Skip to content

feat(skills): add instrument-reverse-proxy skill - #512

Merged
rafaeelaudibert merged 1 commit into
mainfrom
feat/reverse-proxy-skill
Nov 12, 2026
Merged

rafaeelaudibert merged 1 commit into
mainfrom
feat/reverse-proxy-skill

Conversation

@rafaeelaudibert

Copy link
Copy Markdown
Member

Problem

Agents that install PostHog had no skill for a reverse proxy. In a trial of hog setup with Claude Code, the user asked for a proxy afterwards. hog skills search reverse proxy returned only replay-debugging skills, so the agent fetched posthog.com docs with curl and wrote a Cloudflare Worker by hand. It never found the managed proxy's API tools (proxy-create, proxy-get, proxy-diagnose, …), which hog api and the MCP server already expose.

Changes

New omnibus skill instrument-reverse-proxy (context/skills/omnibus/instrument-reverse-proxy/), with the proxy overview and every platform page from posthog.com/docs/advanced/proxy as references.

  • Opt-in. It runs only when the user asks for a proxy or agrees to one an agent suggested. Setting one up can take steps only the user can do, such as a DNS record.
  • Self-hosted where it's easy, managed elsewhere. It prefers a self-hosted proxy when the platform makes it a small change: Next.js, Nuxt, SvelteKit, Remix, Cloudflare, Vercel, Netlify, or an nginx/Caddy/ingress config already in the repo. It also uses one when the managed proxy can't serve the app: self-hosted PostHog, HIPAA, EU-only edge, a Cloudflare zone hold, no admin or DNS access, or the plan's proxy limit. Everything else gets the managed proxy. A trade-offs table from the docs covers setup, DNS uncloaking, platform cost, maintenance, compliance and availability, so the agent can explain its choice.
  • Managed path uses the proxy-* API tools, which work through the MCP exec tool and hog api call. It checks proxy-list first, confirms the subdomain with the user before proxy-create, gives the exact CNAME, and uses proxy-diagnose / proxy-retry when provisioning fails. It doesn't switch api_host until the status is valid. Until then it makes the host configurable and leaves the default pointing at PostHog.
  • Region. It finds the region from the calling tool, posthog.json, or the current api_host, and otherwise asks. It never assumes US.
  • Verification uses /array/<token>/config.js and /flags, which write no events. It warns that posthog-js's bot filter drops captures in automated browsers.

New reverse-proxy commandments: region routing, ui_host, the self-hosted header and body-size checklist from the proxy reference, and the two managed proxy rules. The skill also carries javascript_web.

Links from the install skills. instrument-integration, instrument-product-analytics and instrument-error-tracking now name the new skill where they already suggest a proxy in the final message.

How I tested it

  • npm test: 321 tests pass.
  • npm run build: emits omnibus-instrument-reverse-proxy.zip (SKILL.md, COMMANDMENTS.md, 17 references) and puts it in skills-mcp-resources.zip.
  • I served the built bundle locally and pointed hog at it (POSTHOG_MCP_LOCAL_SKILLS_URL). hog skills list shows instrument-reverse-proxy under implementation, it is the top result for hog skills search reverse proxy, and hog skills read instrument-reverse-proxy --file references/cloudflare.md works.

Not in this PR

  • No eval yet in evals/install-skills.
  • instrument-integration still says to set up a proxy during install when the framework reference documents one. I left that unchanged because it is existing wizard behavior.

🤖 Generated with Claude Code

Agents that install PostHog had no skill for a reverse proxy. In a trial
of `hog setup`, `hog skills search reverse proxy` matched nothing useful,
so the agent fetched posthog.com docs with curl and never found the
managed proxy's API tools (`proxy-create` and friends).

The new omnibus skill picks between a self-hosted proxy and PostHog's
managed proxy. It prefers self-hosted where the platform makes it a small
change (Next.js, Nuxt, SvelteKit, Remix, Cloudflare, Vercel, Netlify, or
an nginx/Caddy/ingress config already in the repo), and the managed proxy
elsewhere, with a trade-offs table from the proxy docs. It runs only when
the user asks for a proxy or agrees to one.

