AutoGineer
Generated banner for Browse Local Sentry
Generated logo for Browse Local Sentry

Browse Local Sentry

SentryOfficialPublished by Sentry

  • Skill
  • Tool integration
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Connects an agent's browser to a local Sentry dev server (dev-ui on *.dev.getsentry.net or the full devserver).
— the description by Sentry

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured workflow for connecting an agent's browser session to a local Sentry development server. It distinguishes between the dev-ui (which interacts with production Sentry data using the user's authenticated session) and the full devserver (which uses a local database). The skill includes rigorous safety checks for certificate validation and browser authentication, ensuring that the agent operates within the user's existing Chrome profile without compromising security or session integrity.

What it does

  • Identifies and locates active local Sentry development servers.
  • Validates SSL certificates to ensure secure connections to local dev environments.
  • Integrates with the user's existing Chrome browser session for authenticated access.
  • Verifies authentication status via Sentry API endpoints.
  • Provides troubleshooting paths for common certificate and browser connectivity issues.
  • Ensures safe interaction by preventing unauthorized data modification in production-linked environments.

When to use it

  • When you need to test frontend changes against a live Sentry development server.
  • When the agent needs to perform browser-based QA on local Sentry builds.
  • When you encounter certificate errors or authentication failures while connecting to a local Sentry instance.
  • When you need to switch between production-linked dev-ui and local-database devserver environments.

Advantages

  • Maintains user session security by leveraging existing browser profiles.
  • Provides clear, actionable troubleshooting steps for common environment setup issues.
  • Prevents accidental data modification by enforcing strict operational rules.
  • Automates the complex process of port discovery and browser attachment.

Usage examples

“Connect to my local Sentry dev-ui.”
The agent will identify the running dev-ui port, verify the SSL certificate, attach to your active Chrome session, and confirm authentication.
“I am getting a certificate error when trying to browse my local Sentry instance.”
The agent will guide you through the troubleshooting steps, including verifying the local CA installation and checking the dev-ui certificate status.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/getsentry/browse-local-sentry/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip browse-local-sentry.zip -d .agents/skills

Documentation by Sentry

Browse Local Sentry

ServerURLDataBrowser
dev-ui (pnpm run dev-ui)https://<org-slug>.dev.getsentry.net:<port>/. Ask the user for the org if it is unknown.Production sentry.io, as the userThe user's own Chrome, the only one with their session
Full devserver (devservices serve)http://dev.getsentry.net:8000/Local databaseAny

Run every check in every session. Chrome updates, re-auth, and port changes undo earlier setup without warning. When a check fails, open the named section of references/troubleshooting.md.

Rules

  • dev-ui acts on production sentry.io as the user, including any staff or superuser session. Do not create, edit, or delete anything, and stay in the org the user named, unless the user approves the specific action. Use the full devserver for flows that change data.

  • Never bypass certificate warnings (thisisunsafe, --ignore-certificate-errors, --acceptInsecureCerts), log in to sentry.io yourself, or type the user's credentials.

  • Change the user's MCP config only with their approval.

  • In the user's own Chrome, open your own tabs with background: true, never isolatedContext, which has no session. Never navigate, reload, close, read, screenshot, run scripts in, or quote the user's tabs. Emulate viewports instead of resizing the window, and close your tabs when done.

Step 1: Find the Server

Use the URL the user gives. Otherwise never assume a port: dev-ui tries 10 ports upward from SENTRY_WEBPACK_PROXY_PORT (default 7999) and prints the one it took, and the devserver logs to .artifacts/dev.log. List listeners with lsof -nP -iTCP -sTCP:LISTEN and match one to its clone with lsof -a -p <pid> -d cwd.

Step 2: Check the Certificate (dev-ui Only)

Outside any shell sandbox, run curl -sS -o /dev/null https://dev.getsentry.net:<port>/ (on macOS, /usr/bin/curl, which reads the keychain). If it fails, see Certificate.

Step 3: Attach to the User's Chrome (dev-ui Only)

Call list_pages, or use another tool that already drives the user's signed-in Chrome. The browser is attached when it lists the user's own tabs. If not, see Chrome.

Step 4: Check Authentication

Open the server URL in a new tab and read /api/client-config/. Continue when isAuthenticated is true. If not, see Authentication.

After editing frontend source, wait for the rebuild, then reload with the cache bypassed. If the console shows "An SSL certificate error occurred when fetching the script.", the certificate is not trusted; return to Step 2.

When a Step Is Blocked

Stop and tell the user which step failed and the exact action they need to take. Do not substitute tests, stories, or reasoning for browser QA, and do not write "browser verification was blocked" into a PR description in place of doing it.

