Repository navigation
docs(mcp-analytics): Ruby identify reads the Authorization header - #21662
Merged
Merged
Conversation
github-actions
Bot
added
docs
PostHog/posthog-ruby#320 passes every HTTP request header to MCP callbacks in extra["headers"]. The Ruby identify samples in identifying-users.mdx and installation/ruby.mdx now resolve the user from the bearer token, like the TS and Python samples, instead of saying Ruby can't read Authorization and pointing at a session lookup or the custom dispatcher. installation/ruby.mdx also carries the "don't return raw header values" warning. Gated on posthog-ruby 3.29.0: confirm the version once #320 ships, then merge. Tested: diff reviewed. No local node_modules, so fix-mdx/vale run in CI.
Contributor
Deploy preview
Changed pages
|
lucasheriques
force-pushed
the
lucas/mcp-ruby-auth-header
branch
from
October 27, 2026 22:46
230f082 to
22123d2
Compare
Contributor
|
Vale prose linter → found 0 errors, 11 warnings, 3 suggestions in your markdown Full report → Copy the linter results into an LLM to batch-fix issues. Linter being weird? Update the rules!
|
| Line | Severity | Message | Rule |
|---|---|---|---|
| 14:20 | warning | Use 'ID' instead of 'id'. | Vale.Terms |
| 17:79 | suggestion | Address the reader directly. Use 'you' instead of 'the user'. | PostHogDocs.DirectAddress |
| 70:11 | warning | Use 'SDK' instead of 'sdk'. | Vale.Terms |
| 107:301 | warning | Use 'SDK' instead of 'sdk'. | Vale.Terms |
| 125:126 | suggestion | Address the reader directly. Use 'you' instead of 'the user'. | PostHogDocs.DirectAddress |
contents/docs/mcp-analytics/installation/ruby.mdx — 0 errors, 8 warnings, 1 suggestions
| Line | Severity | Message | Rule |
|---|---|---|---|
| 11:226 | warning | Capitalize 'Logs' for PostHog's product. Use 'logs' for the general industry concept. | PostHogBase.ProductNames |
| 13:45 | warning | Use 'PostHog' instead of 'posthog'. | Vale.Terms |
| 17:311 | warning | 'Streamable' is a possible misspelling. | PostHogBase.Spelling |
| 77:11 | warning | 'stderr' is a possible misspelling. | PostHogBase.Spelling |
| 79:27 | warning | 'stdout' is a possible misspelling. | PostHogBase.Spelling |
| 79:168 | warning | 'stderr' is a possible misspelling. | PostHogBase.Spelling |
| 79:214 | warning | 'stdout' is a possible misspelling. | PostHogBase.Spelling |
| 125:80 | warning | 'stdout' is a possible misspelling. | PostHogBase.Spelling |
| 127:269 | suggestion | Address the reader directly. Use 'you' instead of 'the user'. | PostHogDocs.DirectAddress |
![posthog[bot]](https://avatars.githubusercontent.com/in/1203049?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
PostHog Review · Standard · reviewed 230f082: 1 Should fix.
See this review and its findings in PostHog Review. Comment @posthog review --deep for a Deep review. A Deep review takes longer and looks deeper than a Standard review.
| ``` | ||
|
|
||
| To identify from a bearer token, use a [custom dispatcher](#custom-dispatchers), which takes `distinct_id:` on each capture. | ||
| The SDK never captures header values. Don't return a raw token, cookie, or API key in `properties:` or from `event_properties`, because the SDK doesn't redact those, and person properties persist on the person profile. Resolve the header to an ID first. |
Contributor
There was a problem hiding this comment.
P2 · Identify the headers captured automatically
For HTTP requests, TransportIdentity.stamp copies User-Agent and X-Anthropic-Client into $mcp_client_user_agent and $mcp_vendor_client on captured events. The blanket privacy guarantee therefore misleads users who rely on it to keep header data out of PostHog; explicitly identify the captured exceptions.
