feat(search): Split search_events into dataset-specific tools

[sentry-junior]

Supersedes #1371. Instead of making dataset required on search_events, this splits search into one tool per dataset, so the agent picks the dataset by picking the tool and has fewer ways to get it wrong.

What changed

New direct tools, all backed by the same handler:

• search_errors: errors, Seer Errors

• search_logs: logs, Seer Logs

• search_traces: spans, Seer Traces

• search_metrics: metrics, Seer Metrics

• search_profiles: profiles, no Seer

• search_replays: replays, no Seer

• The handler moved from tools/catalog/search-events.ts to tools/support/search-events/search.ts (runSearchEvents). Each tool sets its own dataset and passes lockDataset: true. The embedded agent prompt says the dataset is fixed, and the handler ignores any dataset switch the agent suggests. This way search_logs can't return spans.

• Each tool has a shorter description that covers only its own dataset. The event tools have no dataset param, and environment filters go in query. search_replays has no fields and keeps its separate environment param.

• search_traces documents same-trace cross-event queries ("checkout requests that also have an error log"). Seer only applies cross-event filters with the Traces strategy.

• Compatibility: search_events is still in the catalog as a deprecated alias (execute_sentry_tool can still call it). It is off the direct surface and left out of skill definitions.

• Direct surface (surfaces.ts) grows from 9 to 14 tools. That's still under the target of 20 and the hard limit of 25.

• Updated next-step hints that pointed at search_events: trace details, profile formatter, Seer unsupported-issue message, search_issues formatters, get_sentry_resource.

• Updated the plugin agent prompts, evals (search-events.eval.ts now expects the specific tool), the Cloudflare stdio setup copy, and the docs (spec, testing, architecture, READMEs). Regenerated the tool/skill definitions.

Tradeoffs

• Token cost: the direct-surface definitions go from 5,786 to 8,906 tokens (+3,120), per pnpm run measure-tokens. The six search tools total 4,238 tokens, compared with 1,130 for search_events, because each one repeats the shared params. Possible follow-ups: keep search_profiles/search_replays catalog-only, or trim the shared param descriptions.
• Misrouting still happens, just earlier. Picking a tool by name is usually more reliable than picking from an enum, but "slow requests with an error log" can still go to search_logs instead of search_traces. The cross-event hint on search_traces is meant to catch that.
• Out of scope: the Seer gate still skips structured-looking queries and explicit fields/sort. That's a separate change.

Testing

• mcp-core: 1749 tests pass. That includes new tests for each tool, covering the locked dataset and the schema with no dataset param. search_traces also has a test that sends a natural-language query to Seer's Traces strategy.
• mcp-cloudflare: 430 tests pass.
• Typecheck passes for core, cloudflare, server, evals and test-client. packages/cli typecheck fails in my sandbox with a Node loader error (ERR_INVALID_RETURN_PROPERTY_VALUE). The same failure happens on clean main.
• Lint passes.
• Not yet run: CI evals, and a live check against an org that has Seer enabled.

via shaun.kaasten.

--

View Junior Session [Sentry]