fix(tasks): probe the resolved MCP host during startup

[tatoalo]

Problem

Agent startup diagnostics used a static MCP hostname even when the agent was configured with a region-specific or overridden endpoint. A blocked resolved endpoint could therefore be reported as having no detected egress block.

Changes

Move MCP URL resolution into shared task logic and include the resolved hostname in startup egress probes. This keeps US, EU, development, local, and configured override routing aligned with diagnostics.

Credential redaction at the agent persistence boundary is handled by PostHog/code#4046.

[trunk-io]

😎 Merged manually by @tatoalo - details.

[greptile-apps]

Prompt To Fix All With AI

### Issue 1
products/tasks/backend/logic/services/modal_sandbox.py:161-163
**Static MCP probe remains active**

When an EU, development, local, or custom MCP endpoint is configured, this prepends the resolved hostname but retains `mcp.posthog.com` from `SESSION_INIT_PROBE_HOSTS`. Because any failed host is reported as required blocked egress, an inaccessible but unused US endpoint produces a misleading startup diagnosis even when the configured MCP endpoint is reachable.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(tasks): probe the resolved MCP host ..." | Re-trigger Greptile}

[stamphog]

Contained diagnostics fix (moves MCP host resolution to a shared module and includes the resolved host in startup egress probes) by an author on the owning team; the one substantive Greptile finding (stale mcp.posthog.com left in the static probe list) is verifiably fixed in the current diff — mcp.posthog.com was removed from SESSION_INIT_PROBE_HOSTS and replaced with dynamic resolution, backed by new parameterized tests, and Greptile itself 👍'd the fix.

• Author wrote 11% of the modified lines and has 114 merged PRs in these paths (familiarity MODERATE).
• 👍 on the PR from greptile-apps[bot], hex-security-app[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	57L, 3F substantive, 84L/4F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1b-small (84L, 4F, single-area, fix)
stamphog 2.0.0b4		.stamphog/policy.yml @ b038735 · reviewed head 015929b

[github-actions]

🤖 CI report

⚠️ Backend coverage — 86.0% of changed backend lines covered — 4 uncovered

🧪 Backend test coverage

Patch coverage — changed backend lines (products + core): █████████████████░░░ 86.0% (26 / 30)

File	Patch	Uncovered changed lines
products/tasks/backend/temporal/process_task/utils.py	50.0%	698
products/tasks/backend/logic/services/mcp_url.py	81.2%	8, 16, 20

🤖 Agents: add a test covering the lines above, or note why under "How did you test this code?". Machine-readable gap list: the patch-coverage artifact on this run (gh run download 30645193188 -n patch-coverage), or the coverage-data block at the end of this comment.

Per-product line coverage (touched products)

