feat(mcp-server): Ship @sentry/mcp-server as a slim bundle that shares CLI auth

.agents/skills/mcp-qa/SKILL.md

@@ -19,29 +19,27 @@ Fix any failures before proceeding.
 This is the primary QA path for tool behavior. Stdio runs the local MCP server
 against prod Sentry without depending on the Cloudflare worker, local `/mcp`
 route, or Cloudflare OAuth configuration.
-When validating code or tool changes, build first because the test client
-launches `packages/mcp-server/dist/index.js`:
+The test client launches `sentry mcp` from CLI source
+(`pnpm --dir packages/cli run cli mcp`), which reads mcp-core's build output, so
+build first when validating code or tool changes:
 
 ```bash
 pnpm -w run build
 ```
 
-Check auth first:
+Check auth first. `sentry mcp` uses the CLI's credentials:
 
 ```bash
-pnpm --filter @sentry/mcp-server start auth status
+pnpm --filter sentry run cli auth status
 ```
 
-If no cache exists, warm the device-code cache:
+If you are not logged in, log in once (or pass `--access-token` to the test
+client):
 
 ```bash
-pnpm --filter @sentry/mcp-server start auth login
+pnpm --filter sentry run cli auth login
 ```
 
-Device-code auth uses the bundled stdio public client ID, requires no client
-secret, is separate from the Cloudflare OAuth app, and caches the token in
-`~/.sentry/mcp.json`.
-
 First prove startup and auth:
 
 ```bash
@@ -96,9 +94,9 @@ For agent-client-specific behavior, replace the default harness prompt with the
 same realistic prod prompt used for stdio QA. Passing QA requires the same
 changed-tool transcript evidence, not only `whoami`.
 
-as an isolated auth cache. Real clients do not give stdio subprocesses a TTY,
-so warm the cache before running the harness. It also runs the built
-`packages/mcp-server/dist/index.js`, so build first to avoid stale code.
+Real clients do not give stdio subprocesses a TTY, so log in with
+`sentry auth login` before running the harness. Build first to avoid stale
+mcp-core code.
 
 ## 4. Cloudflare HTTP Only When Relevant
 
@@ -144,7 +142,7 @@ dev-time source execution:
 
