PostHog Error Digest

SKILL.md preview

---
type: Skill
mode: read-only
name: PostHog Error Digest
category: dev
description: Weekly cross-project error overview from PostHog - enumerates every project the OAuth grant covers, pulls the last 7 days of error-tracking issues per project, ranks them by impact, flags what's new vs ongoing, and sends one digest with per-project totals, the top issues, and a clickable link to a full committed report of every issue.
var: ""
tags: [monitoring, errors, mcp]
mcp: [posthog]
capabilities: [external_api, read_only, sends_notifications]
---

Today is ${today}.

> **${var}** — optional scope override. Empty (default) → **all** projects the OAuth
> grant covers, **last 7 days**. Accepts:
> - `Nd` — change the window, e.g. `14d` or `30d` (bare number also read as days).
> - a comma-list of project name substrings — e.g. `web, api` limits to projects
>   whose name contains one of those (case-insensitive). Combine with a window:
>   `web, api, 14d`.
>
> This runs unattended — treat `${var}` as final, no confirmation step.

Give the operator a single, scannable overview of the errors across **every** one of
their PostHog projects for the past week. The heavy lifting is the **PostHog MCP
server** (`mcp.posthog.com/mcp`): it enumerates the projects and returns the
error-tracking issues, so you reason over structured facts (occurrence counts, users
affected, first/last-seen timestamps) instead of guessing. Your job is to fan out
across projects, rank by impact, separate new from ongoing, and write the digest.

## Capability notes (read before running or editing)

`mode: read-only` is load-bearing and shapes **how** this skill writes. The read-only
toolset (`scripts/skill_mode.sh`) drops `Write`, `Edit`, and `python`; it keeps `Read`,
the MCP tools, `curl`, `jq`, and `Bash` for `node`/`cat`/`echo`/`mkdir`/`date`/`jq`. So
every file this skill produces — the `./notify` body and the state snapshot — is
written with a **`cat` heredoc (or `node`) redirection**, never the Write tool and
never `python`. Reaching for `python` to build or send the digest gets denied mid-run
and the notification silently never ships. `./notify` itself works in read-only, but
its multi-line body must be a file written the way above — and that scratch file goes
under **`/tmp/`**, never `memory/`/`output/` (those are committed; only the Step 4
snapshot and Step 4b report are meant to persist).

## Detection & auth

The server is wired in `.mcp.json` as `posthog` by the dashboard MCP panel's one-click
**Connect** (OAuth 2.1 + PKCE against `oauth.posthog.com`; tokens stored as
`MCP_POSTHOG_TOKEN` + `MCP_POSTHOG_OAUTH`, and a fresh access token minted each run by
`scripts/mcp-oauth-refresh.sh`). Its tools surface as `mcp__posthog__*` — **discover
them from the server; the tool descriptions and their parameters are the source of
truth, don't assume a fixed list or fixed argument names.** The tools you'll reach for
are the ones for **scope** (list organizations, list projects, switch the active
organization/project — typically named like `organizations-get`, `projects-get`,
`switch-organization`, `switch-project`) and **error tracking** (list a project's
errors over a date range and fetch one error's detail — typically `list-errors` /
`error-details`). Use whatever the server actually exposes.

- **No `mcp__posthog__*` tool callable** → the server isn't connected (or its OAuth
  secrets are missing, in which case the workflow logged a `::warning::` and skipped
  MCP for the whole run). Log `POSTHOG_NOT_CONNECTED`, notify **once** pointing the
  operator at the dashboard → MCP → **Connect PostHog**, and exit.
- **Tools exist but return 401 / "invalid token" / "insufficient scope"** → the OAuth
  access token expired and the refresh failed (typically a rotated refresh token that
  couldn't be saved back — durable headless refresh needs `GH_SECRETS_PAT`; see
  `docs/mcp-oauth.md`), or the granted scopes are too narrow. Log `POSTHOG_AUTH_STALE`,
  notify the operator to **re-c

…