mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-11-13 15:55:46 +01:00
DottaandClaude Opus 5.5
34f2bb78ee
## Thinking Path
> - Paperclip is the open source app people use to manage AI agents for
work
> - Agents use app connections to call provider tools, such as the
Sentry MCP server
> - The Sentry connection has only one method: browser sign-in through
the hosted MCP OAuth server
> - That grant expires. An unattended triage agent loses Sentry access
until a person signs in again
> - During that time, a scheduled triage routine completes each run but
reads no Sentry data
> - This pull request adds a second Sentry method that uses a user auth
token
> - The benefit is a Sentry connection that stays valid until a person
revokes the token
## Linked Issues or Issue Description
**Subsystem affected**
App connections: the Sentry entry in the connection catalog.
**Problem or motivation**
A Sentry connection that was created with browser sign-in on 2026-10-11
changed to "OAuth authorization expired. Reconnect this app to
continue." at 04:01 UTC on 2026-11-10. The agent that used it had no
Sentry tools after that time. Each hourly triage run reported the
blocker but could not continue. Unattended agents need a Sentry
connection that does not need a person to sign in again each month.
**Proposed solution**
The hosted Sentry MCP server accepts a Sentry user auth token in the
`Authorization: Sentry-Bearer <token>` header. It reserves `Bearer` for
its own OAuth tokens. Paperclip API-key methods already support a custom
header prefix. Add a Sentry API-key method that uses this header.
**Alternatives considered**
Reconnect with browser sign-in again. That restores access only until
the next grant expiry.
## What Changed
- Add the `mcp-user-token` method ("Use a user auth token") to Sentry in
`scripts/ingest-app-definitions.mjs`. It uses the same server URL and
sends the token as `Authorization: Sentry-Bearer <token>`.
- Regenerate `packages/shared/src/app-definitions/sentry.json`. I did
not include unrelated output that the content corpus drift caused for
other providers.
- Add a permission review entry for the new method in
`doc/connections/tool-method-permission-reviews.json`.
- Add a test for the new method and its header prefix.
- Document the token method, its required scopes, and its ownership risk
in `doc/connections/SENTRY.md`.
## Verification
- `pnpm exec vitest run packages/shared/src/app-definitions.test.ts`: 40
passed. The new assertion fails on `master` because Sentry has only one
method there.
- `pnpm exec vitest run src/__tests__/tool-access-service.test.ts -t
Sentry` (server): 2 passed.
- `pnpm exec vitest run ui/src/pages/apps/app-connect-policy.test.ts
server/src/__tests__/satisfied-connection-intents.test.ts`: 64 passed.
- `pnpm verify` returned exit 2 (a doc is a global CI input). Required
CI supplies the broad coverage.
- Live probe of `https://mcp.sentry.dev/mcp` with an `initialize`
request: `Authorization: Sentry-Bearer <invalid token>` starts an MCP
session (the token is checked on tool calls). `Authorization: Bearer
<same token>` returns `401 invalid_token`. This confirms the server
accepts the header scheme.
- Not done yet: a real agent tool call with a real token after
deployment.
## Risks
- Low risk. This adds a method. The existing OAuth method and saved
connections do not change.
- A user auth token acts as its creator and lasts until revoked. The
method guidance and docs say this. Rotate the token when that person
leaves.
- If Sentry changes the `Sentry-Bearer` scheme, connections that use
this method fail on tool calls. The OAuth method still works.
> For core feature work, check [`ROADMAP.md`](ROADMAP.md) first and
discuss it in `#dev` before opening the PR. Feature PRs that overlap
with planned core work may need to be redirected — check the roadmap
first. See `CONTRIBUTING.md`.
## Model Used
- Claude Opus 5.5 (`claude-opus-5-5`) in Claude Code, with tool use
(shell, browser, web search).
