Skip to content

fix(mcp): accept PostHog UUIDs in evaluation tool parameters#53382

Open
andrewm4894 wants to merge 3 commits intomasterfrom
fix/mcp-uuid-validation
Open

fix(mcp): accept PostHog UUIDs in evaluation tool parameters#53382
andrewm4894 wants to merge 3 commits intomasterfrom
fix/mcp-uuid-validation

Conversation

@andrewm4894
Copy link
Copy Markdown
Member

@andrewm4894 andrewm4894 commented Apr 4, 2026

Problem

PostHog uses UUIDv7-style identifiers where the version nibble can be 0 (e.g. 019d5924-5d0e-0000-f0ff-8b13567dc212). Zod's built-in .uuid() validator rejects these because it requires version 1-8 per RFC 9562. This made it impossible to update, delete, get, or run evaluations via MCP tools — any evaluation ID returned by evaluation-create or evaluations-get would fail validation when passed back to other tools.

Changes

  • Replaced z.string().uuid() with plain z.string() in all 5 evaluation tool schemas (create, get, update, delete, run)
  • The API already returns 404 for invalid IDs, so client-side UUID format validation adds no value
  • Updated test snapshots

How did you test this code?

  • pnpm tsc --noEmit passes
  • pnpm vitest run — all 427 tests pass (1 pre-existing SSL cert failure unrelated to this change)
  • Snapshot tests updated with vitest -u

no

🤖 LLM context

Agent-authored PR. Discovered the bug while trying to use the MCP evaluation-update and evaluation-delete tools — every PostHog-generated UUID was rejected by Zod's strict UUID validation. Initially added a custom regex helper, then simplified to just dropping .uuid() entirely since the API handles validation.

PostHog uses UUIDv7-style identifiers where the version nibble can be
`0` (e.g. `019d5924-5d0e-0000-f0ff-...`). Zod's built-in `.uuid()`
rejects these because it requires version 1-8 per RFC 9562. This made
it impossible to update, delete, get, or run evaluations via MCP tools.

Replace `z.string().uuid()` with a shared `posthogUuid()` helper that
accepts any 8-4-4-4-12 hex string.
@greptile-apps
Copy link
Copy Markdown
Contributor

greptile-apps bot commented Apr 4, 2026

Prompt To Fix All With AI
This is a comment left during a code review.
Path: services/mcp/src/tools/llmAnalytics/evaluations/run.ts
Line: 8

Comment:
**`target_event_id` not validated with `posthogUuid`**

`target_event_id` is described as a UUID, but it still uses `z.string()` with no format validation. Now that `posthogUuid()` is available and imported in this file, this field could use the same validator for consistency — especially since passing an incorrectly formatted value here would silently reach the API.

```suggestion
    target_event_id: posthogUuid().describe('The UUID of the $ai_generation event to evaluate.'),
```

How can I resolve this? If you propose a fix, please make it concise.

Reviews (1): Last reviewed commit: "fix(mcp): accept PostHog UUIDs in evalua..." | Re-trigger Greptile

@andrewm4894 andrewm4894 self-assigned this Apr 4, 2026
PostHog UUIDs don't pass Zod's strict RFC 9562 validation. Rather than
rolling a custom regex, just use z.string() — the API handles invalid
IDs with a 404, so client-side format validation adds no value.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant