diff --git a/docs/platforms/javascript/common/configuration/options.mdx b/docs/platforms/javascript/common/configuration/options.mdx index 0953eb55764785..68134bd8e631c7 100644 --- a/docs/platforms/javascript/common/configuration/options.mdx +++ b/docs/platforms/javascript/common/configuration/options.mdx @@ -140,6 +140,7 @@ For more on what data Sentry collects and how to control it, see
`variables`: Collect the variables that are passed to GraphQL operations.

The operation name and type are always collected. | | `genAI` | `{ inputs?, outputs? }` | both `true` | `inputs`: Collect the content of generative AI inputs: system instructions, prompt messages, tool definitions, and tool call arguments.

`outputs`: Collect the content of generative AI outputs, such as completion text and tool call results.

Metadata, such as the model name and token counts, is always collected. Options set on an AI integration take precedence over these values. | +| `mcp` | `{ inputs?, outputs? }` | both `true` | Available in SDK version `11.9.0` and above.

`inputs`: Collect the content of incoming MCP requests, such as tool call arguments, prompt arguments, and the payload of MCP logging notifications.

`outputs`: Collect the content of MCP responses, such as tool results and prompt result messages.

Metadata, such as the method name, the tool or prompt name, and error status, is always collected. A field you don't set falls back to the matching `genAI` field. The `recordInputs` and `recordOutputs` options of `wrapMcpServerWithSentry` take precedence over these values. | | `databaseQueryData` | `boolean` | `true` | Collect the data associated with database queries: bound query parameters, data payloads for write operations, and returned result data.

The sanitized or parameterized query text (`db.query.text`) is **not** controlled by this option. Structural metadata, such as the database system, query summary, operation name, and table, is also **always** collected. | | `queues` | `boolean` | `true` | Collect the arguments passed to tasks within queues. For Kafka, this is the message key. Structural metadata, such as the messaging system, the destination name, and the operation, is always collected. | | `stackFrameVariables` | `CollectBehavior` | `true` | Capture local variable values in stack frames. Allow/deny lists match variable names. | diff --git a/docs/platforms/javascript/common/data-management/data-collected/index.mdx b/docs/platforms/javascript/common/data-management/data-collected/index.mdx index aee6cfbef1c6f5..c7d4483e507aaa 100644 --- a/docs/platforms/javascript/common/data-management/data-collected/index.mdx +++ b/docs/platforms/javascript/common/data-management/data-collected/index.mdx @@ -272,8 +272,6 @@ Sentry.init({ The content of generative AI inputs (system instructions, prompt messages, tool definitions, and tool call arguments) and outputs (such as completion text and tool call results) might carry personal data. By default, the SDK records both inputs and outputs. Metadata like model ID and token counts is always collected. - The same setting applies to instrumented MCP servers. By default, the SDK records the inputs and outputs of tool calls, prompt retrievals, and resource reads. Use the `recordInputs` and `recordOutputs` options of `wrapMcpServerWithSentry` to control recording per server. - Use the `dataCollection.genAI` option to control this. For example, opt out of recording AI message content while keeping the metadata: ```JavaScript @@ -287,6 +285,32 @@ Sentry.init({ }, }); ``` + + + ## MCP Server Inputs and Outputs + + When you instrument an MCP server, metadata like the method name, the tool or prompt name, the session and protocol version, content counts, and error status is always sent to Sentry. + + The content of MCP requests and responses might carry personal data, such as tokens, file paths, or private user content. By default, the SDK records both inputs (such as tool call arguments, prompt arguments, and the payload of MCP logging notifications) and outputs (such as tool results and prompt result messages). + + Use the `dataCollection.mcp` option, available in SDK version `11.9.0` and above, to control this. For example, opt out of recording MCP content while keeping the metadata: + + ```JavaScript + Sentry.init({ + dsn: "___PUBLIC_DSN___", + dataCollection: { + mcp: { + inputs: false, + outputs: false, + }, + }, + }); + ``` + + If you don't set a field of `dataCollection.mcp`, the SDK uses the matching `dataCollection.genAI` field instead. In SDK versions before `11.9.0`, `dataCollection.genAI` is the only global setting for MCP content. + + To control recording for a specific server, use the `recordInputs` and `recordOutputs` options of `wrapMcpServerWithSentry`. They take precedence over the `dataCollection` settings. + diff --git a/docs/platforms/javascript/common/mcp-monitoring/index.mdx b/docs/platforms/javascript/common/mcp-monitoring/index.mdx index 69cf07ee99ed37..8ff8b96d0a465e 100644 --- a/docs/platforms/javascript/common/mcp-monitoring/index.mdx +++ b/docs/platforms/javascript/common/mcp-monitoring/index.mdx @@ -24,18 +24,20 @@ Support for `@modelcontextprotocol/server` 2.x requires Sentry JavaScript SDK ve By default, the SDK sends the inputs and outputs of your MCP tool calls, prompt retrievals, and resource reads. This gives you rich debugging context. MCP payloads can carry sensitive data, such as tokens, file paths, or private user content. Review what your server handles before you deploy to production. -The `dataCollection.genAI` option controls this recording globally for both MCP and AI instrumentation: +The `dataCollection.mcp` option controls this recording globally for all MCP servers: ```javascript Sentry.init({ dsn: "___PUBLIC_DSN___", dataCollection: { - genAI: { inputs: false, outputs: false }, + mcp: { inputs: false, outputs: false }, }, }); ``` -To control recording for a specific server, pass it to `wrapMcpServerWithSentry` with the `recordInputs` and `recordOutputs` options. These options override the `dataCollection.genAI` settings, and they also apply to a server the SDK has already instrumented automatically: +The `dataCollection.mcp` option requires Sentry JavaScript SDK version `11.9.0` or newer. If you don't set a field of `dataCollection.mcp`, or you use an older SDK version, the matching `dataCollection.genAI` field controls MCP recording instead. + +To control recording for a specific server, pass it to `wrapMcpServerWithSentry` with the `recordInputs` and `recordOutputs` options. These options override the `dataCollection` settings, and they also apply to a server the SDK has already instrumented automatically: ```javascript const server = Sentry.wrapMcpServerWithSentry(mcpServer, {