Sentry (Archived Reference) — agentic threat model

Not certain from the listing — The Sentry MCP server is model-agnostic and relies on an external LLM client. The primary L1 threat is indirect prompt injection via user-supplied error messages and stack traces retrieved from Sentry, which could reprogram the host LLM.

Retrieves Sentry issue payloads and stack traces. These payloads contain user-supplied error messages, creating a significant data poisoning and indirect prompt injection surface where malicious inputs in application logs are ingested into the agent's context.

Uses the Model Context Protocol (MCP) to expose issue retrieval and stack trace analysis tools. Vulnerabilities include insecure tool integration if the orchestrating agent blindly executes actions or leaks sensitive stack trace data to unauthorized parties.

Not certain from the listing — As an open-source reference server, deployment details depend on the user's environment. However, it requires a Sentry auth token, which if stored insecurely in environment variables or hardcoded, poses a credential theft risk.

Not certain from the listing — The reference implementation does not detail built-in guardrails, evaluation frameworks, or anomaly detection for malicious payloads retrieved from Sentry.

Relies on Sentry token authentication for access control. Compliance risks include potential exposure of Personally Identifiable Information (PII) or secrets accidentally logged in Sentry stack traces and retrieved by the agent.

Designed as an MCP tool for other agents. A compromised or malicious orchestrator agent could abuse this tool to exfiltrate sensitive proprietary code structure or user data contained within Sentry error logs.