Numeric issue IDs bypass project-scoped MCP sessions
Maintainers usually reply within 1 day
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 30/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start with the project-scoped check added in commit 01b06bba (#1922) and see how it validates org-qualified targets and short IDs against the session's project. Then trace how issue view resolves a numeric ID to an issue and where the CLI could fetch the issue's project before reading or changing it. Done means a numeric ID outside the session's project is rejected in a sentry mcp --commands session, with tests covering the case.
Written by the indexing model from the issue text.
Description
Part of #1357. Found while reviewing #1922.
In a project-scoped sentry mcp --commands session, an issue command that takes a numeric ID can read or change an issue in another project of the same org. For example, issue view 12345 in an acme/web session reaches an issue that lives in acme/api. The command surface checks each target before the call, but a numeric ID doesn't say which project the issue belongs to, so it can't be checked there.
- Org-qualified targets and issue short IDs are already checked against the session's project in #1922 (01b06bba). Numeric IDs are the remaining path.
- The same gap applies to any other command that resolves an opaque ID to a project-owned resource.
- Proposal (BYK, while reviewing #1922): after looking up the issue, the CLI compares its project with the session constraint before reading or changing anything. Since that's a CLI change outside #1922's command surface, it lands separately.
via @BYK.
--
- Dominant language
- TypeScript
- Stars
- 961
- Forks
- 179
- Avg merge
- 15h 33m
- Merged PRs (30d)
- 476
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from getsentry/toolkit
-
MCP mcp-feedback-pattern
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
getsentry/toolkit#2276 · 1 comment ·
Maintainers usually reply within 1 day
-
CLI enhancement MCP
Difficulty 2/5 1-3 hours Newbie friendliness 63/100
getsentry/toolkit#1908 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
getsentry/toolkit#1471 · 1 comment ·
Maintainers usually reply within 1 day
-
get_sentry_resource gives no guidance for Explore > Errors list URLsPossibly taken @sentry-junior claimed this today. OpenMCP mcp-feedback-pattern
Difficulty 2/5 1-3 hours Newbie friendliness 32/100
getsentry/toolkit#2278 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 3/5 1-2 days Newbie friendliness 65/100
getsentry/toolkit#2275 · 1 comment ·
Maintainers usually reply within 1 day
All issues in getsentry/toolkit
Similar issues
-
Add: BOM CineOpenapproved check:passed streams:add
Difficulty 1/5 Under an hour Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
Maintainers usually reply within 1 day
-
bug platform-android
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Termix-SSH/Mobile#146 · 1 comment ·
Maintainers usually reply within 2 days
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 66/100
devswha/herdr-web-ui#3875 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 88/100