Sentry MCP server returns 401 invalid_token — SENTRY_API_KEY may be expired

[lpcox]

Problem

The Sentry MCP backend consistently fails to register tools with a 401 invalid_token error during gateway startup. This means agents in workflows that configure Sentry have no access to Sentry tools.

Evidence

Workflow run: https://github.com/github/gh-aw/actions/runs/24940914427/job/73034425192
Workflow: "Daily OTel Instrumentation Advisor"

From mcp-gateway.log (gateway startup):

[2026-04-25T21:20:03Z] [ERROR] [backend] [sentry] Failed to register tools from sentry (took 201.9333ms):
  failed to connect: failed to create HTTP connection:
  failed to connect using any HTTP transport (tried streamable, SSE, and plain JSON-RPC):
  last error: plain JSON-RPC initialize failed: initialize failed:
  status=401, body={"error":"invalid_token","error_description":"Invalid access token"}

[2026-04-25T21:20:03Z] [ERROR] [backend] Tool registration incomplete:
  1 of 3 backends failed: [sentry] — agents will not see tools from these servers

[2026-04-25T21:20:03Z] [INFO] [backend] Tool registration complete:
  2 succeeded, 1 failed, total tools=29

Config pipeline (working correctly)

The token delivery chain is functional — the issue is the token value itself:

1. SENTRY_API_KEY is set as a repository/org secret (masked in logs as ***)
2. Forwarded to MCPG Docker container via -e SENTRY_API_KEY
3. Expanded in stdin JSON config: "SENTRY_API_KEY": "${SENTRY_API_KEY}"
4. Gateway config validation confirms expansion: Expanded variable: SENTRY_API_KEY (found in environment)
5. Gateway attempts to connect to https://mcp.sentry.dev/mcp/gh-aw-test.sentry.io/gh-aw/
6. Sentry responds with 401 invalid_token

Impact

• Workflows that configure Sentry as an MCP backend (e.g., otel-advisor) silently lose Sentry tool access
• The agent still runs with remaining backends (github, safeoutputs) but cannot query Sentry data
• The otel-advisor agent explicitly noted: "The Sentry MCP server was inaccessible during this run (empty tool list)"

Suggested fix

Rotate or regenerate the SENTRY_API_KEY secret and verify it works against the Sentry MCP endpoint (https://mcp.sentry.dev/mcp/gh-aw-test.sentry.io/gh-aw/).