mcp-core

getsentry/sentry-mcp/packages/mcp-core

This package provides the core tools that allow AI assistants to inspect error reports, analyze performance data, and manage projects in Sentry. The biggest risk is that certain tools can bypass your configured project and permission limits, and default write access could allow malicious error data to trick the AI into modifying your Sentry resources.

What it can reach

Network

Connects to Sentry APIs, documentation services, and telemetry endpoints, as well as AI provider APIs including OpenAI, Anthropic, OpenRouter, and Azure OpenAI.

Secrets

Reads Sentry access tokens and AI provider API keys from environment variables and runtime configuration.

Findings

1. Mediumget_sentry_resource bypasses skill and capability checks for several resource types

   packages/mcp-core/src/tools/catalog/get-sentry-resource.ts:655

   get_sentry_resource is available to sessions granted inspect, triage, or seer skills and declares no requiredCapabilities. While its handler calls assertCatalogToolAvailable before delegating to get_monitor_details and get_dashboard_details, it delegates directly to getTraceDetails, getSpanDetails, getReplayDetails, getProfileDetails, getSnapshot, and getSnapshotImage without checking assertCatalogToolAvailable. Consequently, an agent in a triage-only or seer-only session (or a project-constrained session where traces, replays, or profiles capabilities are disabled) can still access those restricted resources via get_sentry_resource.

   Fix: Call assertCatalogToolAvailable (or verify the backing tool is in context.availableToolNames) before delegating to get_trace_details, get_span_details, get_replay_details, get_profile_details, get_snapshot, and get_snapshot_image.

2. MediumSnapshot tools do not enforce session project constraints

   packages/mcp-core/src/tools/catalog/get-latest-base-snapshot.ts:86

   Session project constraints (context.constraints.projectSlug) are automatically filtered and injected only for schema parameters named projectSlug or projectSlugOrId. get_latest_base_snapshot defines its parameter as project instead and does not check context.constraints.projectSlug in its handler, and get_snapshot / get_snapshot_image do not verify the snapshot's project against context.constraints.projectSlug. In a project-constrained session, an agent can still query snapshots from other projects in the organization.

   Fix: Rename the parameter in get_latest_base_snapshot to projectSlugOrId (or explicitly enforce context.constraints.projectSlug in get_latest_base_snapshot, get_snapshot, and get_snapshot_image).

3. LowRaw tool arguments are recorded on telemetry spans without redacting sensitive fields

   packages/mcp-core/src/tools/special/execute-tool.ts:28

   Both server.ts and execute-tool.ts attach every tool argument verbatim as gen_ai.tool.call.arguments.<key> on the active Sentry span. Tools such as create_uptime_monitor and update_uptime_monitor accept custom HTTP headers (e.g., X-API-Key, Cookie, or secret headers) and request bodies; although get_uptime_monitor_details redacts sensitive headers in tool output, the raw arguments are still attached to spans sent to Sentry telemetry.

   Fix: Redact sensitive tool argument keys (such as headers and body on uptime monitor tools) before setting gen_ai.tool.call.arguments.* span attributes, and apply scrubbing in beforeSendSpan.