Skip to content

Added call_tool #153

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 5, 2025
Merged

Added call_tool #153

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions src/server.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ import {getConfig, setConfigValue} from './tools/config.js';
import {trackToolCall} from './utils/trackTools.js';

import {VERSION} from './version.js';
import {capture} from "./utils/capture.js";
import {capture, capture_call_tool} from "./utils/capture.js";

console.error("Loading server.ts");

Expand Down Expand Up @@ -390,7 +390,7 @@ import {ServerResult} from './types.js';
server.setRequestHandler(CallToolRequestSchema, async (request: CallToolRequest): Promise<ServerResult> => {
try {
const {name, arguments: args} = request.params;
capture('server_call_tool', {
capture_call_tool('server_call_tool', {
name
});

Expand Down
29 changes: 20 additions & 9 deletions src/utils/capture.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,12 +10,6 @@ try {
} catch {
// Continue without version info if not available
}
// Configuration
const GA_MEASUREMENT_ID = 'G-NGGDNL0K4L'; // Replace with your GA4 Measurement ID
const GA_API_SECRET = '5M0mC--2S_6t94m8WrI60A'; // Replace with your GA4 API Secret
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
const GA_DEBUG_BASE_URL = `https://www.google-analytics.com/debug/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;


// Will be initialized when needed
let uniqueUserId = 'unknown';
Expand Down Expand Up @@ -81,13 +75,13 @@ export function sanitizeError(error: any): { message: string, code?: string } {
* @param event Event name
* @param properties Optional event properties
*/
export const capture = async (event: string, properties?: any) => {
export const captureBase = async (captureURL: string, event: string, properties?: any) => {
try {
// Check if telemetry is enabled in config (defaults to true if not set)
const telemetryEnabled = await configManager.getValue('telemetryEnabled');

// If telemetry is explicitly disabled or GA credentials are missing, don't send
if (telemetryEnabled === false || !GA_MEASUREMENT_ID || !GA_API_SECRET) {
if (telemetryEnabled === false || !captureURL) {
return;
}

Expand Down Expand Up @@ -165,7 +159,7 @@ export const capture = async (event: string, properties?: any) => {
}
};

const req = https.request(GA_BASE_URL, options, (res) => {
const req = https.request(captureURL, options, (res) => {
// Response handling (optional)
let data = '';
res.on('data', (chunk) => {
Expand Down Expand Up @@ -197,3 +191,20 @@ export const capture = async (event: string, properties?: any) => {
// Silently fail - we don't want analytics issues to break functionality
}
};

export const capture_call_tool = async (event: string, properties?:any) => {
const GA_MEASUREMENT_ID = 'G-35YKFM782B'; // Replace with your GA4 Measurement ID
const GA_API_SECRET = 'qM5VNk6aQy6NN5s-tCppZw'; // Replace with your GA4 API Secret
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
const GA_DEBUG_BASE_URL = `https://www.google-analytics.com/debug/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
return await captureBase(GA_BASE_URL, event, properties);
}
Comment on lines +195 to +201
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Critical security issue: Hardcoded API credentials exposed in source code.

The Google Analytics API secret and measurement ID are hardcoded in the source code, which poses a significant security risk. These credentials should be stored in environment variables or a secure configuration system.

-export const capture_call_tool = async (event: string, properties?:any) => {
-    const GA_MEASUREMENT_ID = 'G-35YKFM782B'; // Replace with your GA4 Measurement ID
-    const GA_API_SECRET = 'qM5VNk6aQy6NN5s-tCppZw'; // Replace with your GA4 API Secret
-    const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
-    const GA_DEBUG_BASE_URL = `https://www.google-analytics.com/debug/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;    
-    return await captureBase(GA_BASE_URL, event, properties);
-}
+export const capture_call_tool = async (event: string, properties?:any) => {
+    const GA_MEASUREMENT_ID = process.env.GA_CALL_TOOL_MEASUREMENT_ID || '';
+    const GA_API_SECRET = process.env.GA_CALL_TOOL_API_SECRET || '';
+    
+    if (!GA_MEASUREMENT_ID || !GA_API_SECRET) {
+        console.warn('GA credentials not configured for call_tool capture');
+        return;
+    }
+    
+    const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
+    return await captureBase(GA_BASE_URL, event, properties);
+}
🧰 Tools
🪛 Gitleaks (8.26.0)

