toolkitBLOCK
Agentic tooling for Sentry
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Sentry's MCP service is primarily designed for human-in-the-loop coding agents. Our tool selection and priorities are focused on developer workflows and debugging use cases, rather than providing a general-purpose MCP server for all Sentry functionality.
This remote MCP server acts as middleware to the upstream Sentry API, optimized for coding assistants like Cursor, Claude Code, and similar development tools. It's based on Cloudflare's work towards remote MCPs.
Getting Started
You'll find everything you need to know by visiting the deployed service in production:
If you're looking to contribute, learn how it works, or to run this for self-hosted Sentry, continue below.
Claude Code Plugin
Install as a Claude Code plugin for automatic subagent delegation:
claude plugin marketplace add getsentry/sentry-mcp claude plugin install sentry-mcp@sentry-mcp
This provides a sentry-mcp subagent that Claude automatically delegates to when you ask about Sentry errors, issues, traces, or performance.
For forward-looking tool variants and features:
claude plugin install sentry-mcp@sentry-mcp-experimental
Stdio vs Remote
While this repository is focused on acting as an MCP service, we also support a stdio transport. This is still a work in progress, but is the easiest way to adapt run the MCP against a self-hosted Sentry install.
Note: The AI-powered search tools (search_errors, search_traces, search_logs, search_issues, etc.) require an LLM provider (OpenAI, Azure OpenAI, Anthropic, or OpenRouter). These tools use natural language processing to translate queries into Sentry's query syntax. Without a configured provider, these specific tools will be unavailable, but all other tools will function normally.
To utilize the stdio transport, you'll need to create an User Auth Token in Sentry with the necessa
ecf363473d00OBSERVED · 2026-10-06Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add mcp-server --env SENTRY_ACCESS_TOKEN=${SENTRY_ACCESS_TOKEN} -- npx -y @sentry/[email protected]Exposed tools (33)
19 read · 10 write · 4 destructive. Blast radius: 4 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
DO_NOT_TRACK | write | Industry-standard opt-out for telemetry. When set to |
Documentation | read | Deprecated legacy docs-only grant. Documentation tools are now available through Inspect Issues & Events. |
FORCE_COLOR | destructive | Force color output on interactive terminals. Only takes effect when stdout is a TTY. Set to |
NODE_EXTRA_CA_CERTS | read | Path to a PEM file containing additional CA certificates to trust. |
NO_COLOR | write | Standard convention to disable color output. See [no-color.org](https://no-color.org/). Respected when |
SENTRY_CLIENT_ID | read | Client ID of a public OAuth application on your Sentry instance. **Required for [self-hosted Sentry](./self-hosted/)** (26.1.0+) to use |
SENTRY_CLI_NO_AUTO_REPAIR | write | Disable automatic database schema repair. By default, the CLI automatically repairs its SQLite database when it detects schema drift. Set this to |
SENTRY_CLI_NO_TELEMETRY | write | Disable CLI telemetry (error tracking for the CLI itself). The CLI sends anonymized error reports to help improve reliability — set this to opt out. |
SENTRY_CLI_NO_UPDATE_CHECK | write | Disable the automatic update check that runs periodically in the background. |
SENTRY_CONFIG_DIR | read | Override the directory where the CLI stores its database (credentials, caches, defaults). Follows the [XDG Base Directory specification](https://specifications.freedesktop.org/basedir/latest/): defaults to |
SENTRY_CUSTOM_HEADERS | read | Custom HTTP headers to include in all requests to your Sentry instance. |
SENTRY_DSN | read | Sentry DSN for project auto-detection. This is the same DSN you use in |
SENTRY_FORCE_ENV_TOKEN | destructive | When set, environment variable tokens ( |
SENTRY_HOST | read | Base URL of your Sentry instance. **Only needed for [self-hosted Sentry](./self-hosted/).** SaaS users (sentry.io) should not set this.\n\nWhen set, all API requests (including OAuth login) are directed to this URL instead of |
