Assessment: Sentry MCP server
Sentry's MCP server is a hosted one — it runs remotely and clients connect over OAuth rather than shelling out to a local process — which changes the security question from “what can the tools do” to “who is allowed to connect and what were they granted.” It handles that boundary carefully, with unusually deep test coverage. Generous, verifiable read.
The standout
The standout is the transport and access story. This is a remote server behind an OAuth flow with an explicit approval step, deployed on Cloudflare Workers, and backed by ~160 test files — one of the most thoroughly tested servers I've read. The consent dialog at connect time is a real access gate, not an afterthought: a client doesn't get tools until a human has approved the grant. Tools carry readOnlyHint annotations, so a host can still tell a read from a write once connected.
The method, check by check
| ✓ | Annotations | Tools carry readOnlyHint; reads and writes distinguished. |
| ✓ | Access model | OAuth with an explicit approval dialog at connect — a real consent gate, not just a token. |
| ✓ | Tests & CI | ~160 test files across the monorepo, with CI. Exceptional coverage. |
| — | Path handling | Hosted, API-backed; no filesystem surface. |
| ⚠ | Confirmation (8) | Access is gated at connect, but individual destructive actions (resolving/updating issues) still rely on the client to gate on the hint rather than the server requiring a per-action confirmation. |
| ⚠ | Blast radius (12) | Bounded by the granted OAuth scope; no explicit per-call cap on bulk operations. |
✓ present · ⚠ the tier-two hardening still open · — not applicable
Verdict
Strong where a hosted server most needs to be — the connect-time OAuth approval is a better access gate than most local servers have, and the test coverage is genuinely exceptional. The tier-two frontier is the same as everyone's: consent happens at connect, but the server doesn't yet require a fresh confirmation before each destructive action. Sound on the basics, ahead on access, with per-action confirmation the hardening left to add.
Want the same read on yours?
The whole server against both tiers, a document you can forward. How it works · lesliekadenge@gmail.com.
Checkable against github.com/getsentry/sentry-mcp. Offered in good faith; named only for what it does well.