fix(mcp-analytics): suggest server apps before setup - #1239
Open
lucasheriques wants to merge 4 commits into
Open
fix(mcp-analytics): suggest server apps before setup#1239lucasheriques wants to merge 4 commits into
lucasheriques wants to merge 4 commits into
Conversation
Suggest local MCP server entry points before authentication and let users correct the directory or choose a file. Keep agent discovery available for custom servers, and explain the separate command for connecting PostHog to a coding agent. Run against the selected project directory and ask the agent to verify the chosen entry point. Use language-appropriate SDK instructions and finish with first-event steps and a link to the authenticated project and region. Record selection outcomes without including local paths in the new events. Validation: - Build and smoke checks passed. - All 2,595 tests passed with vitest run --maxWorkers=4. - Real Ink keyboard checks passed for directory/file recovery, custom server discovery, client guidance, and duplicate submissions. - pnpm fix and the targeted ESLint checks passed. - Typecheck reports 26 diagnostics identical to the clean base commit. The initial unrestricted test run hit a CLI timeout; the isolated CLI suite and full four-worker suite passed. Event ingestion verification and live activation measurement remain outside this change. Installation completion is not proof that data has arrived.
🧙 Wizard CIRun the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands: Test all apps:
Test all apps in a directory:
Test an individual app:
Show more apps
Test against a Context Mill branch:
Add Results will be posted here when complete. |
Start setup directly from a single detected server and make agent discovery primary when the scan is inconclusive. Keep manual paths optional and review ambiguous selections. Recognize the official Python v2 MCPServer constructor. Validation: build and smoke checks passed; 2,596 tests passed with four workers; real Ink keyboard checks and pnpm fix passed. Typecheck diagnostics match the clean base. Full authenticated wizard installs remain untested.
lucasheriques
changed the title
![veria-ai[bot]](https://avatars.githubusercontent.com/in/1723776?s=60&v=4){kind=small}
| ); | ||
| store.setFrameworkContext(MCP_SCAN_ERROR_KEY, undefined); | ||
| setView(View.Select); | ||
| } else if (startSetup) { |
There was a problem hiding this comment.
Medium: Automatic selection can expand the agent root
resolveMcpTarget searches upward for project markers, so a directory beneath another project can supply one matching server file and resolve to the enclosing project root. Auto-confirming that result makes the enclosing root the agent’s working directory, allowing attacker-controlled project content to direct reads or writes against sibling files that the user did not select; retain the review screen whenever resolution changes the directory.
Suggested change
| } else if (startSetup) { | |
| } else if (startSetup && resolved.directory === directory) { |
PR overviewThis pull request updates the MCP analytics setup flow to suggest available servers and use discovery by default. The intro screen resolves the selected directory to an MCP project target and can proceed directly into setup. One issue remains in the automatic setup path: resolving a selected directory can move the agent’s working root to an enclosing project without retaining the user review step. In a crafted project layout, this could expose sibling files outside the directory the user intended to select to agent-directed reads or writes. Open issues (1)
Fixed/addressed: 0 · PR risk: 7/10 |
Recognize generic FastMCP and Mastra constructors. Reserve a bounded scan pass for likely server paths so unrelated files cannot consume the whole budget. Filter test fixtures and comment-only examples, and order application packages before examples and templates. Validation: 2,600 unit tests, build/security smoke checks, screen checks and pnpm fix passed. Twenty real-repository keyboard flows passed across nine starting directories. Typecheck matches all 26 clean-base diagnostics. Validation covers discovery and selection, not full agent installation or runtime instrumentation support for the recognized wrapper classes.
Group JavaScript entry points by runnable application package and follow runtime workspace dependencies to include factory consumers. Exclude client apps and development-only relationships. Route shared-library-only scans and MCP launchers through guided discovery instead of selecting a helper file. Pass scoped app/source-tracing instructions to the agent and document the bounded metadata scan. Keep Python file suggestions and manual recovery. Validation: 2,612 unit tests, build/security smoke checks, lint and screen checks passed. 35 keyboard flows passed on six public repos across eight starting directories. Typecheck matches all 26 clean-base diagnostics. Full agent installation, runtime wrapper compatibility and ingestion remain outside this validation.
lucasheriques
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
MCP analytics users starting from a monorepo root can select a shared helper instead of the server they want to instrument.
A generic intro also misses custom constructors and gives no useful explanation when a launcher delegates to another package.
Changes
Real Ink renders use fictional example projects:
Launcher source tracing:
Test plan
Source probes now suggest Cloudflare's 18 app packages and Supabase's two server packages. Playwright's launcher gets source-tracing guidance.
Firecrawl remains a single application; official MCP servers retain seven choices; Mastra's server apps exclude its client apps.
Pinned validation repositories: Cloudflare, Supabase, Playwright MCP, Firecrawl MCP, official MCP servers, and Mastra.
These checks cover discovery and selection before authentication. Full agent installations, wrapper runtime compatibility, and event ingestion were not exercised.
Suggestions remain bounded heuristics; they do not certify SDK compatibility or successful activation.
LLM context
Codex implemented the change in an isolated wizard checkout. Unit fixtures and screenshot projects are fictional; public repository clones remained unchanged.
🤖 Agent context
Skills used: debugging-mcp-analytics, wizard-development, adding-skill-program, ink-tui, exploring-the-wizard, and writing-pr-descriptions.