feat(mcp): reduce PII in $mcp_intent (redaction + stronger prompt)

[gesh]

Problem

$mcp_intent is free text the calling agent writes into the injected context argument. Agents sometimes narrate personal data (emails, phone numbers, names) into it, and the SDK previously stored it almost verbatim — the only cleanup removed PostHog tokens and large binary blobs, and the "no personal data" instruction was prompt-only, not enforced.

Changes

Two layers, both scoped to @posthog/mcp:

• Always-on redaction (redactPii in mcp-payloads.ts, applied to userIntent in sanitization.ts): strips structured identifiers — emails, phone numbers, IPv4/IPv6, Luhn-valid card numbers, US SSNs — from $mcp_intent before capture. Covers both the instrument() and PostHogMCP paths via the shared sanitizeEvent. Scoped to the intent only; structured tool arguments/results are untouched, since the same shapes are often legitimate there.
• Stronger default context prompt (DEFAULT_CONTEXT_PARAMETER_DESCRIPTION): now forbids repeating/paraphrasing/inferring personal data and tells the agent to generalize entities to roles ("a user", "the customer") — covering names, which regex cannot. Tests reference the constant symbolically, so no assertions changed.

Unit tests added for both. All 694 @posthog/mcp unit tests pass; oxlint clean.

Libraries affected

• @posthog/mcp (not in the list below)

Checklist

• Tests for new code
• Accounted for the impact of any changes across different platforms
• Accounted for backwards compatibility (no API break; redaction changes only the captured $mcp_intent content)
• Took care not to unnecessarily increase the bundle size (a few regexes + one function)
• Ran pnpm changeset to generate a changeset file

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Built with PostHog Desktop (Claude Opus). The human driver chose the scope (redaction limited to the intent, always-on, no config flag), the structured-identifier pattern set, and the final wording of the default prompt. Names/addresses were deliberately left to the prompt layer rather than regex, to avoid over-redacting ordinary prose. tsc/rslib build OOM locally in this environment (pre-existing, unrelated to the diff); verified via the vitest suite and oxlint instead.

---

Created with PostHog Desktop

[greptile-apps]

Security Review

The phone-number redaction can leave personal data in $mcp_intent: slash-separated numbers are not matched, and long formatted numbers can be only partially replaced.

Prompt To Fix All With AI

### Issue 1
packages/mcp/src/extensions/mcp-payloads.ts:42
**Phone numbers remain exposed**

Common phone formats are not fully covered by this pattern. For example, `415/555/0142` is left unchanged because `/` is not accepted, while a long formatted number such as `+44 (0) 20 7946 0958` can be only partly replaced, leaving trailing digits in `$mcp_intent`. Expand the candidate handling and ensure that a match consumes the entire phone token.

> **How this was verified:** The shared sanitization path applies this exact regex to every captured intent, and neither `/` nor characters beyond its fixed span can be included in the replacement.

### Issue 2
packages/mcp/src/extensions/mcp-payloads.ts:42
**Timestamps resemble phone numbers**

The permissive phone detector also matches ordinary date-and-time text. For example, `2024-01-15 12:30 UTC` has ten digits and accepted grouping characters, so its `2024-01-15 12` prefix is replaced with `[redacted]`. This corrupts otherwise valid, non-PII intent text; add validation that distinguishes phone syntax from timestamps.

### Issue 3
packages/mcp/src/__tests__/mcp-payloads.test.ts:69-135
**Redaction tests repeat scaffolding**

These new cases repeatedly call `redactPii(input)` and compare one expected string. This violates the repository directive to prefer parameterised tests. Convert the equivalent cases to a table-driven `it.each` test while keeping separately named tests for genuinely distinct behavior; this repository requirement must be satisfied before merging.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "feat(mcp): strengthen default context pr..." | Re-trigger Greptile}

[veria-ai]

PR overview

All previously flagged issues have been addressed. No open security concerns remain on this pull request.

Security review

No open security issues remain on this pull request.

Fixed/addressed: 2 · PR risk: 0/10

[gesh]

Note

🤖 Automated comment by QA Swarm — not written by a human

Multi-perspective review across two rounds. Findings verified with deterministic reproductions, then fixed.

Verdict: 💬 APPROVE WITH NITS _{(round 2 @ a764145)}

Redaction is correctly scoped to $mcp_intent. Two review rounds found a safety bug, several under-redaction gaps, and (from human + bot review) precision bugs in the IPv6 and phone patterns. All were reproduced and fixed.

Fixed

• 🟠 ReDoS in the email pattern (O(n²), reachable pre-truncation) → bounded quantifiers (~13s → ~26ms at 80k chars).
• 🟡 Under-redaction → Unicode (NBSP) spaces normalized; dot/slash-grouped cards (Luhn-gated); space/dot-separated SSNs.
• 🟠 IPv6 (from @marandaneto) → 2001:db8:: (trailing ::) leaked and std::bad was over-redacted. Reworked into four bounded forms with a (?<![\w:]) boundary: trailing/middle/leading :: redact; hex-looking C++ scope is left intact.
• 🟡 Phone (from @marandaneto + greptile) → the loose "any 10-15 digits" heuristic over-redacted dates/versions, missed /-grouped numbers, and partially leaked long international numbers. Replaced with structural patterns (NANP 3-3-4 requiring a separator; international requiring a leading +). Dates, versions, bare digit runs, and order IDs are now left intact.
• ✅ Tests converted to table-driven it.each per the suite's style (greptile).

Remaining best-effort limitations (by design)

• Non-punycode IDN email domains, non-+ international phone formats, and bare un-punctuated numbers are not caught. Names and postal addresses cannot be matched by regex at all — the injected context prompt is the primary defense; redaction is the backstop.

Reviewers

Reviewer	Assessment
🧭 router (sonnet) + 🔎 opus	ReDoS + under-redaction gaps, all fixed.
👤 @marandaneto (human)	IPv6 :: leak/over-match + phone-as-date — all fixed & resolved.
🤖 greptile / veria	Phone precision, test style, email ReDoS — all addressed.

---

Automated by QA Swarm — not a human review

[marandaneto]

Automated advisory code review.

[marandaneto]

left one last comment otherwise lgtm

[marandaneto]

Automated advisory code review.

[marandaneto]

blocking: Adjacent expiry digits prevent card redaction — For Charging card 4111 1111 1111 1111 12/30 for renewal., the greedy candidate includes the expiry month. The combined number fails Luhn, so the entire match is returned unchanged, exposing the complete valid card in $mcp_intent. Recognize the valid card without absorbing adjacent numeric fields. Reproduction: reproduced — the focused pi-review-card.test.ts Vitest regression failed on this head with the complete card retained; the same card without expiry passed, and a temporary 16-digit candidate control made both cases pass.