From f3c3a7fe201a15d11765821706366bdbc7fb1df7 Mon Sep 17 00:00:00 2001 From: Matt Rubens <2600+mrubens@users.noreply.github.com> Date: Thu, 10 Sep 2026 14:47:59 -0400 Subject: [PATCH] fix: stop allowlisting Sentry MCP tools behind the catalog gateway Sentry's hosted MCP server is catalog-first: tools/list advertises only a small top-level surface plus search_sentry_tools / execute_sentry_tool, and every other operation is reached by naming it in execute_sentry_tool. The Sentry read-only allowlist did not include the gateway tools and listed names that no longer appear, so connected deployments saw only five tools and Sentry-alert tasks reported "connected but zero tools". Drop the Sentry allowlist. Access is now whatever the admin approves on Sentry's consent screen (only the Inspect Issues & Events group is read-only), narrowed further by the per-deployment disabled tools list. Add integration instructions that tell agents how to discover and run catalog tools and to treat Sentry as read-only unless asked otherwise, and document the consent-screen choice. --- apps/docs/integrations/sentry.mdx | 23 +++++++++++++--- .../src/__tests__/mcp-tool-policy.test.ts | 12 +++++++++ packages/types/src/mcp-oauth.ts | 2 ++ packages/types/src/mcp-tool-policy.ts | 26 +++---------------- 4 files changed, 38 insertions(+), 25 deletions(-) diff --git a/apps/docs/integrations/sentry.mdx b/apps/docs/integrations/sentry.mdx index 614ad2a536..cb3b854dc7 100644 --- a/apps/docs/integrations/sentry.mdx +++ b/apps/docs/integrations/sentry.mdx @@ -15,13 +15,30 @@ performance context from production. ## How setup works -Admins connect Sentry once from **Settings > Integrations**. +Admins connect Sentry once from **Settings > Integrations**. Sentry's consent +screen lists four access groups, all selected by default: + +- **Inspect Issues & Events** is read-only: issues, events, traces, replays, + releases, monitors, profiles, documentation, and project metadata. +- **Seer**, **Triage Issues**, and **Manage Projects & Teams** grant write + access: AI analysis runs, resolving and assigning issues, and creating or + editing projects, teams, DSNs, and uptime monitors. + +Roomote does not restrict the connection beyond what you approve there. For a +read-only connection, leave only **Inspect Issues & Events** selected. You can +also disable individual tools afterwards from the integration's tool settings. +Most Sentry operations run through the `execute_sentry_tool` gateway, so +disabling that tool removes the whole catalog rather than a single operation. ## What to expect Sentry gives Roomote incident and performance context during a task. It can also -support scheduled read-only Sentry triage. The final decision, code change, and -review still happen in the normal task and repository flow. +support scheduled Sentry triage. The final decision, code change, and review +still happen in the normal task and repository flow. + +Roomote agents are instructed to treat Sentry as read-only unless a request +explicitly asks them to change Sentry state. That instruction is not enforced +by Roomote; the access you approve on Sentry's consent screen is the boundary. ## Scope a triage request diff --git a/packages/types/src/__tests__/mcp-tool-policy.test.ts b/packages/types/src/__tests__/mcp-tool-policy.test.ts index 5819167ade..ed82cf037b 100644 --- a/packages/types/src/__tests__/mcp-tool-policy.test.ts +++ b/packages/types/src/__tests__/mcp-tool-policy.test.ts @@ -125,3 +125,15 @@ describe('monday.com MCP tool policy', () => { expect(allowedToolNames).not.toContain('all_monday_api'); }); }); + +describe('Sentry MCP tool policy', () => { + it('does not allowlist tool names', () => { + // mcp.sentry.dev is catalog-first: tools/list advertises a small top-level + // surface and everything else runs through execute_sentry_tool, so a + // static name list silently hides most of the server. Read-only access is + // chosen by the admin in Sentry's consent dialog (the "Inspect Issues & + // Events" skill) and narrowed further with the per-deployment disabled + // tools list. + expect(getAllowedIntegrationMcpToolNames('sentry')).toBeUndefined(); + }); +}); diff --git a/packages/types/src/mcp-oauth.ts b/packages/types/src/mcp-oauth.ts index 215ec6bc27..8436147c59 100644 --- a/packages/types/src/mcp-oauth.ts +++ b/packages/types/src/mcp-oauth.ts @@ -507,6 +507,8 @@ export const MCP_INTEGRATIONS: McpIntegration[] = [ description: `Enable Sentry so this deployment can access alerts and performance indicators from ${PRODUCT_NAME} tasks.`, icon: 'sentry', connectionScope: 'deployment', + instructions: + 'Sentry advertises only a few tools directly (find_organizations, find_projects, search_issues, search_events, get_sentry_resource). Reach everything else (issue details, event stack traces, breadcrumbs, tag values, issue events, releases, traces, replays, attachments, monitors, alert rules, docs) by calling search_sentry_tools with a short query, then execute_sentry_tool with the returned tool name and arguments. Which tools exist depends on the access the admin granted when connecting. Treat Sentry as read-only unless the request explicitly asks to change Sentry state: do not resolve, assign, ignore, or otherwise update issues, and do not create or modify projects, teams, DSNs, or monitors on your own initiative.', }, { id: 'pylon', diff --git a/packages/types/src/mcp-tool-policy.ts b/packages/types/src/mcp-tool-policy.ts index a889d28257..7661526eb8 100644 --- a/packages/types/src/mcp-tool-policy.ts +++ b/packages/types/src/mcp-tool-policy.ts @@ -96,27 +96,6 @@ const PYLON_READ_ONLY_TOOL_NAMES = [ 'get_account', ] as const; -const SENTRY_READ_ONLY_TOOL_NAMES = [ - 'whoami', - 'find_organizations', - 'find_teams', - 'find_projects', - 'find_releases', - 'get_issue_details', - 'get_issue_tag_values', - 'get_trace_details', - 'get_replay_details', - 'get_event_attachment', - 'search_events', - 'find_dsns', - 'search_docs', - 'get_doc', - 'search_issues', - 'search_issue_events', - 'get_profile_details', - 'get_sentry_resource', -] as const; - const JIRA_SHARED_TOOL_NAMES = [ 'atlassianUserInfo', 'getAccessibleAtlassianResources', @@ -218,7 +197,10 @@ const INTEGRATION_MCP_ALLOWED_TOOL_NAMES: Readonly< monday: MONDAY_READ_ONLY_TOOL_NAMES, pylon: PYLON_READ_ONLY_TOOL_NAMES, railway: RAILWAY_READ_ONLY_TOOL_NAMES, - sentry: SENTRY_READ_ONLY_TOOL_NAMES, + // Sentry is intentionally absent: mcp.sentry.dev is catalog-first, so + // tools/list advertises a small top-level surface and everything else runs + // through execute_sentry_tool. A static name list silently hid most of the + // server. Access is chosen by the admin in Sentry's consent dialog instead. x: X_READ_ONLY_TOOL_NAMES, };