SENTRY_INIT | write | Used with the install script. When set to |
SENTRY_INIT_TUI | read | Control the TUI (terminal user interface) for |
SENTRY_INSTALL_DIR | write | Override the directory where the CLI binary is installed. Used by the install script and |
SENTRY_LOG_LEVEL | read | Controls the verbosity of diagnostic output. Defaults to |
SENTRY_MAX_PAGINATION_PAGES | read | Cap the maximum number of pages fetched during auto-pagination. Useful for limiting API calls when using large |
SENTRY_NO_CACHE | write | Disable API response caching. When set, the CLI will not cache API responses and will always make fresh requests. |
SENTRY_NO_GRAPHICS | write | Disable inline terminal graphics (kitty and sixel) on terminals that support them; the banner falls back to block art, and image attachments printed by |
SENTRY_NO_SIXEL | read | Deprecated alias for |
SENTRY_ORG | read | Default organization slug. Skips organization auto-detection. |
SENTRY_OUTPUT_FORMAT | destructive | Force the output format for all commands. Currently only |
SENTRY_PIPELINE | read | Identifies the Sentry build plugin that invoked the CLI (e.g., |
SENTRY_PLAIN_OUTPUT | destructive | Force plain text output (no colors or ANSI formatting). Takes precedence over |
SENTRY_PROJECT | read | Default project slug. Can also include the org in |
SENTRY_RELEASE | read | Explicit release version for |
SENTRY_TOKEN | read | Legacy alias for |
SENTRY_URL | read | Alias for |
SENTRY_VERSION | write | Pin a specific version for the [install script](./getting-started/#install-script). Accepts a version number (e.g., |
Seer | read | Sentry |
Sentry | read | Connect your Sentry account to search, analyze, and manage errors and performance issues across your applications. |
Trust audit
BLOCKgrade F · trust 37/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (8 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (8 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- found
Findings (25)
exec(`npm --no-git-tag-version version ${version}`);exec(
exec(sql: string): void {exec(input?: (string | URLPatternInit), baseURL?: string): URLPatternResult | null;
exec(query: string): Promise<D1ExecResult>;
".git-credentials",
".netrc",
dammit-sans-v0.3-bold.otf
spleen-8x16.bin
.claude/skills
.cursor/skills
apps/cli-docs/public/.well-known/skills/sentry-cli/SKILL.md
apps/cli-docs/public/.well-known/skills/sentry-cli/references
console.log(`✅ Token stats written to: ${absolutePath}`);console.log(`Logged out (removed cached token for ${cached.user_email}).`);curl http://127.0.0.1:3030/api/users/42
curl -X POST http://127.0.0.1:3030/api/agent/run \
curl -i http://127.0.0.1:3030/api/broken
token: "sntrys_env_token_123",
token: "sntrys_env_token_123",
token: "sntrys_env_token_123",
token: "sntrys_env_token_123_long_enough",
token: "sntrys_env_token_123_long_enough",
FORCE_COLOR, SENTRY_FORCE_ENV_TOKEN, SENTRY_OUTPUT_FORMAT, SENTRY_PLAIN_OUTPUT
embedded-ppdb.dll
Gates applied: no_behavioural_pass.
ecf363473d00full audit observations/trust-audit/mcp-server/getsentry__toolkit.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-06 | ecf363473d00 | BLOCK | F | 37 | first audit |
Questions
What is the toolkit MCP server?
Agentic tooling for Sentry
What tools does toolkit expose?
33 in total: 19 read-only, 10 that write, and 4 that can delete or overwrite (FORCE_COLOR, SENTRY_FORCE_ENV_TOKEN, SENTRY_OUTPUT_FORMAT, SENTRY_PLAIN_OUTPUT). Every one is listed on this page with its risk.
Is toolkit safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (37/100) and found 7 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 4 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does toolkit need?
It reads ANTHROPIC_API_KEY, MCP_OAUTH_REDIRECT_URI, OPENAI_API_KEY, OPENROUTER_API_KEY, SENTRY_ACCESS_TOKEN, SENTRY_AUTH_TOKEN, SENTRY_FORCE_ENV_TOKEN, SENTRY_MCP_AUTH_CACHE and SENTRY_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does toolkit run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @sentry/toolkit-core at 0.1.0.
How current is this page?
The grade is for one exact copy of the source (ecf363473d00), read on 2026-10-06. The repository is watched and re-audited when it changes.