Support inviting organization members via MCP

Open
  • Is something wrong?
#2,047 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
48/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
api, authentication

Research direction

Start with the MCP tools and API client in mcp-core, then read mcp-core/src/permissions.ts and mcp-core/src/scopes.ts alongside the hosted OAuth route at mcp-cloudflare/src/server/oauth/routes/authorize.ts. Trace how existing tools make authenticated requests and check the organization member endpoint’s permission and invite constraints. Done means an invite tool is available with the required scope and permission handling, and tests cover successful invitations and relevant errors, including disabled invites and conflicts.

Written by the indexing model from the issue text.

Description

The Sentry MCP server has no way to invite or add members to an organization. So when a user asks their agent to invite people by email, the agent gets stuck. One agent hit this and sent in user feedback (MCP-SERVER-GKS): the user asked to invite three emails to their org, and the agent found nothing that could do it.

Current state

  • No tool in the catalog invites, adds or lists org members. mcp-core has no API client calls to /organizations/{org}/members/.
  • Sentry already exposes POST /api/0/organizations/{org}/members/ (email, orgRole, teamRoles, sendInvite). MemberPermission allows POST with member:invite, member:write or member:admin.
  • The hosted OAuth flow (mcp-cloudflare/src/server/oauth/routes/authorize.ts) asks for a fixed set of scopes from mcp-core/src/scopes.ts: org:read project:write team:write event:write alerts:write. None of those are member scopes, so existing hosted tokens can't call the endpoint.
  • member:invite is not in the MCP Scope type in mcp-core/src/permissions.ts, which only has member:read/write/admin.

Constraints the backend already enforces

  • The organizations:invite-members feature can turn invites off for an org (403).
  • The assigned role must be one the inviter is allowed to grant. It defaults to member.
  • When open team membership is off, members with member:invite can only invite into teams they belong to.
  • Invites are rate-limited per org, email and inviter (429). Existing invites or invite requests return conflict errors.

Why it matters

  • Inviting teammates is a common setup step. Adding members can also lead orgs to a paid plan.
  • An invite sends a real email to an outside address. That's a new kind of side effect for the MCP, and it should be guarded against agent mistakes.

Related: #927 (org member / assignee lookup tools).

via Dhrumil.

--

View Session [Sentry]

Dominant language
TypeScript
Stars
961
Forks
179
Avg merge
15h 33m
Merged PRs (30d)
476

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from getsentry/toolkit

All issues in getsentry/toolkit

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.