[Fix] Sentry MCP exposes almost no tools behind the catalog gateway - #2481
Merged
Conversation
Contributor
Sentry's hosted MCP server is catalog-first: tools/list advertises only a small top-level surface plus search_sentry_tools / execute_sentry_tool, and every other operation is reached by naming it in execute_sentry_tool. The Sentry read-only allowlist did not include the gateway tools and listed names that no longer appear, so connected deployments saw only five tools and Sentry-alert tasks reported "connected but zero tools". Drop the Sentry allowlist. Access is now whatever the admin approves on Sentry's consent screen (only the Inspect Issues & Events group is read-only), narrowed further by the per-deployment disabled tools list. Add integration instructions that tell agents how to discover and run catalog tools and to treat Sentry as read-only unless asked otherwise, and document the consent-screen choice.
mrubens
force-pushed
the
fix/sentry-mcp-catalog-gateway
branch
from
September 10, 2026 19:05
c26fdd7 to
f3c3a7f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Deployments with Sentry connected keep filing platform issues like "Sentry integration connected, but discovery for issue details, events, releases, and stack traces returned zero tools."
Sentry's hosted MCP server (
mcp.sentry.dev) became catalog-first in June 2026 (getsentry/sentry-mcp#1067, renamed in #1085).tools/listnow advertises only nine top-level tools, and every other catalog operation (get_issue_details,get_event_stacktrace,find_releases,get_issue_tag_values,search_issue_events,get_trace_details, ...) is reached by naming it inexecute_sentry_tool.Our Sentry read-only allowlist is an intersection filter on
tools/list. It did not includesearch_sentry_tools/execute_sentry_tool, and 13 of its 18 names no longer appear upstream. Net result: a connected Sentry exposed exactly five tools, the proxy returned success, and agents concluded the integration was broken.Fix
Drop the Sentry allowlist instead of chasing upstream names. Static name lists have now silently broken three integrations (Better Stack in #1192, X, and Sentry), and a name-based guard cannot see through the
execute_sentry_toolgateway anyway.Read-only is now the admin's choice on Sentry's consent screen. It lists four access groups, all selected by default; only Inspect Issues & Events is read-only, while Seer, Triage Issues, and Manage Projects & Teams grant writes. The per-deployment disabled-tools list still narrows what is advertised.
packages/types/src/mcp-tool-policy.ts: removeSENTRY_READ_ONLY_TOOL_NAMESand thesentryallowlist entry, with a comment explaining why. A test guards against re-adding one.packages/types/src/mcp-oauth.ts: Sentryinstructionstell agents (sandbox and Fast) to discover withsearch_sentry_toolsand run withexecute_sentry_tool, that availability depends on what the admin granted, and to treat Sentry as read-only unless a request explicitly asks to change state.apps/docs/integrations/sentry.mdx: document the consent-screen groups, how to get a read-only connection, that disablingexecute_sentry_toolremoves the whole catalog, and that the read-only behaviour is instruction-based rather than enforced by Roomote.No proxy or policy-engine changes. Other allowlisted integrations are untouched.
Validation
packages/typespolicy tests,apps/apiMCP proxy tests, andapps/webmcp-connections tests pass.pnpm lint:fast,pnpm check-types:fast,pnpm knipclean.