`wrapMcpServerWithSentry` defaults `recordInputs` / `recordOutputs` to `true` (via `dataCollection.genAI`) |

Start in packages/core/src/integrations/mcp-server/transport.ts, especially resolveMcpOptions, and compare its capture defaults with dataCollection.genAI and the scrubbing posture in piiFiltering.ts. Clarify which explicit-option and genAI settings should enable capture, then verify that a bare MCP wrapper is metadata-only or emits the documented warning when both flags resolve true.

Static review of public source at commit b633c8153250. No traffic was sent to any Sentry environment.

MCP server instrumentation resolves capture flags like this:

packages/core/src/integrations/mcp-server/transport.ts:

function resolveMcpOptions(options: McpServerWrapperOptions): ResolvedMcpOptions {
  // ...
  const genAI = getClient()?.getDataCollectionOptions().genAI;
  return {
    recordInputs: options.recordInputs ?? genAI?.inputs ?? true,
    recordOutputs: options.recordOutputs ?? genAI?.outputs ?? true,
  };
}

dataCollection.genAI itself documents { inputs: true, outputs: true } as the default. So a bare Sentry.wrapMcpServerWithSentry(server) will put tool/prompt arguments and results on spans (tokens, file paths, user content, etc.) unless the operator remembers to pass { recordInputs: false, recordOutputs: false } or tighten dataCollection.genAI.

That is great for AI debugging; it is a surprising default for MCP servers that often proxy secrets and private data.

Suggested change:

• Default MCP wrapper capture to false / metadata-only unless recordInputs/recordOutputs or dataCollection.genAI is explicitly enabled; or
• Keep genAI defaults but make wrapMcpServerWithSentry() document and prefer explicit { recordInputs, recordOutputs } with a one-time startup log when both resolve to true.
• Mirror the scrubbing posture already used for network PII in piiFiltering.ts.

Severity: low–medium / privacy & data-minimization defense-in-depth (parallel to the Python SDK EventScrubber recursive default discussion). Not claiming a Sentry platform vulnerability. No proof-of-concept.

Happy to send a focused PR if useful.