feat(middleware): Add AI agent friendly responses for unauthenticated requests by dcramer · Pull Request #106485 · getsentry/sentry

dcramer · 2026-01-16T23:42:04Z

Add middleware that returns helpful markdown guidance when AI agents (Claude Code, Cursor, Copilot, etc.) make unauthenticated requests to frontend UI routes.

When an anonymous request with Accept: text/markdown or text/x-markdown hits a non-API route, the middleware returns a friendly response explaining how to properly access Sentry:

MCP Server - Pre-configured URL with org/project context extracted from the request path
REST API - Authentication instructions and documentation links

Example response for /organizations/my-org/projects/my-project/:

# Hey, you've hit the Sentry web UI

This URL serves HTML for humans in browsers. You probably want one of these instead:

## MCP Server (recommended for AI agents)

Add to your MCP client config:

{
  "mcpServers": {
    "sentry": {
      "url": "https://mcp.sentry.dev/mcp/my-org/my-project",
    }
  }
}

More info: https://mcp.sentry.dev

## REST API (for scripts and integrations)

curl https://sentry.io/api/0/projects/ \
  -H "Authorization: Bearer <token>"

Docs: https://docs.sentry.io/api/

Fixes #106334

evanpurkhiser · 2026-01-16T23:55:47Z

src/sentry/middleware/ai_agent.py

+{mcp_config_json}
+```
+
+Get a token: https://sentry.io/settings/account/api/auth-tokens/


should it say like "Your user can get a token from" so the agent doesn't try and hit this URL to get a token like a dum dum

tbqh this is wrong, stupid bot

evanpurkhiser · 2026-01-16T23:59:21Z

src/sentry/middleware/ai_agent.py

+    return "text/markdown" in accept or "text/x-markdown" in accept
+
+
+def _is_anonymous_request(request: HttpRequest) -> bool:


@cursoragent can u check if there's a better way to do this in the codebase, i thought there was

does this work can I just tag it

Based on my search of the codebase, there's a cleaner pattern used throughout Sentry. The current implementation can be simplified to match the established pattern.

Here's what I found:

Current implementation:

def _is_anonymous_request(request: HttpRequest) -> bool: """Check if the request is anonymous (no authenticated user, no auth token).""" if getattr(request, "auth", None) is not None: return False user = getattr(request, "user", None) return user is None or user.is_anonymous

Better pattern (used throughout the codebase):

The codebase consistently uses request.user.is_authenticated rather than checking for None or is_anonymous. I found this exact pattern in src/sentry/auth/access.py:942:

if request.auth is not None and not request.user.is_authenticated: return from_rpc_auth(request.auth, rpc_user_org_context)

Recommended change:

def _is_anonymous_request(request: HttpRequest) -> bool: """Check if the request is anonymous (no authenticated user, no auth token).""" return request.auth is None and not request.user.is_authenticated

This is:

✅ More concise

✅ Matches the established pattern used in 166+ places in the codebase

✅ Doesn't need getattr() since Django middleware guarantees request.user and request.auth are set by the AuthenticationMiddleware (which runs before this middleware)

yeah tho it will likely fuck it up all because it lacks useful context ("do what")

… requests Add middleware that detects AI agents accessing frontend UI routes (via Accept: text/markdown header) and returns helpful guidance instead of HTML. The response includes: - MCP server configuration with context-aware URLs - REST API documentation links - Token generation instructions The middleware extracts org/project context from the URL path to provide pre-configured MCP server URLs. Fixes GH-106334 Co-Authored-By: Claude <noreply@anthropic.com>

src/sentry/middleware/ai_agent.py

Revised messaging to be more concise and align with Sentry's tone guidelines—front-loading information while keeping personality subtle.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

tests/sentry/middleware/test_ai_agent.py

BYK

Only major concern is the auth endpoints bypass.

BYK · 2026-01-20T21:32:52Z

src/sentry/middleware/ai_agent.py

+# Patterns to extract org and project from URL paths
+ORG_PATTERN = re.compile(r"^/organizations/([^/]+)/")
+PROJECT_PATTERN = re.compile(r"^/organizations/([^/]+)/projects/([^/]+)/")


Would be ideal if these patterns were shared with the main route patterns

too overkill

src/sentry/middleware/ai_agent.py

BYK · 2026-01-20T21:37:11Z

tests/sentry/middleware/test_ai_agent.py

+        request = self.factory.get("/", HTTP_ACCEPT="text/plain")
+        assert _accepts_markdown(request) is False
+
+    def test_case_insensitive(self):


