---
title: Add the Sentry MCP
description: Mount Sentry's hosted MCP server as an eve connection so Foreman can search and debug production errors while it works.
type: guide
summary: One CLI command, one Connect connector, and the per-user OAuth limit that decides which runs can use it.
related:
  - /docs/tools
  - /docs/stations
---

# Add the Sentry MCP



<CopyPrompt
  className="block"
  text={`Help me customize the eve Software Factory template. I want to add Sentry so the agent can search and debug production errors.

Ground truth first: read AGENTS.md in the repository root, read agent/connections/linear.ts as the in-repo example of a connection, and read https://eve.dev/integrations/sentry plus https://eve.dev/docs/connections before writing code. Do not hand-write the connection if the registry provides it.

1. Run: eve add connection/sentry
 This writes agent/connections/sentry.ts using defineMcpClientConnection with url https://mcp.sentry.dev/mcp and auth connect("sentry") from @vercel/connect/eve. Show me the generated file rather than editing it blind.
2. Tell me the setup commands I need to run myself, and do not run them:
 vercel link, vercel connect create sentry, vercel env pull.
3. Important: connect("sentry") is per-user OAuth, so each person authorizes in their own browser before their first tool call. Unattended factory runs (the factory label and the red-CI fix loop) have nobody to complete that flow. Confirm this in the eve connections docs, then tell me plainly which of Foreman's surfaces can and cannot use Sentry.
4. Do not mount this connection under agent/subagents/. Stations run in task mode and cannot park for a sign-in. If I ask for it later, explain the failure mode before doing it.
5. Consider whether the connection needs an approval predicate. Read the one in agent/connections/linear.ts, which denies unattended runs via isAutonomous from agent/lib/trust.ts. Recommend whether Sentry needs the same, given it is read-oriented, and explain your reasoning instead of copying by reflex.
6. Ask me whether I want the endpoint scoped to one organization or project. Sentry supports https://mcp.sentry.dev/mcp/{organizationSlug} and https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}, and scoping hides discovery tools that are no longer needed.

Finish by running pnpm validate and confirming 0 errors and 0 warnings, then run npx eve info and show me that the sentry connection appears in the discovered surface. Do not deploy.

Full recipe, with the reasoning behind each step: https://ask-foreman.dev/recipes/add-the-sentry-mcp`}
/>

Sentry's hosted Model Context Protocol (MCP) server gives Foreman search over your production issues, errors, and stack traces while it works.

## When to use it

Reach for this when bug reports arrive as claims you cannot check. Foreman can then compare the report against the errors actually firing, rather than sending the Analyst off to plan a fix for something that may not be happening.

The limit decides whether it is worth it for you. `connect("sentry")` is per-user OAuth, so Sentry works from mentions, Linear sessions, and the dev TUI, and never from the unattended pipeline. If your factory runs mostly on labeled issues, this buys you less than it looks.

## What it touches

| File                          | Change                                                            |
| ----------------------------- | ----------------------------------------------------------------- |
| `agent/connections/sentry.ts` | Created by `eve add connection/sentry`                            |
| Vercel Connect                | A `sentry` connector, created with `vercel connect create sentry` |
| `package.json`                | The auth dependency, if not already installed                     |

## Before you run it

Authorization is per person, not per deployment. Every teammate who wants Foreman to use Sentry authorizes once in their own browser, and nobody can do it on another person's behalf.

There is a running cost too. Vercel Connect bills per token request, so every Sentry call counts, and each connection widens the tool surface the model searches through on the turns that use it.

