacy-safe MCP usage telemetry | unset |
+| `POSTHOG_HOST` | PostHog ingestion host | `https://us.i.posthog.com` |
+| `POSTHOG_ENVIRONMENT` | Environment property attached to telemetry events | `production` |
+| `POSTHOG_DISTINCT_ID` | Optional stable anonymous server identifier | Fly machine ID or random boot ID |
+
+When PostHog is enabled, the server records `mcp_connection_attempt`,
+`mcp_request`, and `mcp_tool_call`. Events contain operational fields such as
+method, tool name, outcome, status code, and duration. Authentication tokens,
+IP addresses, MCP arguments, project paths, media names, and tool results are
+never sent. Person profiles are disabled for these events.
 
 ---
 
@@ -606,7 +653,7 @@ premiere-pro-mcp/
 ├── src/
 │   ├── index.ts                 # Entry point — stdio transport setup
 │   ├── http-server.ts           # Entry point — HTTP/SSE transport (Fly.io / remote)
-│   ├── server.ts                # MCP server — registers 278 tools + 3 resources + 4 prompts
+│   ├── server.ts                # MCP server — registers 279 tools, filtered by authority profile
 │   ├── bridge/
 │   │   ├── file-bridge.ts       # File-based IPC (write .jsx, poll .json)
 │   │   └── script-builder.ts    # ExtendScript generator with ES3 helpers
@@ -619,7 +666,7 @@ premiere-pro-mcp/
 │   │   ├── timeline.ts          # Timeline clip operations
 │   │   ├── effects.ts           # Effect application and color correction
 │   │   ├── transitions.ts       # Transition management (QE DOM)
-│   │   ├── audio.ts             # Audio levels and keyframes
+│   │   ├── audio.ts             # Audio levels, keyframes, and ffmpeg silence analysis
 │   │   ├── av-settings.ts       # Documented AV inspection, mapping, and capability boundaries
 │   │   ├── text.ts              # Text overlays and MOGRTs
 │   │   ├── markers.ts           # Sequence and clip markers
@@ -675,8 +722,9 @@ All generated scripts use **ES3 syntax** (`var`, manual `for` loops, no arrow fu
 ### Security
 
 Understand the trust model before deploying this: **any client that can reach the MCP
-server can control Premiere Pro.** `execute_extendscript` and `send_raw_script` are
-arbitrary-code-execution tools by design and are disabled by default. Enable them only by setting
+server can control Premiere Pro.** `execute_extendscript` and `evaluate_expression` are
+arbitrary-code-execution tools by design and are omitted from discovery and denied at call time
+by default. Enable them only by setting
 `PREMIERE_MCP_CAPABILITIES=inspect,edit,export,filesystem,unsafe-script`.
 
 - **Run it locally over stdio** unless you have a specific reason not to. That's the safe default.

package/cep-plugin/CSXS/manifest.xml

@@ -1,8 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.4.0" ExtensionBundleName="MCP Bridge">
+<ExtensionManifest Version="7.0" ExtensionBundleId="com.mcp.premiere.bridge" ExtensionBundleVersion="1.5.0" ExtensionBundleName="MCP Bridge">
   <ExtensionList>
-    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.4.0"/>
-    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.4.0"/>
+    <Extension Id="com.mcp.premiere.bridge.panel" Version="1.5.0"/>
+    <Extension Id="com.mcp.premiere.bridge.headless" Version="1.5.0"/>
   </ExtensionList>
   <ExecutionEnvironment>
     <HostList>

package/cep-plugin/index.html

@@ -65,7 +65,7 @@
     <section class="update-section" aria-live="polite">
       <div class="update-copy">
         <span class="section-label">Connector updates</span>
-        <strong id="updateTitle">Version 1.4.0</strong>
+        <strong id="updateTitle">Version 1.5.0</strong>
         <span id="updateDetail">Checking for updates…</span>
       </div>
       <button id="btnUpdate" class="button button-update" onclick="handleUpdateClick()" type="button" disabled>

package/cep-plugin/updater.cjs

@@ -7,7 +7,7 @@
 })(this, function () {
   "use strict";
 
