Support org role permissions on tool calls

[cobyeastwood183]

Environment

Cursor MCP

Steps to Reproduce

• Install from https://mcp.sentry.dev/?ide=cursor
• Be an sentry org owner
• In org settings toggle 'members create projects'
• Run create_project tool

Expected Result

Should create a project in the org.

Actual Result

Gives a 403 error.

[cobyeastwood183]

might need to update scopes (so they're based on org roles), or user context along with api calls?

[dcramer]

Digging deeper, this looks like a permissions/scope mismatch between MCP OAuth scopes and the Sentry endpoint used by create_project.

What create_project currently does:

• MCP calls POST /api/0/teams/{org}/{team}/projects/.

What that endpoint checks server-side:

• Requires project-level write scope for POST.
• If disable_member_project_creation is true, it additionally requires org:write OR team:admin.
• If neither is present, it returns 403.

Why this can fail in MCP even for org owners:

• MCP currently requests a fixed upstream OAuth scope set and does not include org:write.
• We are explicitly not willing to grant team:admin to MCP because that scope expands into destructive capabilities (including deletion paths), which is too broad for this use case.

Important security/product stance:

• team:admin is not an acceptable workaround for create_project.
• The safer direction is to satisfy create-project requirements via narrower org-level scope handling (for example org:write where needed), not team-admin elevation.

Suggested direction:

1. Update scope negotiation for project-management flows so required upstream Sentry scopes are requested from selected skills/tool requirements (instead of fixed static scopes).
2. Ensure create-project path works with org role permissions without requiring team-admin elevation.
3. Improve 403 error text to indicate missing org-level permission vs team-admin requirement branch.

If helpful, I can open a follow-up PR that wires this in and adds a regression test for this exact scenario.

[rodolfoBee]

Are there any updates on this issue?

[dcramer]

@rodolfoBee its likely not going to be resolved in the near term