## What the connection looks like

```ts title="agent/connections/sentry.ts"
import { connect } from "@vercel/connect/eve";
import { defineMcpClientConnection } from "eve/connections";

export default defineMcpClientConnection({
  url: "https://mcp.sentry.dev/mcp",
  description: "Sentry: search, query, and debug errors and issues.",
  auth: connect("sentry"),
});
```

Sentry is a Vercel Connect connector type in its own right, so the setup is the same three commands as any other connector.

```bash
vercel link
vercel connect create sentry
vercel env pull
```

<Callout type="warn" title="This is per-user OAuth, so unattended runs cannot use it">
  `connect("sentry")` authorizes each end user in their own browser before their first tool call. A factory-label run or a red-CI fix run has nobody at a browser, so it cannot complete that flow. Sentry is usable from mentions, Linear sessions, and the dev TUI, and not from the unattended pipeline.
</Callout>

That constraint differs from the Linear connection already in the template, which uses app-scoped auth through `linearAuth` and therefore works without a person present.

## Decide which agent gets it

Connections do not inherit, so where the file lives decides who can call Sentry.

| Mount point                                      | Who gets it                                                              |
| ------------------------------------------------ | ------------------------------------------------------------------------ |
| `agent/connections/sentry.ts`                    | The orchestrator, while triaging and while writing the pull request body |
| `agent/subagents/analyst/connections/sentry.ts`  | The Analyst, so plans can cite production errors                         |
| `agent/subagents/reviewer/connections/sentry.ts` | The Reviewer, to check a fix against the real failure                    |

Mounting at the root gives the stations nothing. That is the most common surprise when extending this template.

<Callout title="Stations cannot wait for a sign-in">
  A station's `outputSchema` puts it in task mode, which cannot pause for a person or an OAuth sign-in. Given Sentry's per-user OAuth, a station that hits an unauthorized Sentry call fails rather than waiting. Prefer the root mount.
</Callout>

## Verify

```bash
pnpm validate
npx eve info
```

`eve info` should list `sentry` among the discovered connections. Then run `pnpm dev` and ask something that needs Sentry. The first call triggers the OAuth sign-in in your browser.

## What to expect

The connection is read-oriented, but it is not read-only by construction. Review what the Sentry MCP server exposes before deciding whether to add an approval predicate like the one guarding the Linear connection.

## FAQ

<Accordions type="single">
  <Accordion title="Can the unattended pipeline use Sentry?">
    No. `connect("sentry")` is per-user OAuth, and each person authorizes in their own browser before their first tool call. A factory-label run or a red-CI fix run has no person present, so it cannot complete that flow.

    Mentions, Linear Agent Sessions, and the dev TUI are all attended, so Sentry works there. If you need production error context inside the unattended pipeline, the practical route today is to have an attended session record the durable finding in the [factory brain](/docs/memory), which every run reads.
  </Accordion>

  <Accordion title="Do the stations get Sentry if I mount it at the root?">
    No. Stations inherit nothing from the orchestrator, including connections. A root mount gives the orchestrator the tools and gives the Classifier, Analyst, Implementer, and Reviewer nothing.

    To give a station Sentry you would put a connection file in that station's own directory, but per-user OAuth plus task mode makes that a poor fit. The orchestrator can weave relevant Sentry findings into the delegation message instead.
  </Accordion>

  <Accordion title="Do I need a Custom OAuth connector for this?">
    No. Sentry is a first-class Vercel Connect connector type, so `vercel connect create sentry` is all you need. Custom OAuth is for providers Connect has no built-in type for.
  </Accordion>

  <Accordion title="Can I limit it to one Sentry project?">
    Yes. Append slugs to the endpoint: `https://mcp.sentry.dev/mcp/{organizationSlug}` for an organization, or `https://mcp.sentry.dev/mcp/{organizationSlug}/{projectSlug}` for a single project.

    Project scoping is worth doing. It makes the tools default to that project and hides the discovery tools you no longer need, which keeps the model's tool surface smaller.
  </Accordion>

  <Accordion title="What does adding a connection cost?">
    Two things. Vercel Connect bills per token request, so every Sentry call the agent makes counts against that. And every connection widens the tool surface the model has to search through with `connection_search`, which costs context on each turn that uses it.
  </Accordion>
</Accordions>


---

For a semantic overview of all documentation, see [/sitemap.md](/sitemap.md)

For an index of all available documentation, see [/llms.txt](/llms.txt)

For agent-facing discovery, including API and MCP surfaces, see [/agents.md](/agents.md)