-  var CURRENT_VERSION = "1.4.0";
+  var CURRENT_VERSION = "1.5.0";
   var LATEST_RELEASE_API =
     "https://api.github.com/repos/leancoderkavy/premiere-pro-mcp/releases/latest";
   var RELEASES_URL =

package/dist/http-server.js

@@ -28,6 +28,7 @@ import { fileURLToPath } from "node:url";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
 import { createServer } from "./server.js";
 import { cleanupTempDir, getTempDir } from "./bridge/file-bridge.js";
+import { getTelemetry } from "./telemetry.js";
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const LANDING_DIR = path.resolve(__dirname, "../landing-dist");
 const MIME = {
@@ -36,6 +37,7 @@ const MIME = {
     ".css": "text/css; charset=utf-8",
     ".json": "application/json",
     ".png": "image/png",
+    ".mp4": "video/mp4",
     ".svg": "image/svg+xml",
     ".ico": "image/x-icon",
     ".woff2": "font/woff2",
@@ -96,6 +98,8 @@ const bridgeOptions = {
         ? parseInt(process.env.PREMIERE_TIMEOUT_MS, 10)
         : undefined,
 };
+process.env.PREMIERE_MCP_TRANSPORT = "http";
+const telemetry = getTelemetry();
 const tempDir = getTempDir(bridgeOptions);
 console.error(`[premiere-pro-mcp] Starting HTTP server on port ${PORT}...`);
 console.error(`[premiere-pro-mcp] Temp directory: ${tempDir}`);
@@ -118,11 +122,20 @@ const httpServer = http.createServer(async (req, res) => {
     }
     // Bearer token auth (constant-time; required unless ALLOW_UNAUTHENTICATED=1)
     if (!isAuthorized(req)) {
+        telemetry.capture("mcp_connection_attempt", {
+            outcome: "unauthorized",
+            method: req.method ?? "unknown",
+        });
         res.writeHead(401, { "Content-Type": "application/json" });
         res.end(JSON.stringify({ error: "Unauthorized" }));
         return;
     }
-    const mcpServer = createServer(bridgeOptions);
+    const requestStartedAt = Date.now();
+    telemetry.capture("mcp_connection_attempt", {
+        outcome: "authorized",
+        method: req.method ?? "unknown",
+    });
+    const mcpServer = createServer(bridgeOptions, { telemetry });
     const transport = new StreamableHTTPServerTransport({
         sessionIdGenerator: undefined, // stateless
     });
@@ -133,8 +146,21 @@ const httpServer = http.createServer(async (req, res) => {
     try {
         await mcpServer.connect(transport);
         await transport.handleRequest(req, res);
+        telemetry.capture("mcp_request", {
+            outcome: res.statusCode >= 400 ? "failed" : "succeeded",
+            method: req.method ?? "unknown",
+            status_code: res.statusCode,
+            duration_ms: Date.now() - requestStartedAt,
+        });
     }
     catch (err) {
+        telemetry.capture("mcp_request", {
+            outcome: "failed",
+            method: req.method ?? "unknown",
+            status_code: 500,
+            duration_ms: Date.now() - requestStartedAt,
+            error_type: err instanceof Error ? err.name : "UnknownError",
+        });
         console.error("[premiere-pro-mcp] Request error:", err);
         if (!res.headersSent) {
             res.writeHead(500, { "Content-Type": "application/json" });
@@ -152,12 +178,12 @@ httpServer.listen(PORT, "0.0.0.0", () => {
         console.error(`[premiere-pro-mcp] Auth: DISABLED via ALLOW_UNAUTHENTICATED — anyone can drive this server`);
     }
 });
-process.on("SIGTERM", () => {
-    console.error("[premiere-pro-mcp] SIGTERM received, shutting down...");
-    httpServer.close(() => process.exit(0));
-});
-process.on("SIGINT", () => {
-    console.error("[premiere-pro-mcp] SIGINT received, shutting down...");
-    httpServer.close(() => process.exit(0));
-});
+async function shutdown(signal) {
+    console.error(`[premiere-pro-mcp] ${signal} received, shutting down...`);
+    httpServer.close();
+    await telemetry.shutdown();
+    process.exit(0);
+}
+process.on("SIGTERM", () => void shutdown("SIGTERM"));
+process.on("SIGINT", () => void shutdown("SIGINT"));
 //# sourceMappingURL=http-server.js.map

package/dist/index.js

@@ -2,6 +2,7 @@
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 import { createServer } from "./server.js";
 import { cleanupTempDir, getTempDir } from "./bridge/file-bridge.js";
+import { getTelemetry } from "./telemetry.js";
 import { execFileSync } from "child_process";
 import { fileURLToPath } from "url";
 import path from "path";
@@ -19,7 +20,7 @@ function debugLog(message) {
 const args = process.argv.slice(2);
 if (args.includes("--help") || args.includes("-h")) {
     console.log(`
-premiere-pro-mcp — MCP server for Adobe Premiere Pro (278 tools)
+premiere-pro-mcp — MCP server for Adobe Premiere Pro (279 tools)
 