197-197: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents 
In src/utils/capture.ts around lines 195 to 201, the Google Analytics API secret
and measurement ID are hardcoded, exposing sensitive credentials. To fix this,
remove the hardcoded values and instead read GA_MEASUREMENT_ID and GA_API_SECRET
from environment variables using process.env. Update the code to use these
environment variables when constructing the GA_BASE_URL and GA_DEBUG_BASE_URL,
ensuring credentials are not stored directly in the source code.


export const capture = async (event: string, properties?: any) => {
const GA_MEASUREMENT_ID = 'G-NGGDNL0K4L'; // Replace with your GA4 Measurement ID
const GA_API_SECRET = '5M0mC--2S_6t94m8WrI60A'; // Replace with your GA4 API Secret
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
const GA_DEBUG_BASE_URL = `https://www.google-analytics.com/debug/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;

return await captureBase(GA_BASE_URL, event, properties);
}
Comment on lines +203 to +210
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue

Critical security issue: Hardcoded API credentials exposed in source code.

Similar to the capture_call_tool function, this implementation exposes sensitive credentials in the source code. Move these to environment variables.

-export const capture = async (event: string, properties?: any) => {
-    const GA_MEASUREMENT_ID = 'G-NGGDNL0K4L'; // Replace with your GA4 Measurement ID
-    const GA_API_SECRET = '5M0mC--2S_6t94m8WrI60A'; // Replace with your GA4 API Secret
-    const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
-    const GA_DEBUG_BASE_URL = `https://www.google-analytics.com/debug/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
-
-    return await captureBase(GA_BASE_URL, event, properties);
-}
+export const capture = async (event: string, properties?: any) => {
+    const GA_MEASUREMENT_ID = process.env.GA_MEASUREMENT_ID || '';
+    const GA_API_SECRET = process.env.GA_API_SECRET || '';
+    
+    if (!GA_MEASUREMENT_ID || !GA_API_SECRET) {
+        console.warn('GA credentials not configured for capture');
+        return;
+    }
+    
+    const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
+    return await captureBase(GA_BASE_URL, event, properties);
+}
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
export const capture = async (event: string, properties?: any) => {
const GA_MEASUREMENT_ID = 'G-NGGDNL0K4L'; // Replace with your GA4 Measurement ID
const GA_API_SECRET = '5M0mC--2S_6t94m8WrI60A'; // Replace with your GA4 API Secret
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
const GA_DEBUG_BASE_URL = `https://www.google-analytics.com/debug/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
return await captureBase(GA_BASE_URL, event, properties);
}
export const capture = async (event: string, properties?: any) => {
const GA_MEASUREMENT_ID = process.env.GA_MEASUREMENT_ID || '';
const GA_API_SECRET = process.env.GA_API_SECRET || '';
if (!GA_MEASUREMENT_ID || !GA_API_SECRET) {
console.warn('GA credentials not configured for capture');
return;
}
const GA_BASE_URL = `https://www.google-analytics.com/mp/collect?measurement_id=${GA_MEASUREMENT_ID}&api_secret=${GA_API_SECRET}`;
return await captureBase(GA_BASE_URL, event, properties);
}
🧰 Tools
🪛 Gitleaks (8.26.0)

205-205: Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

(generic-api-key)

🤖 Prompt for AI Agents 
In src/utils/capture.ts around lines 203 to 210, the GA_MEASUREMENT_ID and
GA_API_SECRET are hardcoded, exposing sensitive credentials. Remove these
hardcoded values and instead read them from environment variables using
process.env, ensuring the credentials are not stored directly in the source
code. Update the GA_BASE_URL and GA_DEBUG_BASE_URL to use these environment
variables accordingly.