 ```bash
 pnpm -w run build
-pnpm --filter @sentry/mcp-server start auth status
+pnpm --filter sentry run cli auth status
 pnpm -w run cli --transport stdio "who am I?"
 ```
 

.craft.yml

@@ -3,9 +3,11 @@ workspaces:
   packages/cli:
     changelog:
       policy: auto
-      # The CLI release also ships the documentation workspace.
+      # The CLI release also ships the documentation workspace and
+      # @sentry/mcp-server.
       includePaths:
         - apps/cli-docs
+        - packages/mcp-server
       aiSummary:
         llm:
           model: gpt-5.6-luna-utility
@@ -24,10 +26,19 @@ workspaces:
           Build:
             - "/^sentry-.*$/"
             - "npm-package"
+            - "mcp-server-npm-package"
             - "vercel"
     targets:
       - name: npm
         includeNames: '/^sentry-\d.*\.tgz$/'
+      # The standalone MCP server, published at the CLI's version.
+      - name: npm
+        id: "@sentry/mcp-server"
+        includeNames: '/^sentry-mcp-server-\d.*\.tgz$/'
+      # Lists that npm package in the MCP Registry. After the npm targets: the
+      # registry checks that npm serves the version.
+      - name: mcp-registry
+        manifest: server.json
       - name: github
         tagPrefix: "cli@"
       - name: vercel
@@ -114,16 +125,3 @@ workspaces:
         includeNames: '/^{{packageSimpleName}}-\d.*\.tgz$/'
       - name: npm
         includeNames: '/^{{packageSimpleName}}-\d.*\.tgz$/'
-  packages/mcp-server:
-    changelogPolicy: none
-    preReleaseCommand: >-
-      bash -c 'set -e; for package in packages/mcp-* packages/smoke-tests; do
-      (cd "$package" && npm version "$CRAFT_NEW_VERSION" --no-git-tag-version);
-      done'
-    releaseBranchPrefix: release/mcp
-    targets:
-      - name: github
-        includeNames: '/^sentry-mcp-server-\d.*\.tgz$/'
-      - name: npm
-        id: "@sentry/mcp-server"
-        includeNames: '/^sentry-mcp-server-\d.*\.tgz$/'

.github/workflows/cli-build.yml

@@ -289,6 +289,19 @@ jobs:
         with:
           name: npm-package
           path: packages/cli/*.tgz
+      # Every CLI release also publishes @sentry/mcp-server at the same version.
+      - name: Bundle mcp-server
+        run: pnpm --filter @sentry/mcp-server run bundle
+      - name: Test mcp-server bundle
+        run: pnpm --filter @sentry/mcp-server run test:bundle
+      - name: Pack mcp-server
+        working-directory: packages/mcp-server
+        run: npm pack
+      - name: Upload mcp-server npm artifact
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        with:
+          name: mcp-server-npm-package
+          path: packages/mcp-server/*.tgz
 
   test-npm:
     name: Test npm Package (Node ${{ matrix.node }})

.github/workflows/merge-jobs.yml

@@ -2,7 +2,7 @@ name: Post-merge tasks
 
 on:
   push:
-    branches: ["main", "release/*", "release/mcp/**", "release/logger/**"]
+    branches: ["main", "release/*", "release/logger/**"]
   workflow_dispatch:
 
 jobs:
@@ -26,18 +26,14 @@ jobs:
         run: pnpm install
 
       - name: Build
-        run: pnpm --filter '@sentry/mcp-server...' --filter @sentry/logger --if-present run build
+        run: pnpm --filter '@sentry/mcp-core...' --filter @sentry/logger --if-present run build
 
       - name: Run linter
         run: pnpm lint
 
       - name: Run tests
         run: pnpm test:ci
 
-      - name: Package mcp-server
-        working-directory: packages/mcp-server
-        run: pnpm pack --pack-destination dist
-
       - name: Package logger
         working-directory: packages/logger
         run: pnpm pack --pack-destination dist
@@ -47,7 +43,6 @@ jobs:
         with:
           name: ${{ github.sha }}
           path: |
-            ${{ github.workspace }}/packages/mcp-server/dist/*.tgz
             ${{ github.workspace }}/packages/logger/dist/*.tgz
 
       - name: Publish Test Report

.github/workflows/release.yml

@@ -7,11 +7,10 @@ on:
         description: Product to release
         required: true
         type: choice
-        default: mcp
+        default: cli
         options:
           - cli
           - logger
-          - mcp
       bump:
         description: Version bump type
         required: true
@@ -60,6 +59,8 @@ jobs:
         env:
           PRODUCT: ${{ inputs.product }}
         run: |
+          # Each product maps to a `.craft.yml` workspace. The `cli` release
+          # also publishes @sentry/mcp-server at the same version.
           case "$PRODUCT" in
             cli)
               workspace=packages/cli
@@ -69,10 +70,6 @@ jobs:
               workspace=packages/logger
               package_path=packages/logger
               ;;
-            mcp)
