Sentry plugin shows “Auth on install” but installed remote 0.1.2 bundle lacks MCP configuration

What version of Codex CLI is running?

codex-cli 0.153.4 (current stable release when checked on September 9, 2026).

Platform and terminal

macOS 15.7.5, arm64; Ghostty.

What issue are you seeing?

The installed OpenAI-curated Sentry plugin shows Auth on install, but its remote bundle has no MCP configuration or app dependency to authenticate. The available skill instead runs a Python helper that requires a manually supplied SENTRY_AUTH_TOKEN.

This is also a package-content mismatch: upstream Sentry gained an OAuth-capable HTTP MCP configuration on August 26, but still declares version 0.1.2, the same version displayed for the installed bundle that lacks it.

Observed state and steps to inspect

1. Open /plugins and select the already-installed Sentry plugin. The detail pane shows:

   Sentry · Installed · OpenAI Curated
   Source    Remote · OpenAI Curated
   Auth      Auth on install
   Version   local 0.1.2
   Skills    sentry
   Hooks     No plugin hooks.
   Apps      No plugin apps.
   

2. Inspect $CODEX_HOME/plugins/cache/openai-curated-remote/sentry/0.1.2:

   • .codex-plugin/plugin.json declares version 0.1.2 and skills: "./skills/", with no mcpServers declaration.
   • .mcp.json is absent.
   • The skill's helper raises Missing SENTRY_AUTH_TOKEN env var. when that variable is absent.

3. The current session exposes the Sentry skill but no callable Sentry MCP tools. There is no separately configured Sentry MCP server.

4. Compare the installed contents with the public source linked below: upstream includes .mcp.json pointing to https://mcp.sentry.dev/mcp, while retaining manifest version 0.1.2.

A separate local Git marketplace checkout also predates the MCP addition (July 13, commit 11c74d6b). This explains that checkout's old contents, but does not establish why the separately materialized remote bundle lacks the file.

These observations concern an existing installation. I have not uninstalled/reinstalled it or reproduced a fresh remote install, so I cannot distinguish a stale release/cache from an intentional or accidental distribution difference.

Expected behavior

The installed plugin should expose its supported authentication flow, or clearly state that it requires manual token setup. The details pane should distinguish an authentication policy from a verified connection state.

If the remote curated bundle is intended to match the published Sentry plugin, it should include the MCP configuration and offer a discoverable update path. If the two distributions intentionally differ, that difference should be visible rather than sharing an apparently identical version.

Source evidence

• Commit adding Sentry's MCP configuration on August 26.
• Current upstream Sentry MCP configuration, pinned.
• The same revision's manifest still declares 0.1.2.
• CLI 0.153.4 renders the Auth row from summary.auth_policy; OnInstall maps directly to Auth on install. This label is not a check of authentication success.

I checked related reports including #41119 (plugin routing) and #34859 (login cannot resolve an existing remote plugin MCP). Here the installed bundle lacks the MCP declaration itself. Filing here because openai/plugins has issues disabled and Codex owns the installed-bundle presentation and loading.

Start with codex-rs/tui/src/chatwidget/plugin_catalog.rs, especially the auth-policy rendering cited in the report, then inspect how the remote Sentry bundle is materialized under $CODEX_HOME/plugins/cache/openai-curated-remote/sentry/0.1.2. Compare that bundle with the pinned upstream plugin files and determine the intended distribution and update behavior. Done means the installed contents and authentication presentation consistently reflect the supported Sentry flow.