[sentry-junior]

@sentry/mcp-server stays the recommended stdio install. Its server code moves into the CLI so it shares the CLI's auth, and the package becomes a slim, dependency-free bundle of that code (see the @sentry/mcp-server section below). The CLI exposes the same server as sentry mcp. This also locks in a one-way package graph, so MCP tools can later be built on the CLI's portable operations without a cycle.

What moved where

• stdio transport: packages/mcp-server/src/transports/stdio.ts → packages/mcp-core/src/transports/stdio.ts, exported as @sentry/mcp-core/transports/stdio. It now uses @sentry/core tracing, so mcp-core takes no Node SDK dependency.
• Server host (flag/env parsing, config validation, usage, agent provider and telemetry setup, the old runMcpServer): moved to packages/cli/src/lib/mcp/{args,config,usage,server}.ts. mcp-core stays free of CLI concepts. lib/mcp.ts still loads the host with a dynamic import, so normal CLI startup does not pay for mcp-core or Zod.
• Standalone auth (device code flow, bundled client ID, ~/.sentry/mcp.json cache, auth subcommands): deleted. CLI auth replaces it.
• Consumers: evals import @sentry/mcp-core/transports/stdio. The test client launches sentry mcp from CLI source. Smoke tests only target the hosted worker, so they needed no change. ensure-generated.mjs now sends generator output to stderr, so a first pnpm run cli mcp cannot write junk into the JSON-RPC stream.
• Refresh after a 401: mcp-core copies the handler context per call, so a token returned from onUpstreamUnauthorized was dropped before. The refreshed token now reaches the context, and a regression test checks that later calls use it.
• Install snippets and docs lead with npx @sentry/mcp-server@latest; the web install instructions are unchanged. User-facing docs mention the shared CLI login but do not steer installs to sentry mcp; the mcp-qa skill drives the server from CLI source. docs/operations/stdio-auth.md and docs/releases/stdio.md are rewritten package-first, and stdio-auth.md documents that each server process uses one account.

Parity

Old @sentry/mcp-server	New @sentry/mcp-server (and sentry mcp)
--access-token / SENTRY_ACCESS_TOKEN	Static token. The flag wins over the env var, and both win over the CLI session. It is never refreshed. An org token (sntrys_) issued for another host is refused with HostScopeError. Other CLI commands ignore SENTRY_ACCESS_TOKEN.
No token: device code flow plus ~/.sentry/mcp.json cache	CLI session (sentry auth login, or SENTRY_AUTH_TOKEN/SENTRY_TOKEN), refreshed after an upstream 401. In a TTY it starts the CLI login. Over pipes it fails with an error naming the login command: npx -y @sentry/mcp-server auth login from the package, sentry auth login from sentry mcp. The old cache is not read.
--host / SENTRY_HOST, --url / SENTRY_URL	Same flags. The env values come from the CLI's configured URL, which is translated into --host/--url. One difference: an http:// SENTRY_URL now maps to --host plus --insecure-http (the CLI's self-hosted behavior) instead of being rejected.
--insecure-http	Same. It is still rejected with --url and for sentry.io hosts.
--mcp-url / MCP_URL, --sentry-dsn / SENTRY_DSN / DEFAULT_SENTRY_DSN	Same
--skills / MCP_SKILLS, --all-skills, --disable-skills / MCP_DISABLE_SKILLS	Same, including dropping seer from the defaults on self-hosted hosts
--agent-provider / EMBEDDED_AGENT_PROVIDER, --openai-base-url, --openai-model / OPENAI_MODEL, --anthropic-base-url, --anthropic-model / ANTHROPIC_MODEL, provider API keys	Same, with the same provider mismatch and auto-detection warnings
--organization-slug, --project-slug, --experimental	Same
--help / -h, --version / -v	Same. --version prints sentry mcp <cli version> (sentry-mcp <package version> from @sentry/mcp-server).
Unknown flags or positionals	Rejected, as before
SENTRY_CLIENT_ID, SENTRY_MCP_AUTH_CACHE	Ignored, because the device flow is gone
sentry-mcp auth login|logout|status	sentry-mcp auth login runs the CLI device flow with plain-text output and stores the CLI session. logout and status point to npx -y sentry auth ..., which reads the same session. sentry mcp auth points users at sentry auth.

Dependency direction guard

sentry → @sentry/mcp-core → @sentry/toolkit-core, and @sentry/mcp-cloudflare → @sentry/mcp-core. No edge runs the other way. pnpm run lint enforces this with two checks:

• An oxlint no-restricted-imports override bans sentry, sentry/**, and relative CLI paths inside packages/mcp-core and packages/toolkit-core.
• scripts/check-workspace-deps.mjs (lint:deps) reads every workspace package.json. It fails on any cycle, on mcp-core reaching sentry or mcp-cloudflare, and on toolkit-core reaching sentry or mcp-core.

