feat(mcp): redact structured PII from $mcp_intent + stronger prompt

[gesh]

Ports PostHog/posthog-js#4783 to the Python SDK.

$mcp_intent is agent-narrated free text written into the injected context argument, so a model can narrate personal data it read aloud. Two defensive layers:

• Always-on redaction of structured identifiers — emails, IPv4/IPv6, US SSNs, Luhn-valid card numbers, and phone numbers — scoped to the intent only. Structured tool arguments/responses are left untouched, since the same shapes are often legitimate there. Best-effort for well-defined shapes, not free-form names/addresses. Email quantifiers are bounded to avoid quadratic backtracking; every card in a multi-card span is redacted.
• Stronger default context prompt telling the agent not to repeat/paraphrase/infer personal data and to refer to people by role.

redact_pii lives in _sanitization.py and runs on user_intent after the existing token/secret scrub — a single choke point covering every adapter and the manual PostHogMCP path.

Tests

New parametrized redaction + intent-scoping tests in posthog/test/mcp/test_pipeline.py, mirroring the JS suite (per-identifier cases, multi-identifier, multi-card span, anti-quadratic timing guard, and sanitize_event scoping). Full MCP suite passes on both SDK v1 and v2 (Python 3.10 and 3.14).

---

Created with PostHog Desktop

[github-actions]

posthog-python Compliance Report

Date: 2026-09-07 10:36:13 UTC
Duration: 256312ms

✅ All Tests Passed!

111/111 tests passed

---

Capture_V1 Tests

✅ 94/94 tests passed

View Details

Test	Status	Duration
Endpoint And Method.Targets V1 Endpoint	✅	514ms
Endpoint And Method.Does Not Use Legacy Endpoints	✅	511ms
Required Headers.Has Authorization Bearer Header	✅	510ms
Required Headers.Has Content Type Json	✅	510ms
Required Headers.Has Posthog Sdk Info Format	✅	511ms
Required Headers.Has Posthog Attempt Header	✅	510ms
Required Headers.Has Posthog Request Id	✅	510ms
Required Headers.Has Posthog Request Timestamp	✅	511ms
Required Headers.Has User Agent	✅	510ms
Body Format.Body Has Created At And Batch	✅	510ms
Body Format.No Api Key In Body	✅	511ms
Body Format.No Sent At In Body	✅	511ms
Event Format.Event Has Required Root Fields	✅	510ms
Event Format.Event Uuid Is Valid	✅	511ms
Event Format.Event Timestamp Is Rfc3339	✅	510ms
Event Format.Distinct Id Is String	✅	510ms
Event Format.Distinct Id At Root Not Properties	✅	511ms
Event Format.Custom Properties Preserved	✅	510ms
Event Format.Set Properties Preserved	✅	510ms
Event Format.Set Once Properties Preserved	✅	510ms
Event Format.Groups Properties Preserved	✅	510ms
Event Format.Sdk Generates Uuid If Not Provided	✅	510ms
Event Format.Event Has Required Root Fields Batch	✅	514ms
Event Format.Event Uuid Is Valid Batch	✅	513ms
Event Format.Event Timestamp Is Rfc3339 Batch	✅	513ms
Event Format.Distinct Id Is String Batch	✅	514ms
Event Format.Distinct Id At Root Not Properties Batch	✅	513ms
Event Format.Custom Properties Preserved Batch	✅	513ms
Event Format.Set Properties Preserved Batch	✅	514ms
Event Format.Set Once Properties Preserved Batch	✅	513ms
Event Format.Groups Properties Preserved Batch	✅	514ms
Event Format.Sdk Generates Uuid If Not Provided Batch	✅	513ms
Batch Behavior.Multiple Events In Single Batch	✅	518ms
Batch Behavior.Batch Envelope Smoke	✅	516ms
Batch Behavior.Flush With No Events Sends Nothing	✅	506ms
Batch Behavior.Flush At Triggers Batch	✅	1011ms
Batch Behavior.Created At Reflects Batch Creation Time	✅	510ms
Deduplication.Generates Unique Uuids	✅	518ms
Deduplication.Different Events Same Content Different Uuids	✅	513ms
Deduplication.Preserves Uuid On Retry	✅	6519ms
Deduplication.Preserves Timestamp On Retry	✅	6515ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry	✅	6524ms
Deduplication.No Duplicate Events In Batch	✅	518ms
Header Behavior On Retry.Attempt Header Starts At One	✅	510ms
Header Behavior On Retry.Attempt Header Increments On Retry	✅	13528ms
Header Behavior On Retry.Request Id Preserved On Retry	✅	6519ms
Header Behavior On Retry.Different Requests Have Different Request Ids	✅	3020ms
Header Behavior On Retry.Request Timestamp Changes On Retry	✅	6520ms
Response Format Validation.Success Response Has Uuid Keyed Results	✅	511ms
Response Format Validation.Success Response Has Ok For Each Event	✅	514ms
Response Format Validation.Success No Retry After When All Ok	✅	512ms
Response Format Validation.Success Retry After Present When Retry Events	✅	1516ms
Response Format Validation.Success No Retry After When Drop Only	✅	513ms
Response Format Validation.Response Echoes Request Id	✅	510ms
Retry Behavior.Retries On 408	✅	6519ms
Retry Behavior.Retries On 500	✅	6519ms
Retry Behavior.Retries On 503	✅	8523ms
Retry Behavior.Retries On 504	✅	6517ms
Retry Behavior.Retryable Errors Have Retry After	✅	3517ms
Retry Behavior.Respects Retry After On Retryable Error	✅	11523ms
Retry Behavior.Does Not Retry On 400	✅	2515ms
Retry Behavior.Does Not Retry On 401	✅	2514ms
Retry Behavior.Does Not Retry On 402	✅	2514ms
Retry Behavior.Does Not Retry On 413	✅	2514ms
Retry Behavior.Does Not Retry On 415	✅	2512ms
Retry Behavior.Non Retryable Errors Have No Retry After	✅	2512ms
Retry Behavior.Implements Backoff	✅	22535ms
Retry Behavior.Max Retries Respected	✅	22526ms
Partial Batch Handling.Handles 200 Full Success	✅	2513ms
Partial Batch Handling.Handles 200 With All Ok	✅	3517ms
Partial Batch Handling.Does Not Retry Dropped Events	✅	3516ms
Partial Batch Handling.Does Not Retry Limited Events	✅	3516ms
Partial Batch Handling.Prunes Ok Events On Partial Retry	✅	6522ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry	✅	6522ms
Partial Batch Handling.Retries Only Retry Events From Partial	✅	6523ms
Partial Batch Handling.Partial Retry Preserves Uuids	✅	6521ms
Partial Batch Handling.Partial Retry Attempt Header Increments	✅	6518ms
Partial Batch Handling.Partial Retry Request Id Preserved	✅	6522ms
Partial Batch Handling.Respects Retry After On Partial	✅	8516ms
Partial Batch Handling.Unknown Result Treated As Terminal	✅	3518ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry	✅	3517ms
Compression.Sends Gzip Content Encoding	✅	511ms
Compression.No Content Encoding When Disabled	✅	510ms
Compression.Compressed Body Is Decompressible	✅	512ms
Error Handling.Does Not Retry On Unknown 4Xx	✅	2512ms
Event Options.Cookieless Mode Override	✅	511ms
Event Options.Disable Skew Correction Override	✅	510ms
Event Options.Process Person Profile Override	✅	510ms
Event Options.Product Tour Id Override	✅	510ms
Event Options.Unset Options Omitted	✅	510ms
Event Options.Options Override In Batch	✅	514ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties	✅	510ms
Geoip And Historical Migration.Historical Migration Set In Body	✅	510ms
Geoip And Historical Migration.Historical Migration Absent By Default	✅	511ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details

