MCP Observatory
1m ago Tracked 59,450 Last 1m ago 24h 2,448
npm JavaScript analyzed 0.39.0

@sentry/mcp-server

v0.39.0
npm

Sentry MCP Server

maintainer
sentry-bot
licence
FSL-1.1-ALv2
first seen
2026-05-22
last seen
2026-09-17
releases · 30d
2
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio verified reported listed in the official MCP registry counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals npm-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v0.39.0 · analyzer v33 · 3w ago

danger signals10

  • suspicious endpoint us.sentry.io (telemetry) expected for this server's purpose package/dist/index.cjs :434 typically the region-specific URL like 'https://us.sentry.io'. For self-hosted Sentry installations, this parameter is usually not needed and should be omitted. You can find the correct regionUrl from
  • suspicious endpoint sentry.sentry.io (telemetry) expected for this server's purpose package/dist/index.cjs :18010 "get_issue_details(issueUrl='https://sentry.sentry.io/issues/6916805731/?project=4509062593708032&query=is%3Aunresolved')",
  • suspicious endpoint my-organization.sentry.io (telemetry) expected for this server's purpose package/dist/index.cjs :18529 "get_issue_activity(issueUrl='https://my-organization.sentry.io/issues/PROJECT-123/')",
  • suspicious endpoint my-org.sentry.io (telemetry) expected for this server's purpose package/dist/index.cjs :18677 "get_issue_breadcrumbs(issueUrl='https://my-org.sentry.io/issues/PROJECT-123/')",
  • suspicious endpoint sentry.io (telemetry) expected for this server's purpose package/dist/index.cjs :18764 "get_issue_tag_values(issueUrl='https://sentry.io/issues/PROJECT-123/', tagKey='browser')",
  • suspicious endpoint us.sentry.io (telemetry) expected for this server's purpose package/dist/index.js :435 typically the region-specific URL like 'https://us.sentry.io'. For self-hosted Sentry installations, this parameter is usually not needed and should be omitted. You can find the correct regionUrl from
  • suspicious endpoint sentry.sentry.io (telemetry) expected for this server's purpose package/dist/index.js :18011 "get_issue_details(issueUrl='https://sentry.sentry.io/issues/6916805731/?project=4509062593708032&query=is%3Aunresolved')",
  • suspicious endpoint my-organization.sentry.io (telemetry) expected for this server's purpose package/dist/index.js :18530 "get_issue_activity(issueUrl='https://my-organization.sentry.io/issues/PROJECT-123/')",
  • suspicious endpoint my-org.sentry.io (telemetry) expected for this server's purpose package/dist/index.js :18678 "get_issue_breadcrumbs(issueUrl='https://my-org.sentry.io/issues/PROJECT-123/')",
  • suspicious endpoint sentry.io (telemetry) expected for this server's purpose package/dist/index.js :18765 "get_issue_tag_values(issueUrl='https://sentry.io/issues/PROJECT-123/', tagKey='browser')",
code evidence v0.39.0 · npm-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 98

filesystem 5

  • fs package/dist/device-code-flow-BRSc_1Sh.js :5 import * as fs from "node:fs";
  • fs package/dist/device-code-flow-Btx7zPjy.cjs :6 const node_fs = require_chunk.__toESM(require("node:fs"));
  • fs package/dist/token-cache-ATUcs1cg.cjs :2 const node_fs_promises = require_chunk.__toESM(require("node:fs/promises"));
  • fs package/dist/token-cache-DbZp4rvg.js :1 import * as fs from "node:fs/promises";
  • fs package/dist/token-util-BRoQwIG6.cjs :39 var import_fs = __toESM$2(require("fs"));

shell / exec 2

  • shell package/dist/device-code-flow-BRSc_1Sh.js :4 import { exec } from "node:child_process";
  • shell package/dist/device-code-flow-Btx7zPjy.cjs :5 const node_child_process = require_chunk.__toESM(require("node:child_process"));

network 6

  • net package/dist/device-code-flow-BRSc_1Sh.js :18 const resp = await fetch(url, {
  • net package/dist/device-code-flow-Btx7zPjy.cjs :19 const resp = await fetch(url, {
  • net package/dist/index.cjs :3902 response = await fetch(url, {
  • net package/dist/index.js :3903 response = await fetch(url, {
  • net package/dist/token-util-BRoQwIG6.cjs :177 const response = await fetch(discoveryUrl, { headers: { "user-agent": userAgent } });
  • net package/dist/token-util-batRsXGA.js :177 const response = await fetch(discoveryUrl, { headers: { "user-agent": userAgent } });

secrets 4

  • secrets package/dist/index.cjs :7878 const token = (0, import_get_context$1.getContext)().headers?.["x-vercel-oidc-token"] ?? process.env.VERCEL_OIDC_TOKEN;
  • secrets package/dist/index.js :7879 const token = (0, import_get_context$1.getContext)().headers?.["x-vercel-oidc-token"] ?? process.env.VERCEL_OIDC_TOKEN;
  • secrets package/dist/token-3xpHVxQo.js :43 process.env.VERCEL_OIDC_TOKEN = maybeToken.token;
  • secrets package/dist/token-C7MavkKX.cjs :43 process.env.VERCEL_OIDC_TOKEN = maybeToken.token;

declared dependencies 13

  • @modelcontextprotocol/sdk@1.30.0
  • @sentry/node@10.54.0
  • @sentry/core@10.54.0
  • dotenv@^16.6.1
  • zod@^4.4.3
  • @types/node@^22.15.33
  • tsdown@^0.12.9
  • tsx@^4.20.3
  • typescript@^5.8.3
  • vitest@^4.1.10
  • @sentry/mcp-core@0.39.0
  • @sentry/mcp-server-tsconfig@0.39.0
show 1 more
  • @sentry/mcp-server-mocks@0.39.0