 Usage:
   premiere-pro-mcp              Start the MCP server (stdio transport)
@@ -79,6 +80,8 @@ if (args.includes("--install-cep") || args.includes("--diagnose-cep")) {
     process.exit(0);
 }
 async function main() {
+    process.env.PREMIERE_MCP_TRANSPORT = "stdio";
+    const telemetry = getTelemetry();
     const bridgeOptions = {
         tempDir: process.env.PREMIERE_TEMP_DIR,
         timeoutMs: process.env.PREMIERE_TIMEOUT_MS
@@ -102,7 +105,7 @@ async function main() {
         const address = uxpBridge.address();
         debugLog(`UXP bridge listening on ws://${address.host}:${address.port}${address.path}`);
     }
-    const server = createServer(bridgeOptions, { uxpBridge });
+    const server = createServer(bridgeOptions, { uxpBridge, telemetry });
     const transport = new StdioServerTransport();
     await server.connect(transport);
     debugLog("Server connected and ready");
@@ -110,6 +113,7 @@ async function main() {
         if (uxpBridge)
             await uxpBridge.stop();
         await server.close();
+        await telemetry.shutdown();
     };
     process.once("SIGINT", () => void shutdown().finally(() => process.exit(0)));
     process.once("SIGTERM", () => void shutdown().finally(() => process.exit(0)));

package/dist/security/capabilities.d.ts

@@ -19,5 +19,20 @@ export declare function requireCapability(config: CapabilityConfig, capability:
 export declare const UNSAFE_TOOL_NAMES: Set<string>;
 /** A conservative classification for centralized server registration. */
 export declare function capabilityForTool(toolName: string): Capability;
+/**
+ * Tools that stay advertised under every profile, because they are how an
+ * operator diagnoses a profile that is too narrow: get_capabilities reports the
+ * active authority, and ping proves the bridge is alive. Withholding them makes
+ * a misconfigured server look broken with no supported way to ask why.
+ */
+export declare const ALWAYS_LISTED_TOOL_NAMES: Set<string>;
+/**
+ * Whether a tool should appear in tools/list under the given profile.
+ *
+ * This is an advertising decision, not an enforcement one — guardToolHandler
+ * remains the authority check at call time. Keeping the two separate means a
+ * listing bug can never widen what a profile is actually allowed to do.
+ */
+export declare function isToolPermitted(toolName: string, config: CapabilityConfig): boolean;
 export declare function guardToolHandler<TArgs, TResult>(toolName: string, handler: (args: TArgs) => Promise<TResult>, config?: CapabilityConfig, createOperationId?: () => string): (args: TArgs) => Promise<TResult>;
 //# sourceMappingURL=capabilities.d.ts.map

package/dist/security/capabilities.js

@@ -39,7 +39,10 @@ export function requireCapability(config, capability, operationId) {
 }
 export const UNSAFE_TOOL_NAMES = new Set(["execute_extendscript", "send_raw_script", "evaluate_expression"]);
 const INSPECT_TOOL_NAMES = new Set(["ping", "get_capabilities", "preview_edit_plan"]);
-const FILESYSTEM_TOOL_NAMES = new Set(["apply_lut", "set_scratch_disk_path", "verify_delivery_file"]);
+// detect_silence reads a media file from disk and shells out to ffmpeg. It
+// changes nothing in Premiere, so classifying it as "edit" would overstate what
+// it does; filesystem is the authority it actually needs.
+const FILESYSTEM_TOOL_NAMES = new Set(["apply_lut", "set_scratch_disk_path", "verify_delivery_file", "detect_silence"]);
 /** A conservative classification for centralized server registration. */
 export function capabilityForTool(toolName) {
     if (UNSAFE_TOOL_NAMES.has(toolName))
@@ -56,6 +59,25 @@ export function capabilityForTool(toolName) {
     // keeps new tools fail-closed instead of silently bypassing the authority profile.
     return "edit";
 }
+/**
+ * Tools that stay advertised under every profile, because they are how an
+ * operator diagnoses a profile that is too narrow: get_capabilities reports the
+ * active authority, and ping proves the bridge is alive. Withholding them makes
+ * a misconfigured server look broken with no supported way to ask why.
+ */
+export const ALWAYS_LISTED_TOOL_NAMES = new Set(["ping", "get_capabilities"]);
+/**
+ * Whether a tool should appear in tools/list under the given profile.
+ *
+ * This is an advertising decision, not an enforcement one — guardToolHandler
+ * remains the authority check at call time. Keeping the two separate means a
+ * listing bug can never widen what a profile is actually allowed to do.
+ */
+export function isToolPermitted(toolName, config) {
+    if (ALWAYS_LISTED_TOOL_NAMES.has(toolName))
+        return true;
+    return config.capabilities.has(capabilityForTool(toolName));
+}
 export function guardToolHandler(toolName, handler, config = resolveCapabilities(), createOperationId = randomUUID) {
     const required = capabilityForTool(toolName);
     return async (args) => {