The rule is documented in AGENTS.md and docs/architecture/overview.md#package-dependency-direction. Capabilities that only the CLI host has (SQLite cache, DSN detection from local files, file uploads) are injected into mcp-core through interfaces defined in mcp-core or toolkit-core. sentry mcp already works this way for the access token and refresh callback in ServerContext.

MCP registry

Unchanged. server.json and mcp-registry.yml keep the listing on @sentry/mcp-server, which keeps mcpName: io.github.getsentry/sentry-mcp.

@sentry/mcp-server bundle

@sentry/mcp-server stays the recommended, supported package. It now ships the CLI's server code bundled into one dependency-free file, instead of its own copy of the server. One implementation serves the package and sentry mcp, including self-hosted Sentry.

• Entry and build: packages/cli/src/mcp-server.ts is the entry point. packages/cli/script/bundle-mcp-server.ts bundles it into packages/mcp-server/dist/sentry-mcp.cjs (about 3.6 MB, about 0.95 MB packed). The package has no runtime dependencies, and the sentry-mcp bin name is unchanged.
• Shared code: sentry mcp and the bundle both call lib/mcp/run.ts (runMcpServer) and lib/project-context.ts (preloadProjectContext, moved out of cli.ts). lib/suppress-sqlite-warning.ts replaces the inline warning filter in bin.ts. startMcpServer reports whether a server is running, so runMcpServer closes the network dispatcher and schedules the force-exit backstop after --help, --version, or a setup error (and the standalone auth entry does the same), but never under a live server. --help/--version name sentry-mcp when the bundle defines SENTRY_MCP_SERVER_VERSION, and lib/login-command.ts makes auth hints (AuthError, refresh and device-flow failures) name npx -y @sentry/mcp-server auth login in the bundle. Hints that confirm a self-hosted host with --url still name npx -y sentry auth login --url, since the standalone auth login takes no flags.
• Auth: sentry-mcp auth login (lib/mcp/auth.ts) runs the CLI's device flow. The bundle swaps formatters/markdown.ts for markdown-plain.ts, so login output is plain text and the markdown renderer and syntax highlighter stay out.
• Left out: CLI commands, the markdown renderer, agent skills, shell completions, sixel/kitty images, the Ink UI, sentry init, and build/sourcemap/debug-file code. The SQLite WASM fallback is also left out, so the engine moves from >=22.13 to >=22.15 (native node:sqlite), and the bin exits early with a clear error on older Node.js.
• Guards: the bundle script fails if any of those modules contributes code to the output, or if the file grows past 4.5 MB.
• Tests and CI: packages/mcp-server/test/bundle.test.mjs runs the built file: initialize plus tools/list over stdio, no runtime dependencies in package.json, --version/--help, the auth subcommands, and the login hint when no credentials are available. merge-jobs.yml bundles, tests, and packs the package.

The old @sentry/mcp-server/transports/stdio export is gone (now @sentry/mcp-core/transports/stdio), and the standalone clean-consumer workflow (mcp-server-package.yml) is removed; the bundle test replaces it.

Release note: @sentry/mcp-server can publish from release/mcp branches through its Craft workspace as before. Do not run npm deprecate. Users on Node.js 22.13 or 22.14 need to upgrade Node.js.

mcp-core CJS output

Nothing builds or consumes mcp-core CJS anymore. #1732, now merged into this branch from main, switched packages/mcp-core/tsdown.config.ts to format: ["esm"]. mcp-core is "type": "module", and every exports entry maps only types and default (.js) with no require condition. The CLI's esbuild bundle (CJS output) resolves default and converts the ESM itself, and scripts/check-build-imports.ts now checks dist/server.js. This PR does not touch the build format.

Verification

• pnpm run lint (includes lint:deps), CLI tsc --noEmit, ci:policy, docs:check, and check:generated pass.
• CLI MCP and security tests pass, plus the new auth, plain-markdown, standalone usage, and teardown tests.
• pnpm --filter @sentry/mcp-server run bundle builds 3555 KB; test:bundle passes 6/6.
• A clean npm install of the packed tarball installs one package; sentry-mcp answers tools/list with 14 tools on sentry.io and 13 with --host=sentry.example.com (Seer is off on self-hosted). No SQLite warning reaches stderr.
• Adding an agent-skills import to the entry point fails the bundle with the guard error.
• The CLI bundle still builds, and sentry mcp answers tools/list.

Codemod used for stale package paths in contributor docs

sed -i 's#packages/mcp-server/src/#packages/mcp-core/src/#g' \
  docs/contributing/api-patterns.md docs/operations/{logging,monitoring,security}.md docs/testing/overview.md

via BYK.

--

View Session in Sentry

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sentry-local	Error		Oct 30, 2026 12:09am UTC

[cursor]

Stale Bugbot comment from a previous run.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 982a007. Configure here.}