Add test steps by junhouse · Pull Request #2466 · mixpanel/docs

junhouse · 2026-03-17T16:09:54Z

This PR adds test-app folder to be used when testing mixpanel-skill. This is important to prevent any prompt drift in mixpanel-skill.

test-app doesn't need thorough review since it's just an example code.

vercel · 2026-03-17T16:10:03Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Mar 17, 2026 4:27pm

public/mixpanel-skill/test-app/server/src/index.js

+app.get("*", (req, res) => {
+  res.sendFile(path.join(clientDist, "index.html"));
+});


In general, the best fix is to add a rate-limiting middleware (such as express-rate-limit) to restrict how many requests a client can make in a fixed time window, especially for routes that perform filesystem or other expensive operations. This middleware can be applied globally or to specific routes.

For this file, the simplest, low-impact fix is:

Import express-rate-limit.

Create a limiter instance with a reasonable window and max request count.

Apply it to the routes that touch the filesystem: the express.static(clientDist) middleware and the wildcard app.get("*", ...) handler. This limits how many static file and SPA-shell responses a single client can trigger per time window, without changing what is served or how routes behave under normal load.

Concrete steps in public/mixpanel-skill/test-app/server/src/index.js:

Add import rateLimit from "express-rate-limit"; near the top with other imports.

After creating app and constants (e.g., after the CLIENT_ORIGIN definition), define a limiter such as:
const staticLimiter = rateLimit({ windowMs: 15 * 60 * 1000, max: 100, });

Apply staticLimiter before filesystem-related middleware:

Change app.use(express.static(clientDist)); to app.use(staticLimiter, express.static(clientDist));

Change app.get("*", (req, res) => { ... }); to app.get("*", staticLimiter, (req, res) => { ... });
This preserves all existing behavior aside from rejecting or delaying excessive requests from a single client.

junhouse · 2026-03-17T16:51:47Z

public/mixpanel-skill/readme.md

+
+---
+
+## Testing


How to test/evaluate.

tiffanyqi

left some questions!

tiffanyqi · 2026-03-18T21:23:08Z

public/mixpanel-skill/tests/01-implement.txt

@@ -0,0 +1,8 @@
+Set up Mixpanel tracking in this project: `public/mixpanel-skill/test-app`. My project token is mixpanel-token. 
+Use the Mixpanel setup skill: public/mixpanel-skill/skill.md


the file is readme.md right?

no, the skill is skill.md file.

gotcha, i see that there's a skill.md file already

tiffanyqi · 2026-03-18T21:23:50Z

public/mixpanel-skill/tests/02-evaluate.txt

+## SDK Setup
+1. Did the agent successfully initialize Mixpanel (SDK loaded + init() called)?
+2. Did the agent track at least one event?
+3. Did the agent use a real project token (not a placeholder like 'YOUR_PROJECT_TOKEN')?


or maybe the one that you provided?

tiffanyqi · 2026-03-18T21:29:18Z

public/mixpanel-skill/tests/02-evaluate.txt

+  "reason": "A strict 1-2 sentence explanation of the ruling."
+}
+
+Once finished, revert all changes made to public/mixpanel-skill/test-app`.


can you clarify this one? is the plan for this to ensure the tests pass, and then it will revert everything? that works for the most part, i'm just trying to think through test failures and reproduction steps.

for testing, will it also run the app, or just check if there is code there?

Basically, test-app contains sample code the agent can use to implement tracking. Once it's done, we will evaluate the code changes - verifying tracking code an agent added are correct. Once that's done, we have to revert the changes so we can use the same code for evaluation purposes in future.

No, we don't have to run the app since we are mostly evaluating code added.

in that case, do we need any of the server code? since the plan isn't to actually run? (unless we wanted tracking in the server code as well)

Yes, server code for server side tracking!

public/mixpanel-skill/test-app/server/package.json

public/mixpanel-skill/test-app/server/src/data/products.js

junhouse added 3 commits March 17, 2026 11:46

initial commit

2ff606c

update test-app

ec79865

update test app to include auth routes

24e4e41

junhouse requested review from a team as code owners March 17, 2026 16:09

junhouse requested review from myronkaifung and tiffanyqi and removed request for a team March 17, 2026 16:09

github-advanced-security bot found potential problems Mar 17, 2026

View reviewed changes

update readme

efb72ae

vercel bot deployed to Preview March 17, 2026 16:27 View deployment

junhouse commented Mar 17, 2026

View reviewed changes

public/mixpanel-skill/readme.md

---

## Testing

Copy link
Copy Markdown

Contributor Author

junhouse Mar 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How to test/evaluate.

tiffanyqi reviewed Mar 18, 2026

View reviewed changes

@@ -4,6 +4,7 @@
             import cors from "cors";
             import morgan from "morgan";
             import dotenv from "dotenv";
+            import rateLimit from "express-rate-limit";
             import { productsRouter } from "./routes/products.js";
             import { ordersRouter } from "./routes/orders.js";
@@ -20,6 +21,11 @@
             const PORT = process.env.PORT ? Number(process.env.PORT) : 5000;
             const CLIENT_ORIGIN = process.env.CLIENT_ORIGIN || "http://localhost:5173";
+            const staticLimiter = rateLimit({
+              windowMs: 15 * 60 * 1000, // 15 minutes
+              max: 100, // limit each IP to 100 requests per windowMs
+            });
             app.use(morgan("dev"));
             app.use(express.json({ limit: "1mb" }));
             app.use(cors({ origin: CLIENT_ORIGIN }));
@@ -33,8 +39,8 @@
             // Serve built client in production
             const clientDist = path.join(__dirname, "..", "..", "client", "dist");
-            app.use(express.static(clientDist));
-            app.get("*", (req, res) => {
+            app.use(staticLimiter, express.static(clientDist));
+            app.get("*", staticLimiter, (req, res) => {
               res.sendFile(path.join(clientDist, "index.html"));
             });

@@ -11,7 +11,8 @@
                 "cors": "^2.8.5",
                 "dotenv": "^16.4.5",
                 "express": "^4.19.2",
-                "morgan": "^1.10.0"
+                "morgan": "^1.10.0",
+                "express-rate-limit": "^8.3.1"
               },
               "devDependencies": {
                 "nodemon": "^3.1.4"

Package	Version	Security advisories
express-rate-limit (npm)	8.3.1	None

		@@ -0,0 +1,8 @@
		Set up Mixpanel tracking in this project: `public/mixpanel-skill/test-app`. My project token is mixpanel-token.
		Use the Mixpanel setup skill: public/mixpanel-skill/skill.md

Conversation

junhouse commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vercel bot commented Mar 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Check failure

Uh oh!

Copilot Autofix

Choose a reason for hiding this comment

Uh oh!

tiffanyqi left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

junhouse commented Mar 17, 2026 •

edited

Loading

vercel bot commented Mar 17, 2026 •

edited

Loading