package/dist/server.d.ts

@@ -1,8 +1,16 @@
 import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
 import { BridgeOptions } from "./bridge/file-bridge.js";
 import type { UxpWebSocketBridge } from "./bridge/uxp-websocket-bridge.js";
+import { type Telemetry } from "./telemetry.js";
+/**
+ * Read the version from package.json rather than hardcoding it. A literal here
+ * silently drifts from the published package every release, which makes the
+ * version reported over MCP useless for triaging bug reports.
+ */
+export declare const SERVER_VERSION: string;
 export interface ServerOptions {
     uxpBridge?: UxpWebSocketBridge;
+    telemetry?: Telemetry;
 }
 export declare function createServer(bridgeOptions: BridgeOptions, serverOptions?: ServerOptions): McpServer;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.js

@@ -31,11 +31,31 @@ import { getEditPlanTools } from "./tools/edit-plans.js";
 import { getAvSettingsTools } from "./tools/av-settings.js";
 import { getRecoveryTools } from "./tools/recovery.js";
 import { getUxpTools } from "./tools/uxp.js";
-import { guardToolHandler, resolveCapabilities } from "./security/index.js";
+import { guardToolHandler, isToolPermitted, resolveCapabilities, } from "./security/index.js";
 import { EXTENDSCRIPT_REFERENCE } from "./resources/extendscript-reference.js";
 import { WORKFLOW_PROMPTS, WORKFLOW_RESOURCE } from "./workflows/catalog.js";
 import { annotationsForTool, structuredToolResult, } from "./workflows/tool-metadata.js";
+import { getTelemetry } from "./telemetry.js";
 import { z } from "zod";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+/**
+ * Read the version from package.json rather than hardcoding it. A literal here
+ * silently drifts from the published package every release, which makes the
+ * version reported over MCP useless for triaging bug reports.
+ */
+export const SERVER_VERSION = (() => {
+    try {
+        const here = path.dirname(fileURLToPath(import.meta.url));
+        const raw = readFileSync(path.resolve(here, "../package.json"), "utf8");
+        const version = JSON.parse(raw).version;
+        return typeof version === "string" && version ? version : "unknown";
+    }
+    catch {
+        return "unknown";
+    }
+})();
 const PREMIERE_INSTRUCTIONS = `You are controlling Adobe Premiere Pro through MCP tools. Follow these best practices:
 