Product	Coverage	Lines
demo	███████████░░░░░░░░░ 56.3%	1,497 / 2,661
tasks	██████████████░░░░░░ 70.2%	32,919 / 46,922
signals	████████████████░░░░ 81.4%	25,289 / 31,055
cdp	████████████████░░░░ 82.1%	3,285 / 3,999
data_modeling	█████████████████░░░ 85.7%	7,716 / 9,008
notebooks	█████████████████░░░ 86.0%	7,794 / 9,060
actions	█████████████████░░░ 86.6%	717 / 828
cohorts	██████████████████░░ 87.8%	6,181 / 7,040
exports	██████████████████░░ 87.9%	7,077 / 8,053
product_tours	██████████████████░░ 87.9%	1,303 / 1,482
data_warehouse	██████████████████░░ 88.4%	12,192 / 13,798
engineering_analytics	██████████████████░░ 89.3%	6,529 / 7,309
conversations	██████████████████░░ 89.4%	17,623 / 19,722
dashboards	██████████████████░░ 89.5%	5,989 / 6,693
alerts	██████████████████░░ 90.3%	4,482 / 4,966
streamlit_apps	██████████████████░░ 90.7%	2,630 / 2,901
mcp_analytics	██████████████████░░ 90.9%	3,191 / 3,511
error_tracking	██████████████████░░ 91.0%	10,928 / 12,010
slack_app	██████████████████░░ 91.1%	9,664 / 10,610
marketing_analytics	██████████████████░░ 91.2%	12,092 / 13,265
stamphog	██████████████████░░ 91.3%	4,505 / 4,936
product_analytics	███████████████████░ 92.5%	5,849 / 6,321
early_access_features	███████████████████░ 92.6%	1,287 / 1,390
ai_observability	███████████████████░ 92.8%	15,618 / 16,821
surveys	███████████████████░ 93.1%	5,771 / 6,197
posthog_ai	███████████████████░ 93.2%	1,326 / 1,422
web_analytics	███████████████████░ 93.3%	14,911 / 15,976
approvals	███████████████████░ 93.3%	3,437 / 3,682
reminders	███████████████████░ 93.4%	468 / 501
workflows	███████████████████░ 94.1%	7,251 / 7,707
endpoints	███████████████████░ 94.2%	8,655 / 9,192
review_hog	███████████████████░ 94.6%	8,101 / 8,563
skills	███████████████████░ 94.6%	3,158 / 3,337
logs	███████████████████░ 95.4%	10,466 / 10,966
experiments	███████████████████░ 95.5%	26,047 / 27,287
annotations	███████████████████░ 96.2%	732 / 761
revenue_analytics	███████████████████░ 96.3%	1,887 / 1,960
feature_flags	███████████████████░ 96.4%	17,488 / 18,144
replay_vision	███████████████████░ 96.4%	16,081 / 16,679
user_interviews	███████████████████░ 96.5%	2,638 / 2,734
customer_analytics	███████████████████░ 97.1%	10,444 / 10,758
warehouse_sources	███████████████████░ 97.3%	359,759 / 369,766
data_catalog	████████████████████ 97.8%	2,589 / 2,648
pulse	████████████████████ 98.4%	2,017 / 2,049

Report-only. Patch coverage = changed backend lines covered vs origin/master. Sorted lowest first.
Known gaps: lines covered only by Temporal tests show as uncovered; core line numbers may drift if master changed the same file.

New commits pushed (delta classified non_trivial_delta) — stamphog approval dismissed; re-review running automatically.

[stamphog]

Contained fix to sandbox startup egress diagnostics: the previously flagged issue (stale mcp.posthog.com probe alongside the resolved regional host) was addressed in a later commit — the static entry is now removed from the host list and only the dynamically resolved MCP host is probed, with parameterized regression tests covering US/EU/custom-override cases and greptile acknowledging the fix. Not risky territory (no auth, billing, migration, public API, or CI/deploy changes), author is on the owning team, so no independent assurance is required.

• Author wrote 10% of the modified lines and has 114 merged PRs in these paths (familiarity MODERATE).
• 👍 on the PR from greptile-apps[bot], hex-security-app[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	56L, 3F substantive, 83L/4F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1b-small (83L, 4F, single-area, fix)
stamphog 2.0.0b4		.stamphog/policy.yml @ 31adcd8 · reviewed head 767e5c7

[tatoalo]

/trunk merge

[stamphog]

Note

🤖 stamphog review failed before producing a verdict

Check the workflow run and re-apply the label to retry.

New commits pushed (delta classified non_trivial_delta) — stamphog approval dismissed; re-review running automatically.

[stamphog]

Contained fix to sandbox startup egress diagnostics with test coverage; the one reviewer concern (stale mcp.posthog.com still probed for non-US endpoints) was verified fixed in the diff and confirmed by the reviewer's own follow-up, with two human approvals on the current commit.

• Author wrote 10% of the modified lines and has 114 merged PRs in these paths (familiarity MODERATE).
• 👍 on the PR from greptile-apps[bot], hex-security-app[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	54L, 3F substantive, 81L/4F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1b-small (81L, 4F, single-area, fix)
stamphog 2.0.0b4		.stamphog/policy.yml @ f2c9529 · reviewed head 9e382cf

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-07-31 16:49 UTC	Run
prod-us	✅ Deployed	2026-07-31 17:11 UTC	Run
prod-eu	✅ Deployed	2026-07-31 17:12 UTC	Run