Sentry MCP Server: Setup and Security (Oct 2026)

On this page

The Sentry MCP server is Sentry's own hosted server at https://mcp.sentry.dev/mcp. You sign in with OAuth. It lets an agent search errors, traces, and logs, read issue details, triage issues, and run Seer analysis. TrustedMCP grades it A, with full marks on all four checks.

Sentry built it for coding agents that work with a human in the loop. The focus is debugging, not every corner of Sentry.

What it connects

Tools are grouped into "skills". You pick which ones a session gets when you sign in:

Inspect Issues & Events: read-only access to issues, events, traces, replays, releases, monitors, profiles, docs, and project metadata.
Seer: Sentry's AI debugger, for root cause analysis and fix suggestions.
Triage Issues: resolve, assign, and update issues.
Manage Projects & Teams: create and change projects, teams, DSNs, monitors, and alert rules. This group includes delete tools.

Setup

The URL can point at your whole account, one organization, or one project:

https://mcp.sentry.dev/mcp
https://mcp.sentry.dev/mcp/{organizationSlug}
https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}

Sentry recommends the project URL when you can use it. Replace the slugs with your own.

Claude Code:

claude mcp add --transport http sentry https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}

Sentry also ships a Claude Code plugin that adds a sentry-mcp subagent:

claude plugin marketplace add getsentry/sentry-mcp
claude plugin install sentry-mcp@sentry-mcp

Cursor (~/.cursor/mcp.json):

{
  "mcpServers": {
    "sentry": {
      "url": "https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}"
    }
  }
}

VS Code: open the Command Palette, run MCP: Add Server, choose HTTP, and enter https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}.

Any other MCP client that supports HTTP can use the same URL. The first time you connect, the client opens a sign-in page. You approve the session there, then Sentry asks you to log in.

Self-hosted Sentry (stdio)

For a self-hosted Sentry install, run the server locally over stdio. Sentry calls this transport a work in progress. Create a User Auth Token in Sentry with these scopes: org:read, project:read, project:write, team:read, team:write, event:write. Then:

npx @sentry/mcp-server@latest --access-token=TOKEN --host=sentry.example.com

--host takes the hostname only, with no https://. As a client config:

{
  "mcpServers": {
    "sentry": {
      "command": "npx",
      "args": ["@sentry/mcp-server"],
      "env": {
        "SENTRY_ACCESS_TOKEN": "your-token",
        "SENTRY_HOST": "sentry.example.com"
      }
    }
  }
}

Keep the real token out of any file you commit. The AI search tools (search_errors, search_traces, search_logs, search_issues) need an LLM provider key and EMBEDDED_AGENT_PROVIDER set. Without one, those tools are missing and the rest still work.

Security notes

The hosted setup is well designed. Here is what protects you:

OAuth, not a pasted key. Your client gets its own MCP token. The real Sentry token stays on Sentry's server and is never sent to your client.
Skill selection at consent. The approval screen lists each skill group with a checkbox. On first sign-in every group is ticked. Untick what you don't need. If the agent only reads errors, keep Inspect and drop Triage and Manage Projects & Teams.
Scoping by URL. A token minted for /mcp/{org}/{project} only works on that path. It can't be reused against your whole account.
Fails closed. If Sentry rejects the stored token, you have to sign in again. Refreshing never widens access.

Some risks remain:

Event data is untrusted input. Error messages, breadcrumbs, and user reports can contain text an attacker wrote. That text can try to steer the model. Read MCP security best practices.
Triage tools change real issues. Keep tool approval on in your client, so you confirm each resolve, assign, or update.
AI search sends your query to an LLM. The search tools turn plain-English questions into Sentry query syntax using an outside model provider.
Source-available, not open source. The code is under the Functional Source License (FSL-1.1, converting to Apache 2.0 later). You can read it, but it is not OSI open source.

Why it grades A

It gets full marks in all four areas of how TrustedMCP scores servers:

Authentication (30/30): OAuth is the default. Access is narrowed by skill and by URL, and you can revoke it.
Maintenance (25/25): very active, with about 25 people committing in the last 90 days.
Known CVEs (25/25): no advisories on record.
Transport safety (20/20): hosted over HTTPS. Nothing runs on your machine unless you choose the stdio build.

For a quick risk check on any server, see is this MCP server safe?. Full breakdown on the Sentry MCP listing.

FAQs

How do I set up Sentry MCP? Add https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug} to your client as an HTTP server, then sign in when the browser opens. There is nothing to install.

Does Sentry MCP work with self-hosted Sentry? Yes, through the stdio build. Run npx @sentry/mcp-server@latest with --access-token and --host. Seer is left out by default on self-hosted hosts, since self-hosted Sentry doesn't include it.

Do I need an auth token? Not for the hosted server. OAuth handles it. You only need a User Auth Token for the stdio build, with the scopes listed above.

Why do I get a 403 or permission error? The server can only do what your Sentry user is allowed to do. On stdio, check that the token has every scope listed above. On the hosted server, a scoped URL token won't work for another org or project, and a tool won't appear if you unticked its skill. Sign in again and tick the skill you need.

How much context does it use? Ticking every skill loads dozens of tools. Untick the skills you don't need, and use a project URL, which hides the org and project discovery tools. More tips in why MCP servers eat your context window.

Which tools does it have? Search tools for errors, issues, traces, logs, and events; detail tools for issues, traces, replays, releases, and profiles; Seer analysis; issue updates; and project, team, and alert management.