Would also add text/html test, just in case

tests/sentry/middleware/test_ai_agent.py

BYK · 2026-01-20T21:41:07Z

src/sentry/middleware/ai_agent.py

+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        # Skip API routes - only intercept frontend UI routes
+        if request.path.startswith("/api/"):


Shall we also explicitly exclude our auth endpoints? Or maybe we can add a property on the views themselves in the future: has_markdown and only allow those?

you mean the oauth stuff? i think its fine as no one should be sending a user agent that would hit this that would also hit those

the only reason we do /api/ is because it actually is machines sending those requests

Some of the new ones from #105675 might be worth it:

/oauth/device_authorization

/oauth/token

/oauth/device

The middleware guidance text was updated in commit e5fc6cc to use the new brand voice ("# This Is the Web UI") but the test assertion wasn't updated to match.

src/sentry/middleware/ai_agent.py

Exclude /oauth/ paths from the AI agent markdown response middleware since these are legitimate machine-to-machine endpoints that should work normally (device authorization, token exchange, etc.). Fixes feedback from #106485

- Exclude `/oauth/` paths from the AI agent markdown response middleware - These are legitimate machine-to-machine endpoints (device authorization, token exchange) that should work normally Addresses feedback from #106485 (comment)

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Jan 16, 2026

vercel bot deployed to Preview January 16, 2026 23:43 View deployment

dcramer force-pushed the feat/ai-agent-middleware branch 3 times, most recently from 5b57001 to 206226b Compare January 16, 2026 23:53

evanpurkhiser reviewed Jan 16, 2026

View reviewed changes

vercel bot deployed to Preview January 16, 2026 23:56 View deployment

dcramer force-pushed the feat/ai-agent-middleware branch from 206226b to 41eed3a Compare January 16, 2026 23:58

evanpurkhiser reviewed Jan 16, 2026

View reviewed changes

evanpurkhiser approved these changes Jan 17, 2026

View reviewed changes

vercel bot deployed to Preview January 17, 2026 00:01 View deployment

dcramer force-pushed the feat/ai-agent-middleware branch 2 times, most recently from 4050b41 to 0e39b12 Compare January 17, 2026 00:03

vercel bot deployed to Preview January 17, 2026 00:06 View deployment

dcramer force-pushed the feat/ai-agent-middleware branch from 0e39b12 to 659cc37 Compare January 17, 2026 02:08

sentry bot reviewed Jan 17, 2026

View reviewed changes

src/sentry/middleware/ai_agent.py Show resolved Hide resolved

vercel bot deployed to Preview January 17, 2026 02:11 View deployment

fix(middleware): Update AI agent guidance copy to match brand voice

e5fc6cc

Revised messaging to be more concise and align with Sentry's tone guidelines—front-loading information while keeping personality subtle.

vercel bot deployed to Preview January 20, 2026 18:14 View deployment

cursor bot reviewed Jan 20, 2026

View reviewed changes

tests/sentry/middleware/test_ai_agent.py Outdated Show resolved Hide resolved

BYK approved these changes Jan 20, 2026

View reviewed changes

fix(test): Update AI agent middleware test to match new brand voice copy

ef28749

The middleware guidance text was updated in commit e5fc6cc to use the new brand voice ("# This Is the Web UI") but the test assertion wasn't updated to match.

vercel bot deployed to Preview January 20, 2026 23:20 View deployment

test(middleware): Add mixed case test for Accept header parsing

77df4d2

vercel bot deployed to Preview January 21, 2026 17:46 View deployment

sentry bot reviewed Jan 21, 2026

View reviewed changes

src/sentry/middleware/ai_agent.py Outdated Show resolved Hide resolved

refactor(middleware): Consolidate URL path regex patterns into one

35278ad

vercel bot deployed to Preview January 21, 2026 19:11 View deployment

dcramer merged commit c662d6a into master Jan 21, 2026
66 checks passed

dcramer deleted the feat/ai-agent-middleware branch January 21, 2026 19:35

dcramer mentioned this pull request Jan 21, 2026

fix(middleware): Skip OAuth endpoints in AI agent middleware #106711

Merged

2 tasks

github-actions bot locked and limited conversation to collaborators Feb 6, 2026

		return "text/markdown" in accept or "text/x-markdown" in accept


		def _is_anonymous_request(request: HttpRequest) -> bool:

Uh oh!

Conversation

dcramer commented Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

cursor bot Jan 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

BYK left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dcramer commented Jan 16, 2026 •

edited

Loading

cursor bot Jan 16, 2026 •

edited

Loading