Contributor
Bundle reportTotal JS (gzip)10.53 MiB (no change) Eager graph (modules shipped in each entrypoint's initial chunks)
Largest modules in the
|
| Module | Size |
|---|---|
./src/data/mcp-tools.json |
1459.0 KiB |
css ./node_modules/.pnpm/css-loader@5.2.7_webpack@5.101.3/node_modules/css-loader/dist/cjs.js??ruleSet[1].rules[8].oneOf[1].use[1]!./node_modules/.pnpm/postcss-loader@4.3.0_postcss@8.5.6_webpack@5.101.3/node_modules/postcss-loader/dist/cjs.js??ruleSet[1].rules[8].oneOf[1].use[2]!./src/styles/global.css |
840.9 KiB |
./src/components/Stickers/Stickers.tsx |
696.4 KiB |
./node_modules/.pnpm/@posthog+brand@0.13.0_react@18.3.1/node_modules/@posthog/brand/dist/generated/hoggies/svg/x-ray.mjs |
481.2 KiB |
./node_modules/.pnpm/@posthog+brand@0.13.0_react@18.3.1/node_modules/@posthog/brand/dist/generated/hoggies/svg/trenchcoat.mjs |
450.8 KiB |
./node_modules/.pnpm/rehype-raw@7.0.0/node_modules/rehype-raw/lib/index.js + 29 modules |
395.1 KiB |
./node_modules/.pnpm/@posthog+brand@0.13.0_react@18.3.1/node_modules/@posthog/brand/dist/generated/hoggies/svg/im-the-driver.mjs |
385.8 KiB |
./src/hooks/useCustomers.tsx + 61 modules |
381.8 KiB |
./node_modules/.pnpm/@posthog+brand@0.13.0_react@18.3.1/node_modules/@posthog/brand/dist/generated/hoggies/svg/tourist.mjs |
364.6 KiB |
./node_modules/.pnpm/@posthog+icons@0.36.6_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/@posthog/icons/dist/posthog-icons.es.js |
354.8 KiB |
./node_modules/.pnpm/react-markdown@8.0.7_@types+react@16.14.66_react@18.3.1/node_modules/react-markdown/lib/react-markdown.js + 88 modules |
351.4 KiB |
./src/components/ProductComparisonTable/index.tsx + 130 modules |
314.4 KiB |
./node_modules/.pnpm/framer-motion@14.0.0_react-dom@18.3.1_react@18.3.1__react@18.3.1/node_modules/framer-motion/dist/es/render/components/motion/proxy.mjs + 126 modules |
287.2 KiB |
./node_modules/.pnpm/@posthog+brand@0.13.0_react@18.3.1/node_modules/@posthog/brand/dist/generated/hoggies/svg/doll-house.mjs |
284.1 KiB |
./node_modules/.pnpm/cloudinary-core@2.14.0_lodash@4.17.21/node_modules/cloudinary-core/cloudinary-core.js |
281.9 KiB |
Eager-graph budgets are report-only until a baseline is established. Sizes are gzip of public/**/*.js; eager size is webpack module source bytes for the modules actually shipped in the entrypoint's initial chunks (post-tree-shake).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
PostHog/posthog-ruby#320 gives MCP
identify,intent_fallbackandevent_propertiescallbacks every HTTP request header inextra["headers"], with lowercase keys. Before that, Ruby passed only four headers, so these docs told Ruby users thatidentifycan't readAuthorization.identifying-users.mdx. The Rubyidentifysample now resolves the user from theauthorizationbearer token, the same way the TypeScript and Python samples do. The paragraph after it no longer sends Ruby users to a session lookup or the custom dispatcher.installation/ruby.mdx. Theextradescription now saysheadersholds every request header. The bearer-token sample replaces the session lookup. The page also warns that raw header values returned inproperties:orevent_propertiesare sent unredacted, which matches the Python helper's docstring.Checklist