-              workspace=packages/mcp-server
-              package_path=packages/mcp-server
-              ;;
             *)
               echo "::error::Unsupported product: $PRODUCT"
               exit 1

.gitignore

@@ -78,8 +78,6 @@ coverage
 .env.sentry-build-plugin
 
 # Generated files
-packages/mcp-server/src/toolDefinitions.json
-packages/mcp-server/src/skillDefinitions.json
 packages/mcp-server-evals/eval-results.json
 apps/cli-docs/.astro
 apps/cli-docs/src/content/docs/commands/

.oxlintrc.json

@@ -53,6 +53,28 @@
         "jsx-a11y/no-static-element-interactions": "off"
       }
     },
+    {
+      "files": ["packages/mcp-core/**/*.{ts,tsx,js,mjs,cjs}"],
+      "rules": {
+        "no-restricted-imports": [
+          "error",
+          {
+            "paths": [
+              {
+                "name": "sentry",
+                "message": "mcp-core and toolkit-core must not import the Sentry CLI. Inject CLI-only capabilities through interfaces defined in mcp-core or toolkit-core (see docs/architecture/overview.md#package-dependency-direction)."
+              }
+            ],
+            "patterns": [
+              {
+                "group": ["sentry/**", "**/cli/src/**", "**/packages/cli/**"],
+                "message": "mcp-core and toolkit-core must not import the Sentry CLI. Inject CLI-only capabilities through interfaces defined in mcp-core or toolkit-core (see docs/architecture/overview.md#package-dependency-direction)."
+              }
+            ]
+          }
+        ]
+      }
+    },
     {
       "files": [
         "packages/cli/src/**/*.{ts,tsx}",
@@ -154,6 +176,10 @@
           "error",
           {
             "paths": [
+              {
+                "name": "sentry",
+                "message": "mcp-core and toolkit-core must not import the Sentry CLI. Inject CLI-only capabilities through interfaces defined in mcp-core or toolkit-core (see docs/architecture/overview.md#package-dependency-direction)."
+              },
               {
                 "name": "assert",
                 "message": "Shared toolkit-core modules move into @sentry/api and must run in browsers. Use web-standard APIs, or inject the host-specific piece."
@@ -268,6 +294,10 @@
               }
             ],
             "patterns": [
+              {
+                "group": ["sentry/**", "**/cli/src/**", "**/packages/cli/**"],
+                "message": "mcp-core and toolkit-core must not import the Sentry CLI. Inject CLI-only capabilities through interfaces defined in mcp-core or toolkit-core (see docs/architecture/overview.md#package-dependency-direction)."
+              },
               {
                 "group": ["node:*"],
                 "message": "Shared toolkit-core modules move into @sentry/api and must run in browsers. Use web-standard APIs, or inject the host-specific piece."

AGENTS.md

@@ -12,6 +12,7 @@ Toolkit contains the Sentry CLI, the Sentry MCP server, and shared code. Product
 
 - **MCP tool count**: Target ≤20, hard limit 25 (AI agents have limited tool slots).
 - **Quality gate**: `pnpm run tsc && pnpm run lint && pnpm run test` must pass before committing.
+- **Dependency direction**: `sentry` (cli) → `@sentry/mcp-core` → `@sentry/toolkit-core`, and `@sentry/mcp-cloudflare` → `@sentry/mcp-core`; never the reverse. mcp-core and toolkit-core never import the CLI. Inject CLI-only capabilities (SQLite cache, local-file DSN detection, file uploads) through interfaces defined in mcp-core or toolkit-core. `pnpm run lint` enforces this; see docs/architecture/overview.md#package-dependency-direction.
 - **Package CI**: Put checks for one workspace package in its `package.json` scripts and `sentryCi`, which `test.yml` runs per project. Do not add a workflow for them. See docs/operations/github-actions.md#package-ci-checks.
 
 ## Repository Structure
@@ -71,7 +72,7 @@ toolkit/
 
 - docs/architecture/overview.md — MCP system design
 - docs/operations/security.md — Authentication and security patterns
-- docs/operations/stdio-auth.md — Device code flow, token caching, client ID architecture
+- docs/operations/stdio-auth.md — stdio auth: shared CLI login and static tokens
 - docs/operations/oauth-signout-playbook.md — Remote OAuth diagnostic runbook
 - docs/operations/embedded-agents.md — LLM provider configuration for AI-powered tools
 - docs/operations/github-actions.md — CI matrix, `package.json#sentryCi`, and MCP deployment workflows
@@ -99,7 +100,7 @@ toolkit/
 
 **MCP releases:**
 
-- docs/releases/stdio.md — npm package release
+- docs/releases/stdio.md — `@sentry/mcp-server` release and the MCP registry
 - docs/releases/cloudflare.md — Cloudflare deployment
 
 ## Commands