Test	Status	Duration
Request Payload.Request With Person Properties Device Id	✅	12ms
Request Payload.Flags Request Uses V2 Query Param	✅	10ms
Request Payload.Flags Request Hits Flags Path Not Decide	✅	10ms
Request Payload.Flags Request Omits Authorization Header	✅	8ms
Request Payload.Token In Flags Body Matches Init	✅	9ms
Request Payload.Groups Round Trip	✅	9ms
Request Payload.Groups Default To Empty Object	✅	8ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False	✅	8ms
Request Payload.Disable Geoip Omitted Defaults To False	✅	9ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key	✅	8ms
Request Lifecycle.No Flags Request On Init Alone	✅	3ms
Request Lifecycle.No Flags Request On Normal Capture	✅	508ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests	✅	15ms
Request Lifecycle.Mock Response Value Is Returned To Caller	✅	9ms
Retry Behavior.Retries Flags On 502	✅	313ms
Retry Behavior.Retries Flags On 504	✅	313ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event	✅	512ms

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
posthog/test/mcp/test_pipeline.py:324-331
**Unreliable performance measurement**

This test checks one execution against a one-second wall-clock limit. The repository requires performance tests to use clear thresholds such as average duration and standard deviation. A single measurement is vulnerable to scheduler noise and provides weak evidence about regressions, so this requirement must be satisfied before merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(mcp): redact structured PII from $m..." | Re-trigger Greptile}

[gesh]

QA Swarm review complete. See inline comments.

[gesh]

Note

🤖 Automated comment by QA Swarm — not written by a human

Multi-perspective review: router (cheap-first pass) + delegated reviewers as warranted

Verdict: 💬 APPROVE WITH NITS _{(round 1 @ 9c4ec97)}

A well-scoped, well-tested port of posthog-js#4783. The router independently fuzzed every redaction pattern for ReDoS (linear up to ~250k chars), confirmed the Luhn card scan / IPv6 / phone boundary logic, and verified redaction is wired only onto user_intent (not parameters/response). One low-severity robustness nit.

Key findings

• 🟢 LOW — redact_pii assumes a str argument; a non-string user_intent (reachable via the custom-event API, _capture.py:64) now raises TypeError where it previously passed through. Fails closed via _sink.py's try/except (event dropped + logged), so no leak/crash — a behavior regression, not a security hole. Suggest an isinstance(value, str) guard in redact_pii.

Convergence

None (single router pass; no delegation warranted for a LOW-danger, well-tested diff).

Reviewer summaries

Reviewer	Assessment
🧭 router	MEDIUM danger / HIGH confidence. Fuzzed all patterns for ReDoS, verified redaction scope and Luhn/IPv6/phone correctness, ran the sync test suite (pass). Delegated nothing — cheap pass sufficient.

---

Automated by QA Swarm — not a human review