Sentry

Connect Sentry with OAuth so agents can search issues, read events and traces, and tie new errors to a release

Connect Sentry to let CloudThinker agents search issues, read the events and traces behind them, and pull root-cause signals during incident response and release triage. You sign in to Sentry once through OAuth, so there’s no auth token to create or paste.

Prerequisites

• A Sentry account that belongs to the organization and teams you want agents to investigate.
• Permission in that organization to authorize a third-party app.
• Sentry’s hosted service at sentry.io. The connection always goes through Sentry’s hosted MCP server and has no URL field, so a self-hosted Sentry can’t connect.
• The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

Setup

1. Start the connection

   Open More → Workspace settings → Connections, select Sentry, and click Connect. CloudThinker opens Sentry’s authorization page.

2. Authorize CloudThinker

   Sign in to the Sentry account that can see the right organization, then approve access. If your browser is signed in to a different Sentry account, sign out of it first.

3. Return to CloudThinker

   Sentry sends you back to CloudThinker, which stores the tokens for you.

   Success state: the connection shows Connected. Run the prompt in Verify the connection in a new chat to see which projects the account reaches.

Connection details

There are no fields to fill in.

Item	Value
Authentication	OAuth. Sentry issues the tokens and CloudThinker stores them
Endpoint	https://mcp.sentry.dev/mcp, Sentry’s hosted MCP server

Required permissions

Agents see the organizations, projects, and teams the authorizing Sentry account sees. CloudThinker can’t narrow that grant, so to limit what agents reach, authorize with an account that only belongs to the teams you want investigated.

The capabilities below are all reads. Sentry’s MCP server decides which other tools exist, and CloudThinker treats any tool the server doesn’t mark as read-only as a write. Choose Manual so a person approves every change. Once CloudThinker turns on Rule enforcement for your workspace, a Deny Rule can refuse those writes outright.

Every change an agent makes goes through your workspace’s Approvals first. On the default Auto · Rules + AI · Ask me mode, AI judgment can let a safe change run without asking — and an Allow Rule can too, once CloudThinker turns on Rule enforcement for your workspace. Choose Manual to approve every change yourself.

Agent capabilities

Capability	What agents can do
Scoping	List organizations, projects, and teams to pick where to look
Issue search	Search and inspect issues across projects
Events and traces	Read the individual events and distributed traces behind an issue
Root-cause signals	Pull the stack traces, tags, and context Sentry attaches to an issue
Release triage	Line up new errors against recent releases

Agents combine Sentry with your other connections during an investigation. For example, they can match a spike in a Sentry issue to a deploy in your CI system or a metric change in your monitoring tool. See Root cause analysis.

Verify the connection

Ask CloudThinker in a new chat:

List my Sentry projects and summarize the top unresolved issues

Expect the projects the authorizing account can see, each with its top unresolved issues and how often they occur. A project you expected but don’t see is outside that account’s access.

Example prompts

New Sentry errors in the payments project since the last release, ranked by affected users
Show the trace behind the checkout timeout issue and where it spends the most time
Which issues regressed in release 2.14.0 of web, and which tags (browser, region) do they share?

Troubleshooting

The OAuth flow doesn't complete

Your browser is probably signed in to the wrong Sentry account, or to none. Sign in to the right account in Sentry, then click Connect again.

The agent can't find a project you expected

The authorizing account isn’t a member of that project’s team or organization. Add the account to that team in Sentry, or disconnect and connect again with an account that has access.

The connection worked, then stopped

Access was probably revoked in Sentry. Open the Sentry connection, click Connect, and authorize again with the same account. The connection keeps its agents, settings, and memory. To switch to a different account, disconnect and connect again instead.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Scope by account: the connection sees exactly what the authorizing Sentry account sees. A dedicated account with limited team membership keeps agents out of projects they don’t need.
• Revoke when unused: remove CloudThinker under User Settings → Authorized Applications in Sentry (sentry.io/settings/account/authorizations/), then delete the connection in CloudThinker.

Related

Rollbar

Top errors, deployments, and session replay.

Root cause analysis

How agents trace an incident back to its cause.