Sentry MCP server and Dome

1. 01

   Add the Sentry MCP server

   Dome registers itself as a client with Sentry and holds each engineer's tokens. Calls made for them carry their own.

   $ dome tools add --name sentry \
     --url https://mcp.sentry.dev/mcp \
     --auth-method oauth --credential-type per-user \
     --oauth-authorize-url https://mcp.sentry.dev/oauth/authorize \
     --oauth-token-url https://mcp.sentry.dev/oauth/token \
     --oauth-registration-url https://mcp.sentry.dev/oauth/register \
     --gateway eng-gateway

2. 02

   Sync the catalog

   Run it once your own Sentry consent is attached. Until then the sync fails, and agents get “tool not available in this gateway”.

   $ dome tools catalog sync sentry

3. 03

   Apply the rules

   Scope them to one agent while you try them. Simulate before you deploy.

   $ dome rules apply sentry-triage.cedar \
     --agent issue-triager --name sentry-triage

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Sentry itself, see Sentry's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when { resource.connection_name == "sentry" };
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "sentry" &&
  resource.tool_name == "update_issue" &&
  resource has arguments &&
  resource.arguments has ignoreMode &&
  resource.arguments.ignoreMode == "forever"
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "sentry" &&
  resource.tool_name == "execute_sentry_tool" &&
  resource has arguments &&
  resource.arguments has name &&
  (resource.arguments.name like "delete_*" || resource.arguments.name == "update_issue")
};