# sentry probes, 2026-09-17T18:06Z, from a cloud container (one IP), no credentials, no payment
# Responses are cut at 6000 bytes (initialize), 2500 (protected resource), 9000 (authorization server), 4000 (REST). Nothing here was sent with a credential.

## 1. MCP initialize, POST https://mcp.sentry.dev/mcp
$ curl -sS -i -m 25 -X POST https://mcp.sentry.dev/mcp -H 'Content-Type: application/json' -H 'Accept: application/json, text/event-stream' -d '<initialize>'
HTTP/1.1 200 Connection Established

HTTP/2 401 
date: Thu, 17 Sep 2026 18:06:15 GMT
content-length: 0
cache-control: no-store
www-authenticate: Bearer realm="OAuth", resource_metadata="https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp"
pragma: no-cache
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3mZmFoEbiFiSNMX5c91nMNUX363pqSl8%2B0PcKC8vxTMCrbSbJzS4%2FfmTYilwT0k%2BAc3rH%2FFcdiegXwMCCpIdeUURrWBX5MVKmxv3mkGymtz0X9SicmeA7%2FiGvx%2FZLv%2Fpww%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a3ca0b33092a33a9-BOS
alt-svc: h3=":443"; ma=86400



## 2. Protected-resource metadata, GET https://mcp.sentry.dev/.well-known/oauth-protected-resource/mcp
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:06:16 GMT
content-type: application/json
content-length: 205
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, OPTIONS
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=bsqYPtcnRxWVM0uFGMWFfIibVwEmBO3sazFncy%2Fjx%2BHFB276qGX0ysqTOJLi9QILuEDYC1MJyHuFkcuERK2SZ0oUxIscFbX6WOWoRBacyeqirlAT7sYrT5RFyukjjDeBlQ%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a3ca0b36dcc59021-BOS
alt-svc: h3=":443"; ma=86400

{"resource":"https://mcp.sentry.dev/mcp","authorization_servers":["https://mcp.sentry.dev"],"scopes_supported":["org:read","project:write","team:write","event:write"],"bearer_methods_supported":["header"]}

## 3. Authorization-server metadata, GET https://mcp.sentry.dev/.well-known/oauth-authorization-server
HTTP/1.1 200 Connection Established

HTTP/2 200 
date: Thu, 17 Sep 2026 18:06:16 GMT
content-type: application/json
content-length: 724
access-control-allow-origin: *
access-control-allow-headers: Content-Type
access-control-allow-methods: GET, OPTIONS
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=OVLJH4wY8wsYZYl80OqEsTwrbkqYxKGfgeI2Um8B8q33mcXnM6YoFN6Dp3ejz8pu95dj5N%2Fnl3yJSVl7xJdjMyIe3%2BGrNJyjYj2U%2BDdFFTXsL0zGe4qZ1%2FiU5EHmPZ2Rpg%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
server: cloudflare
cf-ray: a3ca0b3acb71f281-BOS
alt-svc: h3=":443"; ma=86400

{"issuer":"https://mcp.sentry.dev","authorization_endpoint":"https://mcp.sentry.dev/oauth/authorize","token_endpoint":"https://mcp.sentry.dev/oauth/token","registration_endpoint":"https://mcp.sentry.dev/oauth/register","scopes_supported":["org:read","project:write","team:write","event:write"],"response_types_supported":["code"],"response_modes_supported":["query"],"grant_types_supported":["authorization_code","refresh_token"],"token_endpoint_auth_methods_supported":["client_secret_basic","client_secret_post","none"],"revocation_endpoint":"https://mcp.sentry.dev/oauth/token","code_challenge_methods_supported":["S256"],"authorization_response_iss_parameter_supported":true,"client_id_metadata_document_supported":true}

## 4. REST, GET https://sentry.io/api/0/projects/, no Authorization header
HTTP/1.1 200 Connection Established

HTTP/2 401 
server: nginx
date: Thu, 17 Sep 2026 18:06:17 GMT
content-type: application/json
content-length: 58
www-authenticate: Bearer realm="api"
allow: GET, HEAD, OPTIONS
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-headers: X-Sentry-Auth, X-Requested-With, Origin, Accept, Content-Type, Authentication, Authorization, Content-Encoding, sentry-trace, baggage, X-CSRFToken
access-control-expose-headers: X-Sentry-Error, X-Sentry-Direct-Hit, X-Hits, X-Max-Hits, Endpoint, Retry-After, Link
access-control-allow-origin: *
x-sentry-rate-limit-remaining: 39
x-sentry-rate-limit-limit: 40
x-sentry-rate-limit-reset: 1789668378
x-sentry-rate-limit-concurrentremaining: 24
x-sentry-rate-limit-concurrentlimit: 25
vary: Accept-Language, Cookie
content-language: en
x-frame-options: deny
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cross-origin-opener-policy-report-only: same-origin; report-to="coop-endpoint"
report-to: {"group":"coop-endpoint","max_age":86400,"endpoints":[{"url":"https://sentry-coop-302178938983.us-central1.run.app/coop"}]}
content-security-policy: base-uri 'none'; script-src 'self' 'unsafe-inline' 'report-sample' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com app.intercom.io widget.intercom.io js.intercomcdn.com; connect-src 'self' *.algolia.net *.algolianet.com *.algolia.io browser.sentry-cdn.com sentry.io *.sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io maps.googleapis.com *.intercom.io wss://*.intercom.io *.intercom-messenger.com wss://*.intercom-messenger.com uploads.intercomcdn.com uploads.intercomusercontent.com; media-src *; font-src * data:; worker-src 'self' blob:; default-src 'none'; img-src * blob: data:; frame-ancestors 'self' *.sentry.io; object-src 'none'; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io 'self' intercom-sheets.com www.intercom-reporting.com; style-src * 'unsafe-inline'; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=e6cd26b79e3880d44f0847361810021adaa88f87
x-envoy-upstream-service-time: 7
strict-transport-security: max-age=31536000; includeSubDomains; preload
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

{"detail":"Authentication credentials were not provided."}