 WORKFLOW ORDER:
@@ -222,18 +242,34 @@ function collectTools(bridgeOptions, capabilities, uxpBridge) {
 export function createServer(bridgeOptions, serverOptions = {}) {
     const server = new McpServer({
         name: "premiere-pro-mcp",
-        version: "1.2.0",
+        version: SERVER_VERSION,
     });
     const capabilities = resolveCapabilities();
+    const telemetry = serverOptions.telemetry ?? getTelemetry();
     // Collect all tools from each module
     const toolModules = collectTools(bridgeOptions, capabilities, serverOptions.uxpBridge);
     // Register each tool with the MCP server
+    let withheld = 0;
     for (const [name, tool] of Object.entries(toolModules)) {
+        // Don't advertise tools the active authority profile will always refuse.
+        // guardToolHandler still rejects them at call time, but listing an
+        // unusable tool spends client context and invites the model to attempt a
+        // call that cannot succeed.
+        if (!isToolPermitted(name, capabilities)) {
+            withheld++;
+            continue;
+        }
         const zodShape = jsonSchemaToZodShape(tool.parameters);
         const guardedHandler = guardToolHandler(name, tool.handler, capabilities);
         server.tool(name, tool.description, zodShape, annotationsForTool(name), async (args) => {
+            const startedAt = Date.now();
             try {
                 const result = await guardedHandler(args);
+                telemetry.capture("mcp_tool_call", {
+                    tool: name,
+                    outcome: result.success ? "succeeded" : "failed",
+                    duration_ms: Date.now() - startedAt,
+                });
                 if (result.success) {
                     // Special handling for capture_frame: return image content block
                     const data = result.data;
@@ -281,6 +317,12 @@ export function createServer(bridgeOptions, serverOptions = {}) {
                 }
             }
             catch (err) {
+                telemetry.capture("mcp_tool_call", {
+                    tool: name,
+                    outcome: "failed",
+                    duration_ms: Date.now() - startedAt,
+                    error_type: err instanceof Error ? err.name : "UnknownError",
+                });
                 return {
                     structuredContent: structuredToolResult(name, false, undefined, err instanceof Error ? err.message : String(err)),
                     content: [
@@ -294,6 +336,11 @@ export function createServer(bridgeOptions, serverOptions = {}) {
             }
         });
     }
+    if (withheld > 0) {
+        debugLog(`Withheld ${withheld} tool(s) from tools/list — not permitted by the ` +
+            `active capability profile (${[...capabilities.capabilities].sort().join(", ")}). ` +
+            `Call get_capabilities to see the enabled authority.`);
+    }
     // Register LLM instructions resource
     server.resource("premiere-instructions", "config://premiere-instructions", {
         description: "Instructions and best practices for using Premiere Pro via MCP tools",

package/dist/telemetry.d.ts

@@ -0,0 +1,8 @@
+export type TelemetryProperties = Record<string, string | number | boolean | null | undefined>;
+export interface Telemetry {
+    readonly enabled: boolean;
+    capture(event: string, properties?: TelemetryProperties): void;
+    shutdown(): Promise<void>;
+}
+export declare function getTelemetry(): Telemetry;
+//# sourceMappingURL=telemetry.d.ts.map

package/dist/telemetry.js

@@ -0,0 +1,63 @@
+import { randomUUID } from "node:crypto";
+import { PostHog } from "posthog-node";
+class PostHogTelemetry {
+    client;
+    distinctId;
+    commonProperties;
+    enabled = true;
+    constructor(client, distinctId, commonProperties) {
+        this.client = client;
+        this.distinctId = distinctId;
+        this.commonProperties = commonProperties;
+    }
+    capture(event, properties = {}) {
+        this.client.capture({
+            distinctId: this.distinctId,
+            event,
+            properties: {
+                ...this.commonProperties,
+                ...properties,
+                $process_person_profile: false,
+            },
+        });
+    }
+    async shutdown() {
+        await this.client.shutdown();
+    }
+}
+const disabledTelemetry = {
+    enabled: false,
+    capture: () => { },
+    shutdown: async () => { },
+};
+let telemetry;
+export function getTelemetry() {
+    if (telemetry)
+        return telemetry;
+    const apiKey = process.env.POSTHOG_API_KEY;
+    if (!apiKey) {
+        telemetry = disabledTelemetry;
+        return telemetry;
+    }
+    const host = process.env.POSTHOG_HOST ?? "https://us.i.posthog.com";
+    const distinctId = process.env.POSTHOG_DISTINCT_ID ??
+        process.env.FLY_MACHINE_ID ??
+        `server-${randomUUID()}`;
+    const client = new PostHog(apiKey, {
+        host,
+        // MCP servers may be idle for long stretches. Flush each bounded operational
+        // event promptly so a low-volume deployment remains observable.
+        flushAt: 1,
+        flushInterval: 10_000,
+    });
+    telemetry = new PostHogTelemetry(client, distinctId, {
+        service: "premiere-pro-mcp",
+        service_version: process.env.npm_package_version ?? "unknown",
+        environment: process.env.POSTHOG_ENVIRONMENT ?? process.env.NODE_ENV ?? "production",
+        region: process.env.FLY_REGION,
+        transport: process.env.PREMIERE_MCP_TRANSPORT ?? "unknown",
+    });
+    console.error(`[premiere-pro-mcp] PostHog telemetry enabled (${host})`);
+    return telemetry;
+}
+//# sourceMappingURL=telemetry.js.map