Sentry MCP OAuth fails with "Invalid redirect URI" (CIMD client-id flow, not port-related)

Status Open
Maintainer reply None cached
Activity 1 comment · opened Jul 27, 2026

Description

Authenticating the built-in /mcp OAuth flow against Sentry's remote MCP server (https://mcp.sentry.dev/mcp) consistently fails with "Invalid redirect URI" from Sentry's authorization endpoint, even after pinning a fixed local callback port via --callback-port.

Steps to reproduce

  1. claude mcp add --transport http sentry https://mcp.sentry.dev/mcp --callback-port 8090
  2. In an interactive session, run /mcp and select sentry to authenticate
  3. Browser opens Sentry's authorize page, then redirects back and Sentry reports "Invalid redirect URI"

Observed vs expected

  • Expected: OAuth completes and sentry shows as connected in claude mcp list.
  • Observed: Fails at the redirect step regardless of which local port is pinned.

Diagnostic detail

Inspecting ~/.claude/.credentials.json after a failed attempt shows the registered OAuth client for sentry:

"sentry|<hash>": {
  "serverName": "sentry",
  "serverUrl": "https://mcp.sentry.dev/mcp",
  "accessToken": "",
  "discoveryState": {
    "authorizationServerUrl": "https://mcp.sentry.dev",
    "oauthMetadataFound": true
  },
  "clientId": "https://claude.ai/oauth/claude-code-client-metadata",
  "redirectUri": "http://localhost:8090/callback"
}

Note that clientId is a URL rather than an opaque per-registration string. For comparison, a working MCP server in the same file (Atlassian) has a normal opaque clientId (e.g. "9x7sh1vLBPHawvkh"), consistent with classic Dynamic Client Registration (RFC 7591).

This suggests Claude Code is using an OAuth Client ID Metadata Document (CIMD)-style flow for Sentry — sending https://claude.ai/oauth/claude-code-client-metadata as the client_id and expecting Sentry's authorization server to fetch that document to learn the allowed redirect_uris — rather than performing Dynamic Client Registration against Sentry directly.

Pinning --callback-port changes the local port requested in redirect_uri, but does not change which client-identification method is used, and the error persists across different ports (8090 confirmed exact match in both the request and the stored redirect_uri, still rejected).

Suspected root cause

Either:

  • Sentry's MCP OAuth server does not support / does not correctly resolve the CIMD flow, and Claude Code has no fallback to classic DCR for this server, or
  • The metadata document served at https://claude.ai/oauth/claude-code-client-metadata does not declare http://localhost:<port>/callback as an allowed redirect URI in a way Sentry accepts.

Environment

  • Claude Code (native install), Windows 11
  • MCP server: https://mcp.sentry.dev/mcp (HTTP transport)

Possible workaround

Registering a custom OAuth app directly in Sentry (Settings → Developer Settings) and passing --client-id/--client-secret explicitly to claude mcp add may bypass the CIMD path, but this shouldn't be required for a server listed as a standard Claude Code MCP OAuth example.

View original on GitHub ↗

This issue has 1 comment on GitHub. Read the full discussion on GitHub ↗