feat(mcp-server): Ship @sentry/mcp-server as a slim bundle that shares CLI auth

.agents/skills/mcp-qa/SKILL.md

@@ -19,29 +19,27 @@ Fix any failures before proceeding.
 This is the primary QA path for tool behavior. Stdio runs the local MCP server
 against prod Sentry without depending on the Cloudflare worker, local `/mcp`
 route, or Cloudflare OAuth configuration.
-When validating code or tool changes, build first because the test client
-launches `packages/mcp-server/dist/index.js`:
+The test client launches `sentry mcp` from CLI source
+(`pnpm --dir packages/cli run cli mcp`), which reads mcp-core's build output, so
+build first when validating code or tool changes:
 
 ```bash
 pnpm -w run build
 ```
 
-Check auth first:
+Check auth first. `sentry mcp` uses the CLI's credentials:
 
 ```bash
-pnpm --filter @sentry/mcp-server start auth status
+pnpm --filter sentry run cli auth status
 ```
 
-If no cache exists, warm the device-code cache:
+If you are not logged in, log in once (or pass `--access-token` to the test
+client):
 
 ```bash
-pnpm --filter @sentry/mcp-server start auth login
+pnpm --filter sentry run cli auth login
 ```
 
-Device-code auth uses the bundled stdio public client ID, requires no client
-secret, is separate from the Cloudflare OAuth app, and caches the token in
-`~/.sentry/mcp.json`.
-
 First prove startup and auth:
 
 ```bash
@@ -96,9 +94,9 @@ For agent-client-specific behavior, replace the default harness prompt with the
 same realistic prod prompt used for stdio QA. Passing QA requires the same
 changed-tool transcript evidence, not only `whoami`.
 
-as an isolated auth cache. Real clients do not give stdio subprocesses a TTY,
-so warm the cache before running the harness. It also runs the built
-`packages/mcp-server/dist/index.js`, so build first to avoid stale code.
+Real clients do not give stdio subprocesses a TTY, so log in with
+`sentry auth login` before running the harness. Build first to avoid stale
+mcp-core code.
 
 ## 4. Cloudflare HTTP Only When Relevant
 
@@ -144,7 +142,7 @@ dev-time source execution:
 
