SentryBLOCK
An MCP server for interacting with Sentry via LLMs.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Sentry's MCP service is primarily designed for human-in-the-loop coding agents. Our tool selection and priorities are focused on developer workflows and debugging use cases, rather than providing a general-purpose MCP server for all Sentry functionality.
This remote MCP server acts as middleware to the upstream Sentry API, optimized for coding assistants like Cursor, Claude Code, and similar development tools. It's based on Cloudflare's work towards remote MCPs.
Getting Started
You'll find everything you need to know by visiting the deployed service in production:
If you're looking to contribute, learn how it works, or to run this for self-hosted Sentry, continue below.
Claude Code Plugin
Install as a Claude Code plugin for automatic subagent delegation:
claude plugin marketplace add getsentry/sentry-mcp claude plugin install sentry-mcp@sentry-mcp
This provides a sentry-mcp subagent that Claude automatically delegates to when you ask about Sentry errors, issues, traces, or performance.
For forward-looking tool variants and features:
claude plugin install sentry-mcp@sentry-mcp-experimental
Stdio vs Remote
While this repository is focused on acting as an MCP service, we also support a stdio transport. This is still a work in progress, but is the easiest way to adapt run the MCP against a self-hosted Sentry install.
Note: The AI-powered search tools (search_events, search_issues, etc.) require an LLM provider (OpenAI, Azure OpenAI, Anthropic, or OpenRouter). These tools use natural language processing to translate queries into Sentry's query syntax. Without a configured provider, these specific tools will be unavailable, but all other tools will function normally.
To utilize the stdio transport, you'll need to create an User Auth Token in Sentry with the necessary scopes. As of writing this is
310dfd43d61dOBSERVED · 2026-09-27Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env SENTRY_ACCESS_TOKEN=${SENTRY_ACCESS_TOKEN} -- npx -y @sentry/[email protected]Exposed tools (3)
3 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
Documentation | read | Deprecated legacy docs-only grant. Documentation tools are now available through Inspect Issues & Events. |
Seer | read | Sentry |
Sentry | read | Connect your Sentry account to search, analyze, and manage errors and performance issues across your applications. |
Trust audit
BLOCKgrade F · trust 41/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (5 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(query: string): Promise<D1ExecResult>;
exec(`open ${JSON.stringify(url)}`);exec(`start "" ${JSON.stringify(url)}`);exec(`cmd.exe /c start "" ${JSON.stringify(url)}`);.claude/skills
.cursor/skills
console.log(`✅ Token stats written to: ${absolutePath}`);console.log(`Logged out (removed cached token for ${cached.user_email}).`);apiKey: "sk-abc123def456ghi789jkl012mno345pqr678stu901vwx234",
.craft.yml
.openspec.yaml
.env.test
CLAUDE.md
if [ -f ../../main-stats/token-stats.json ]; then
MAIN_TOKENS=$(jq -r '.total_tokens' ../../main-stats/token-stats.json)
import { SentryIcon } from "../../ui/icons/sentry";import { isAuthError, getErrorMessage } from "../../utils/chat-error-handler";import { useAuth } from "../../contexts/auth-context";MCP_OAUTH_REDIRECT_URI=http://192.168.1.20:8765/callback \
["http://127.0.0.1:8765/callback", "loopback"],
isRegisteredRedirectUri("http://127.0.0.1:62210/callback", ["http://127.0.0.1/callback",
isRegisteredRedirectUri("http://127.0.0.1:3118/callback", ["--insecure-http",
Gates applied: no_behavioural_pass.
310dfd43d61dfull audit observations/trust-audit/mcp-server/getsentry__sentry-5.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-09-27 | 310dfd43d61d | BLOCK | F | 41 | first audit |
Questions
What is the Sentry MCP server?
An MCP server for interacting with Sentry via LLMs.
What tools does Sentry expose?
3 in total: 3 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Sentry safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (41/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Sentry need?
It reads ANTHROPIC_API_KEY, MCP_OAUTH_REDIRECT_URI, OPENAI_API_KEY, OPENROUTER_API_KEY, SENTRY_ACCESS_TOKEN, SENTRY_MCP_AUTH_CACHE and SENTRY_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Sentry run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @sentry/mcp-smoke-tests at 0.42.0.
How current is this page?
The grade is for one exact copy of the source (310dfd43d61d), read on 2026-09-27. The repository is watched and re-audited when it changes.