getsentry / getsentry/sentry-mcp
Support Bearer token authentication for API gateway use cases
- Dominant language
- TypeScript
- Stars
- 853
- Forks
- 144
- Avg merge
- 19h 25m
- Merged PRs (30d)
- 32
Description
## Problem
Sentry MCP's natural language search tools fail when routing through Anthropic-compatible API gateways that require Bearer token authentication:
```
invalid access token key
```
This affects 4 tools that use embedded AI agents:
- `search_issues` - Natural language → Sentry issue search
- `search_events` - Natural language → event search across datasets
- `search_issue_events` - Natural language → filtered events within an issue
- `use_sentry` - Full agentic interface
## Root Cause
Sentry MCP only recognizes `ANTHROPIC_API_KEY`, which causes the Vercel AI SDK to send `x-api-key` headers. Some API gateways require `Authorization: Bearer` headers for OAuth 2.0 compliance.
The underlying Vercel AI SDK (`@ai-sdk/anthropic`) already supports both methods:
- `apiKey` → `x-api-key` header (direct Anthropic API)
- `authToken` → `Authorization: Bearer` header (gateway routing)
## Use Case
Enterprise users want to route Anthropic requests through internal API gateways for:
- Centralized billing/quota management
- Security/compliance monitoring
- Abstraction of underlying AI providers
- Integration with SSO/identity systems
Example scenario: A company's internal API gateway provides Bearer tokens that handle backend provider authentication internally.
## Proposed Solution
Recognize `ANTHROPIC_AUTH_TOKEN` environment variable alongside `ANTHROPIC_API_KEY`:
```typescript
// packages/mcp-core/src/internal/agents/anthropic-provider.ts
export function getAnthropicModel(model?: string): LanguageModel {
const authToken = process.env.ANTHROPIC_AUTH_TOKEN;
const apiKey = process.env.ANTHROPIC_API_KEY;
const factory = createAnthropic({
// Pass authToken (Bearer) OR apiKey (x-api-key), with authToken taking precedence
...(authToken ? { authToken } : apiKey ? { apiKey } : {}),
...(configuredBaseUrl && { baseURL: configuredBaseUrl }),
headers: { "User-Agent": USER_AGENT },
});
return factory(model ?? defaultModel);
}
```
## Files Requiring Changes
1. `packages/mcp-core/src/internal/agents/anthropic-provider.ts` - Core auth logic
2. `packages/mcp-core/src/internal/agents/provider-factory.ts` - Credential validation (4 functions)
3. `packages/mcp-server/src/index.ts` - CLI warning helpers (2 functions)
4. `packages/mcp-server/src/cli/usage.ts` - Help text
5. `packages/mcp-core/src/internal/agents/anthropic-provider.test.ts` - New test file
6. `packages/mcp-core/src/internal/agents/provider-factory.test.ts` - Extend existing tests
7. `docs/embedded-agents.md` - Documentation
## Backward Compatibility
- Existing `ANTHROPIC_API_KEY` users: No changes needed
- New gateway users: Set `ANTHROPIC_AUTH_TOKEN` instead
- Both set: `ANTHROPIC_AUTH_TOKEN` takes precedence (explicit gateway use)
## Configuration Example
```json
{
"mcpServers": {
"sentry": {
"command": "npx",
"args": [
"@sentry/mcp-server",
"--anthropic-base-url=https://genaihub.example.com"
],
"env": {
"SENTRY_ACCESS_TOKEN": "sntrys_...",
"EMBEDDED_AGENT_PROVIDER": "anthropic",
"ANTHROPIC_AUTH_TOKEN": "your-bearer-token"
}
}
}
}
```
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.