## Checklist
- [x] I have included a thinking path that traces from project context
to this change
- [x] I have specified the model used (with version and capability
details)
- [x] I have checked ROADMAP.md and confirmed this PR does not duplicate
planned core work
- [x] I have searched GitHub for duplicate or related PRs and linked
them above
- [x] I have either (a) linked existing issues with `Fixes: #` / `Closes
#` / `Refs #` OR (b) described the issue in-PR following the relevant
issue template
- [x] I have not referenced internal/instance-local Paperclip issues or
links (only public GitHub `#NNN` / `github.com/paperclipai/paperclip`
URLs)
- [x] My branch name describes the change (e.g. `docs/...`, `fix/...`)
and contains no internal Paperclip ticket id or instance-derived details
- [x] I have run tests locally and they pass
- [x] I have added or updated tests where applicable
- [x] I have updated relevant documentation to reflect my changes
- [x] I have considered and documented any risks above
- [ ] All Paperclip CI gates are green
- [ ] Greptile is 5/5 with no open P2s, recommendations, or follow-ups
- [x] I will address all Greptile and reviewer comments before
requesting merge
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
90 lines
2.8 KiB
JSON
90 lines
2.8 KiB
JSON
{
|
|
"schemaVersion": 1,
|
|
"slug": "sentry",
|
|
"name": "Sentry",
|
|
"description": "Investigate errors, releases, and production issues.",
|
|
"categories": [
|
|
"developer"
|
|
],
|
|
"featured": false,
|
|
"branding": {
|
|
"logoUrl": "/brands/apps/sentry.svg",
|
|
"darkLogoUrl": "/brands/apps/sentry-dark.svg"
|
|
},
|
|
"urlPatterns": [
|
|
"https://mcp.sentry.dev/*"
|
|
],
|
|
"methods": [
|
|
{
|
|
"key": "mcp-oauth",
|
|
"transport": "mcp_remote",
|
|
"auth": "oauth",
|
|
"ownershipModes": [
|
|
"customer",
|
|
"dcr"
|
|
],
|
|
"whenToUse": "Use the provider-hosted connection for the quickest setup.",
|
|
"defaults": {
|
|
"serverUrl": "https://mcp.sentry.dev/mcp",
|
|
"discoveryUrl": "https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp",
|
|
"scopesHint": [
|
|
"org:read",
|
|
"project:write",
|
|
"team:write",
|
|
"event:write",
|
|
"alerts:write"
|
|
]
|
|
},
|
|
"guidanceMd": "Connect the Sentry organization and projects agents need for incident work.",
|
|
"riskTier": "S2",
|
|
"requiredResourceFilters": [
|
|
"organization",
|
|
"project",
|
|
"environment"
|
|
]
|
|
},
|
|
{
|
|
"key": "mcp-user-token",
|
|
"transport": "mcp_remote",
|
|
"auth": "api_key",
|
|
"ownershipModes": [
|
|
"customer"
|
|
],
|
|
"whenToUse": "Use a user auth token when an unattended agent needs Sentry access that does not expire with a browser sign-in grant.",
|
|
"defaults": {
|
|
"serverUrl": "https://mcp.sentry.dev/mcp"
|
|
},
|
|
"guidanceMd": "Connect with a Sentry user auth token for unattended agents. Browser sign-in grants expire and need the owner to sign in again; a user auth token lasts until you revoke it.",
|
|
"riskTier": "S2",
|
|
"label": "Use a user auth token",
|
|
"credentialFields": [
|
|
{
|
|
"key": "authorization",
|
|
"label": "Sentry user auth token",
|
|
"type": "password",
|
|
"required": true,
|
|
"placeholder": "sntryu_...",
|
|
"secret": true,
|
|
"helperMd": "Create a user auth token with org:read, project:read, project:write, team:read, team:write and event:write. The token acts as its creator; Paperclip cannot increase an existing token's permissions."
|
|
}
|
|
],
|
|
"keyPlacement": {
|
|
"location": "header",
|
|
"name": "Authorization",
|
|
"prefix": "Sentry-Bearer "
|
|
},
|
|
"consoleLinks": {
|
|
"keys": "https://sentry.io/settings/account/api/auth-tokens/",
|
|
"docs": "https://github.com/getsentry/sentry-mcp#remote-server"
|
|
},
|
|
"requiredResourceFilters": [
|
|
"organization",
|
|
"project",
|
|
"environment"
|
|
]
|
|
}
|
|
],
|
|
"docsUrl": "https://mcp.sentry.dev/.well-known/oauth-authorization-server",
|
|
"redirectConstraints": "https-or-loopback-http"
|
|
}
|