How to set up the Sentry MCP server

Sentry tracks application errors, performance, and releases so engineering teams can diagnose production problems. Use OAuth for a user-delegated MCP connection, or an auth token for a dedicated unattended integration.

This guide prepares the Sentry side of an MCP connection. The agent template is the final deployment step, after the Sentry authorization below is working.

Choose a connection method

Choose OAuth when the MCP connection should use an analyst's Sentry project access. Choose a personal auth token or internal integration token for a named unattended connection. Sentry's authentication guide documents the available token and OAuth scopes.

Recommended: OAuth

Use OAuth when the server should act with an analyst's existing Sentry project access. Create a test project and a dedicated test member before authorization.

1. Register an OAuth application in Sentry and add the exact callback URL requested by the MCP client; for Dome, use https://api.domesystems.ai/oauth/callback.
2. Request the smallest scopes needed for issue and event analysis; begin read-only.
3. Authorize as the test member in the intended Sentry organization.
4. Confirm that the member can inspect a known test issue.
5. Confirm that an issue in an unshared project or another organization is unavailable.

Consult Sentry's authentication documentation for current OAuth and token scopes.

Alternative: Auth token

Use a Sentry auth token only when the MCP client cannot complete OAuth or the integration must run unattended. Tokens inherit the access and scopes of the identity that creates them, so use a dedicated member with access only to the intended test organization and project.

• Sign in to Sentry as the dedicated member, then open User settings → Personal Tokens. For organization-owned automation, create an internal integration instead; Sentry documents both choices in its authentication guide.
• Create a token with only the scopes the server needs. For read-only issue analysis, begin with org:read and project:read; add event or write scopes only after a tested requirement proves they are needed.
• Copy the token once into the MCP client's secret store. Do not place it in a prompt, an agent rule, or a repository.
• Record the identity, organization, project boundary, scopes, and expiry/rotation owner. Revoke and replace the token immediately if that boundary changes.
• Test it against one known test issue, then confirm that a project the member cannot access is unavailable.

Verify Sentry MCP

Use this checklist to confirm the MCP server is connected with the intended access.

• Connect the MCP client using the newly created authorization.
• Confirm that Sentry MCP tools are discovered.
• Read one known test resource that the authorized identity is allowed to access.
• Attempt to read a resource outside the approved Sentry boundary; it should be unavailable or denied.
• Confirm that no write capability beyond the reviewed setup is available.

Troubleshooting

An authorization that lists the wrong organization should be revoked and repeated with the correct user. Missing events after a valid token normally indicate project membership, retention, or event visibility—not an MCP transport failure.

Next steps

Deploy the Sentry agent template to create a governed agent in Dome that can inspect the approved organizations and projects, with the template's included model, tools, and rules.