Files

SOURCES.md

Browse Local Sentry Sources

SourceContributionConfidence
getsentry/sentry rsbuild.config.tsdev-ui loads config/localhost.pem when present, else a self-signed basic-ssl certificate, both at config load; proxies /api/ to production sentry.io; does not proxy /identity/ or /auth/High, read from source
getsentry/sentry package.json mkcert-localhost scriptCert command and SANs (dev.getsentry.net, *.dev.getsentry.net); writes the files before mkcert -install, so a file can exist without a trusted CAHigh, read from source
FiloSottile/mkcert cert.goLeaf certificates expire 2 years and 3 months after issueHigh, read from source
getsentry/sentry .gitignore/config/*.pem is ignored, so certs are per cloneHigh, read from source
getsentry/sentry scripts/dev-ui-server.tsPort starts at SENTRY_WEBPACK_PROXY_PORT or 7999 and searches 10 ports upwardHigh, read from source
getsentry/sentry AGENTS.md, devserver.py, runner/commands/createuser.pyDevserver is plain HTTP on 8000 with local accounts; .artifacts/dev.log; createuser flags for non-interactive useHigh, read from source
chrome-devtools-mcp 1.12.0 browser-options.js, ServerConfig.js, BrowserManager.js--autoConnect needs Chrome 144+ and chrome://inspect/#remote-debugging; channel choices; without it the server launches a dedicated profile under its cache directoryHigh, read from source
chrome-devtools-mcp docs/troubleshooting.md, docs/advanced-usage.md, docs/client-configurations.md, .claude-plugin/plugin.jsonmacOS Files & Folders fix, timeout causes including frozen tabs, default-profile rule, --browser-url needs a separate profile, Codex command, plugin args pinned without --autoConnectHigh, upstream docs
Sentry Cookie Sync 1.6.1 extension sourceCopies sentry.io session, su, staff, sc, and sudo cookies to dev.getsentry.net, only for orgs seen in open :7999 dev-ui or *.sentry.io tabsHigh, read from source
getsentry/sentry setup-dev skillSays Cookie Sync is required for the full devserver; conflicts with the extension's HTTPS-only host permissions, so not adoptedRejected
Maintainer's working setupOkta device trust rejects fresh profiles; nvm PATH gotchaMedium, observed in practice

Decisions

  • Adopted: probe trust with curl, then route with openssl verify of the served certificate against the local mkcert CA. curl's wording does not tell the fallback from an untrusted CA, and the issuer string cannot tell two mkcert CAs of the same user apart.

  • Adopted: keep the checks and safety rules in SKILL.md, and the failure procedures in references/troubleshooting.md, since a working setup needs only the checks.

  • Adopted: run Step 2 outside shell sandboxes, which hide the keychain from curl and may block openssl's direct connection.

  • Adopted: change MCP config only with the user's approval, since it persists, and pin the server version, since it controls a signed-in browser.

  • Adopted: detect a failed openssl capture with [ -s "$f" ], since LibreSSL and OpenSSL word the failure differently.

  • Adopted: ask for the org instead of using the bare dev.getsentry.net host, which can land in an arbitrary org under a staff session.

  • Adopted: the agent may create a local devserver account, since it only touches the local database.

  • Rejected: a runtime pointer from pr-screenshots, since skills must not require each other by name. This skill's description triggers on the same certificate and login errors.

Validation Log

  • 2026-10-22: Steps 3 and 4 run against a live dev-ui. list_pages listed the user's tabs; /api/client-config/ returned isAuthenticated: true over a secure context, on both the org subdomain and the bare host.

  • 2026-10-22: With a trusted certificate, the service-worker SSL console message did not appear, so it is treated as a sign of an untrusted certificate.

  • 2026-10-22: A fresh headless Chrome profile loaded dev-ui without certificate errors, confirming the mkcert CA is trusted machine-wide.

  • 2026-10-22: /usr/bin/curl returned 200 against the trusted dev-ui.

  • 2026-10-22: curl's message for dev-ui's fallback certificate differed between tests: "unable to get local issuer certificate" for a cert generated by @rsbuild/plugin-basic-ssl, "self signed certificate" for a hand-made CN=localhost cert. An untrusted mkcert CA gives the former too.

  • 2026-10-22: openssl verify against $(mkcert -CAROOT)/rootCA.pem returned OK for the live dev-ui's certificate and failed for a self-signed CN=localhost certificate and for one from a scratch mkcert CA with the same issuer string. Expiry reads certificate has expired on both OpenSSL 4 and macOS LibreSSL. An unreachable port prints different errors on each.

  • 2026-10-22: @anthropic-ai/sandbox-runtime 0.0.81's default config blocks the curl probe to loopback with "CONNECT tunnel failed, response 403". With loopback allowed, sandboxed /usr/bin/curl rejects the trusted certificate because the sandbox denies com.apple.trustd.agent, while openssl still connects and verifies OK. mkcert then reports the CA as already installed, which the OK row uses to detect the sandbox.

Gaps

  • Full devserver sign-in path not run end to end.

  • Wrong-channel and macOS Files & Folders fixes taken from upstream docs, not reproduced.

Changelog

  • 2026-10-22: Created.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Needs network access, Needs Node.js

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Sentry
Publisher
Sentry (Official)
Source
getsentry/skills · skills/browse-local-sentry · commit e94f222
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by Sentry or Sentry.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download browse-local-sentry.zip