 ```bash
 pnpm -w run build
-pnpm --filter @sentry/mcp-server start auth status
+pnpm --filter sentry run cli auth status
 pnpm -w run cli --transport stdio "who am I?"
 ```
 

.craft.yml

@@ -3,9 +3,11 @@ workspaces:
   packages/cli:
     changelog:
       policy: auto
-      # The CLI release also ships the documentation workspace.
+      # The CLI release also ships the documentation workspace and
+      # @sentry/mcp-server.
       includePaths:
         - apps/cli-docs
+        - packages/mcp-server
       aiSummary:
         llm:
           model: gpt-5.6-luna-utility
@@ -24,10 +26,15 @@ workspaces:
           Build:
             - "/^sentry-.*$/"
             - "npm-package"
+            - "mcp-server-npm-package"
             - "vercel"
     targets:
       - name: npm
         includeNames: '/^sentry-\d.*\.tgz$/'
+      # The standalone MCP server, published at the CLI's version.
+      - name: npm
+        id: "@sentry/mcp-server"
+        includeNames: '/^sentry-mcp-server-\d.*\.tgz$/'
       - name: github
         tagPrefix: "cli@"
       - name: vercel
@@ -103,16 +110,3 @@ workspaces:
               assert_match version.to_s, shell_output("#{bin}/sentry --version").chomp
             end
           end
-  packages/mcp-server:
-    changelogPolicy: none
-    preReleaseCommand: >-
-      bash -c 'set -e; for package in packages/mcp-* packages/smoke-tests; do
-      (cd "$package" && npm version "$CRAFT_NEW_VERSION" --no-git-tag-version);
-      done'
-    releaseBranchPrefix: release/mcp
-    targets:
-      - name: github
-        includeNames: '/^sentry-mcp-server-\d.*\.tgz$/'
-      - name: npm
-        id: "@sentry/mcp-server"
-        includeNames: '/^sentry-mcp-server-\d.*\.tgz$/'

.github/workflows/cli-build.yml

@@ -289,6 +289,19 @@ jobs:
         with:
           name: npm-package
           path: packages/cli/*.tgz
+      # Every CLI release also publishes @sentry/mcp-server at the same version.
+      - name: Bundle mcp-server
+        run: pnpm --filter @sentry/mcp-server run bundle
+      - name: Test mcp-server bundle
+        run: pnpm --filter @sentry/mcp-server run test:bundle
+      - name: Pack mcp-server
+        working-directory: packages/mcp-server
+        run: npm pack
+      - name: Upload mcp-server npm artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mcp-server-npm-package
+          path: packages/mcp-server/*.tgz
 
   test-npm:
     name: Test npm Package (Node ${{ matrix.node }})

.github/workflows/mcp-registry.yml

@@ -6,7 +6,7 @@ on:
   workflow_dispatch:
     inputs:
       version:
-        description: Existing stable release (e.g. 0.40.0)
+        description: Existing stable @sentry/mcp-server version (e.g. 0.48.0)
         required: true
         type: string
 
@@ -17,37 +17,54 @@ defaults:
   run:
     shell: bash
 
+# Key on the release tag so a manual retry of `0.48.0` queues behind the
+# `cli@0.48.0` release run instead of racing it to publish the same version.
 concurrency:
-  group: mcp-registry-${{ inputs.version || github.event.release.tag_name }}
+  group: mcp-registry-${{ github.event_name == 'release' && github.event.release.tag_name || format('cli@{0}', inputs.version) }}
   cancel-in-progress: false
 
 jobs:
   publish:
     if: >-
       (github.repository == 'getsentry/sentry-mcp' || github.repository == 'getsentry/toolkit') &&
-      ((github.event_name == 'release' && !github.event.release.prerelease && !startsWith(github.event.release.tag_name, 'cli@')) ||
+      ((github.event_name == 'release' && !github.event.release.prerelease && startsWith(github.event.release.tag_name, 'cli@')) ||
        (github.event_name == 'workflow_dispatch' && github.ref == 'refs/heads/main'))
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
       contents: read
       id-token: write
     env:
-      VERSION: ${{ inputs.version || github.event.release.tag_name }}
+      INPUT_VERSION: ${{ inputs.version }}
+      RELEASE_TAG: ${{ github.event.release.tag_name }}
     steps:
       # Use the maintained manifest on main, including for older releases.
       - uses: actions/checkout@v4
         with:
           ref: main
           persist-credentials: false
 
-      - name: Prepare metadata
+      # Each CLI release (`cli@<version>`) publishes @sentry/mcp-server at the
+      # same version. Releases before that used bare `<version>` tags.
+      - name: Resolve release
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          [[ "$VERSION" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
-          gh release view "$VERSION" --repo getsentry/sentry-mcp --json isDraft,isPrerelease \
+          if [[ -n "$RELEASE_TAG" ]]; then
+            tag="$RELEASE_TAG"
+          elif gh release view "cli@$INPUT_VERSION" --repo "$GITHUB_REPOSITORY" > /dev/null 2>&1; then
+            tag="cli@$INPUT_VERSION"
+          else
+            tag="$INPUT_VERSION"
+          fi
+          version="${tag#cli@}"
+          [[ "$version" =~ ^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          gh release view "$tag" --repo "$GITHUB_REPOSITORY" --json isDraft,isPrerelease \
             | jq -e '(.isDraft | not) and (.isPrerelease | not)'
+          echo "VERSION=$version" >> "$GITHUB_ENV"
+
+      - name: Prepare metadata
+        run: |
           jq --arg version "$VERSION" '.version = $version | .packages[0].version = $version' \
             server.json > "$RUNNER_TEMP/server.json"
 

.github/workflows/merge-jobs.yml

@@ -2,7 +2,7 @@ name: Post-merge tasks
 
 on:
   push:
-    branches: ["main", "release/*", "release/mcp/**"]
+    branches: ["main", "release/*"]
   workflow_dispatch:
 
 jobs:
@@ -26,25 +26,14 @@ jobs:
         run: pnpm install
 
       - name: Build
-        run: pnpm --filter '@sentry/mcp-server...' --if-present run build
+        run: pnpm --filter '@sentry/mcp-core...' --if-present run build
 
       - name: Run linter
         run: pnpm lint
 
       - name: Run tests
         run: pnpm test:ci
 
-      - name: Package mcp-server
-        working-directory: packages/mcp-server
-        run: pnpm pack --pack-destination dist
-
-      - name: Archive artifacts
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ github.sha }}
-          path: |
-            ${{ github.workspace }}/packages/mcp-server/dist/*.tgz
-
       - name: Publish Test Report
         uses: mikepenz/action-junit-report@cf701569b05ccdd861a76b8607a66d76f6fd4857
         if: ${{ !cancelled() }}

.github/workflows/release.yml

@@ -7,10 +7,9 @@ on:
         description: Product to release
         required: true
         type: choice
-        default: mcp
+        default: cli
         options:
           - cli
-          - mcp
       bump:
         description: Version bump type
         required: true
@@ -59,15 +58,13 @@ jobs:
         env:
           PRODUCT: ${{ inputs.product }}
         run: |
+          # Each product maps to a `.craft.yml` workspace. The `cli` release
+          # also publishes @sentry/mcp-server at the same version.
           case "$PRODUCT" in
             cli)
               workspace=packages/cli
               package_path=packages/cli
               ;;
-            mcp)
-              workspace=packages/mcp-server
-              package_path=packages/mcp-server
-              ;;
             *)
               echo "::error::Unsupported product: $PRODUCT"
               exit 1

.gitignore

@@ -78,8 +78,6 @@ coverage
 .env.sentry-build-plugin
 
 # Generated files
-packages/mcp-server/src/toolDefinitions.json
-packages/mcp-server/src/skillDefinitions.json
 packages/mcp-server-evals/eval-results.json
 apps/cli-docs/.astro
 apps/cli-docs/src/content/docs/commands/