- The managed path uses the proxy-* API tools, which work through the MCP
  server and `hog api call`. It confirms the subdomain first, and doesn't
  switch `api_host` until the proxy is `valid`
- Verification uses `/array/<token>/config.js` and `/flags`, which write
  no events
- New `reverse-proxy` commandments: region routing, `ui_host`, the
  self-hosted header checklist, and the managed proxy rules
- instrument-integration, instrument-product-analytics and
  instrument-error-tracking name the skill where they suggest a proxy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@rafaeelaudibert
rafaeelaudibert requested a review from a team as a code owner November 12, 2026 18:57
@github-actions

Copy link
Copy Markdown

🧙 Wizard CI

Run the Wizard CI and test your changes against wizard-workbench example apps by replying with a GitHub comment using one of the following commands:

Test all apps:

  • /wizard-ci all

Test all apps in a directory:

  • /wizard-ci ai-observability
  • /wizard-ci basic-integration
  • /wizard-ci feature-flags
  • /wizard-ci mcp-analytics
  • /wizard-ci replay-vision
  • /wizard-ci revenue
  • /wizard-ci self-driving
  • /wizard-ci warehouse
  • /wizard-ci warehouse-seeded

Test an individual app:

  • /wizard-ci ai-observability/anthropic
  • /wizard-ci ai-observability/google-adk
  • /wizard-ci ai-observability/groq
Show more apps
  • /wizard-ci ai-observability/manual-capture
  • /wizard-ci ai-observability/openai
  • /wizard-ci ai-observability/openai-agents
  • /wizard-ci ai-observability/opentelemetry
  • /wizard-ci ai-observability/vercel-ai
  • /wizard-ci basic-integration/android
  • /wizard-ci basic-integration/angular
  • /wizard-ci basic-integration/astro
  • /wizard-ci basic-integration/django
  • /wizard-ci basic-integration/fastapi
  • /wizard-ci basic-integration/flask
  • /wizard-ci basic-integration/flutter
  • /wizard-ci basic-integration/javascript-node
  • /wizard-ci basic-integration/javascript-web
  • /wizard-ci basic-integration/laravel
  • /wizard-ci basic-integration/next-js
  • /wizard-ci basic-integration/nuxt
  • /wizard-ci basic-integration/python
  • /wizard-ci basic-integration/rails
  • /wizard-ci basic-integration/react-native
  • /wizard-ci basic-integration/react-router
  • /wizard-ci basic-integration/sveltekit
  • /wizard-ci basic-integration/swift
  • /wizard-ci basic-integration/tanstack-router
  • /wizard-ci basic-integration/tanstack-start
  • /wizard-ci basic-integration/vue
  • /wizard-ci feature-flags/django
  • /wizard-ci feature-flags/next-js
  • /wizard-ci mcp-analytics/custom-dispatcher
  • /wizard-ci mcp-analytics/go-sdk
  • /wizard-ci mcp-analytics/python-sdk
  • /wizard-ci mcp-analytics/ruby-sdk
  • /wizard-ci mcp-analytics/rust-sdk
  • /wizard-ci mcp-analytics/typescript-sdk
  • /wizard-ci replay-vision/javascript-node
  • /wizard-ci replay-vision/next-js
  • /wizard-ci replay-vision/react-vite
  • /wizard-ci revenue/stripe
  • /wizard-ci self-driving/astro
  • /wizard-ci self-driving/fastapi
  • /wizard-ci self-driving/nuxt
  • /wizard-ci self-driving/react-router
  • /wizard-ci self-driving/sveltekit
  • /wizard-ci warehouse/monorepo-env
  • /wizard-ci warehouse/multi-source-next
  • /wizard-ci warehouse/stripe-node
  • /wizard-ci warehouse/zero-source
  • /wizard-ci warehouse-seeded/next-stripe
  • /wizard-ci warehouse-seeded/next-stripe-declined

Test against a wizard branch:

  • /wizard-ci all wizard:my-branch

Add wizard:<branch> to any command above to pin the wizard branch. It defaults to main.

Results will be posted here when complete.

@rafaeelaudibert
rafaeelaudibert merged commit 66175c2 into main Nov 12, 2026
19 checks passed
Silthus added a commit that referenced this pull request Nov 13, 2026
Resolves add/add conflicts with #451's versions: main's migrate-email files equal #450's head, which #451 builds on. Brings in #512.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants