[CI] (81b9a8c) custom-dispatcher/hono-server

[wizard-ci-bot]

Automated wizard CI run

Source: context-mill-pr
Trigger ID: 81b9a8c
App: custom-dispatcher/hono-server
App directory: apps/custom-dispatcher/hono-server
Workbench branch: wizard-ci-81b9a8c-custom-dispatcher-hono-server
Wizard branch: main
Context Mill branch: codex/mcp-modern-capture-wizard
PostHog (MCP) branch: master
Timestamp: 2026-09-03T21:18:46.516Z
Duration: 329.2s

YARA Scanner

✓ 18 tool calls scanned, 0 violations detected

No violations: ✓ 18 clean scans

[wizard-ci-bot]

Now I have all the information needed. Let me produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog MCP analytics into a custom Hono-based MCP JSON-RPC dispatcher using @posthog/mcp (PostHogMCP). It adds captureInitialize on initialize, prepareToolList/prepareToolCall/captureToolCall on tool operations, exception autocapture, and graceful shutdown flushing. The .env file containing a real API key is committed but .gitignore is also added.

Files changed	Lines added	Lines removed
4	+132	-4

Confidence score: 4/5 👍

• Hardcoded API key committed in .env: The .env file contains a real PostHog project token (phc_nmum...) and is committed to the repo. Although .gitignore was added for .env, the file itself was committed in a prior state or alongside (it exists on disk and the .gitignore was added in this PR). The key is now in git history. [CRITICAL]
• No .env.example for documentation: While the report markdown mentions the env vars, there is no .env.example file committed to document required variables without exposing real values. [MEDIUM]

---

File changes

Filename	Score	Description
src/index.ts	4/5	Well-structured PostHog MCP integration with PostHogMCP client, captureInitialize, prepareToolList, prepareToolCall/captureToolCall, exception autocapture, and SIGTERM shutdown. Clean null-guarding throughout.
package.json	4/5	Correctly adds @posthog/mcp and posthog-node as dependencies
.gitignore	3/5	Adds .env to gitignore, but the .env file itself appears to be committed with a real key
posthog-mcp-analytics-report.md	4/5	Thorough documentation of what was changed and manual steps

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	TypeScript compiles, dependencies resolve, no syntax issues
Preserves existing env vars & configs	Yes	Existing app code and configs preserved; PostHog additions are additive
No syntax or type errors	Yes	All code is valid TypeScript with proper typing
Correct imports/exports	Yes	PostHogMCP from @posthog/mcp is correct; posthog-node listed as dependency
Minimal, focused changes	Yes	Only PostHog MCP instrumentation added, no scope creep
Pre-existing issues	None	Base app is clean

Issues

• Committed .env with real API key: The .env file contains phc_nmum54dVqUBEAmNrWgHdnRF8HRSCVQhxL6kRhy4GCV6a. Even though .gitignore now lists .env, the file is already tracked/committed. This key is now in git history. [CRITICAL]
• No .env.example: Environment variables are documented only in the report markdown, not in a standard .env.example file. [MEDIUM]

Other completed criteria

• Build configuration is valid — package.json scripts and dependencies are correct
• Changes are minimal and focused on PostHog MCP analytics instrumentation
• Existing app functionality fully preserved

---

PostHog implementation ✅

Criteria	Result	Description
PostHog SDKs installed	Yes	@posthog/mcp (^0.13.0) and posthog-node (^5.51.6) added to dependencies
PostHog client initialized	Yes	PostHogMCP constructed once at module scope with token from env var, host config, captureModel: true, and enableExceptionAutocapture: true
capture()	Yes	captureInitialize on initialize, captureToolCall on tools/call (success and error paths)
identify()	N/A	Server-only MCP dispatcher — no user identification needed
Error tracking	Yes	enableExceptionAutocapture: true in client config; error path in captureToolCall sets isError: true
Reverse proxy	N/A	Server-only app — no browser-side ad-blocker concerns

Issues

None

Other completed criteria

• API key loaded from process.env.POSTHOG_PROJECT_TOKEN (not hardcoded in source)
• Host correctly configured from process.env.POSTHOG_HOST with fallback to https://us.i.posthog.com
• Graceful shutdown via SIGTERM handler calling posthog.shutdown()
• Null-safe guarding throughout (posthog?.captureToolCall(...)) when token is missing
• prepareToolList correctly wraps tool advertisements
• prepareToolCall strips injected context and extracts intent/model metadata
• Duration tracking with Date.now() start/end

---

PostHog insights and events ✅

Filename	PostHog events	Description
src/index.ts	``	Captured on every initialize JSON-RPC call with client info, protocol version, and session ID
src/index.ts	``	Captured after every tools/call — both success and error paths — with tool name, parameters, response, duration, intent, model metadata, and session context
src/index.ts	``	Automatically emitted alongside failed tool calls via enableExceptionAutocapture

Issues

None

Other completed criteria

• Events represent real MCP protocol actions (initialize, tool calls, errors)
• Events include rich properties: tool name, parameters, duration, intent, model info, session ID, protocol version
• Event names follow PostHog's * convention
• No PII in event properties
• Error and success paths both instrumented with appropriate isError flag

---

Reviewed by wizard workbench PR evaluator