fix(sentry): Harden observability and privacy telemetry

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,7 +1,7 @@
 name: Bug Report
 description: Report a bug or issue with XcodeBuildMCP
-title: "[Bug]: "
-labels: ["bug"]
+title: '[Bug]: '
+labels: ['bug']
 body:
   - type: markdown
     attributes:

.github/ISSUE_TEMPLATE/config.yml

@@ -1 +1 @@
-blank_issues_enabled: false
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,13 +1,13 @@
 name: Feature Request
 description: Suggest a new feature for XcodeBuildMCP
-title: "[Feature]: "
-labels: ["enhancement"]
+title: '[Feature]: '
+labels: ['enhancement']
 body:
   - type: markdown
     attributes:
       value: |
         Thanks for suggesting a new feature for XcodeBuildMCP!
-        
+
   - type: textarea
     id: feature-description
     attributes:
@@ -16,7 +16,7 @@ body:
       placeholder: I would like the AI assistant to be able to...
     validations:
       required: true
-      
+
   - type: textarea
     id: use-cases
     attributes:
@@ -28,7 +28,7 @@ body:
         - Automating complex Xcode workflows
     validations:
       required: false
-      
+
   - type: textarea
     id: example-interactions
     attributes:

.github/workflows/ci.yml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
 
 jobs:
   build-and-test:
@@ -15,36 +15,36 @@ jobs:
         node-version: [24.x]
 
     steps:
-    - uses: actions/checkout@v3
+      - uses: actions/checkout@v3
 
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
 
-    - name: Install dependencies
-      run: npm ci
+      - name: Install dependencies
+        run: npm ci
 
-    - name: Bundle AXe artifacts
-      run: npm run bundle:axe
+      - name: Bundle AXe artifacts
+        run: npm run bundle:axe
 
-    - name: Build
-      run: npm run build
+      - name: Build
+        run: npm run build
 
-    - name: Validate docs CLI command references
-      run: npm run docs:check
+      - name: Validate docs CLI command references
+        run: npm run docs:check
 
-    - name: Lint
-      run: npm run lint
+      - name: Lint
+        run: npm run lint
 
-    - name: Check formatting
-      run: npm run format:check
+      - name: Check formatting
+        run: npm run format:check
 
-    - name: Type check
-      run: npm run typecheck
+      - name: Type check
+        run: npm run typecheck
 
-    - name: Run tests
-      run: npm test
+      - name: Run tests
+        run: npm test
 
-    - run: npx pkg-pr-new publish
+      - run: npx pkg-pr-new publish

.github/workflows/sentry.yml

@@ -32,5 +32,5 @@ jobs:
           SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
         with:
           environment: production
-          sourcemaps: "./build"
-          version: ${{ steps.get_version.outputs.MCP_VERSION }}
+          sourcemaps: './build'
+          version: ${{ steps.get_version.outputs.MCP_VERSION }}

.github/workflows/stale.yml

@@ -1,8 +1,8 @@
-name: "Stale Issues and PRs"
+name: 'Stale Issues and PRs'
 
 on:
   schedule:
-    - cron: "30 3 * * *"
+    - cron: '30 3 * * *'
   workflow_dispatch: {}
 
 permissions:
@@ -21,12 +21,12 @@ jobs:
           days-before-issue-close: 7
           days-before-pr-stale: 21
           days-before-pr-close: 7
-          stale-issue-label: "stale"
-          stale-pr-label: "stale-pr"
+          stale-issue-label: 'stale'
+          stale-pr-label: 'stale-pr'
           exempt-issue-assignees: true
           exempt-pr-assignees: true
-          exempt-issue-labels: "no-stale,security,pinned"
-          exempt-pr-labels: "no-stale,security,pinned"
+          exempt-issue-labels: 'no-stale,security,pinned'
+          exempt-pr-labels: 'no-stale,security,pinned'
           stale-issue-message: >
             This issue has been inactive for 30 days. It will be closed in 7 days
             if no further activity occurs. Add a comment to keep it open, or apply

CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## [Unreleased]
+
+### Fixed
+
+- Fixed Sentry telemetry scope to capture only internal XcodeBuildMCP runtime failures, removing broad MCP wrapping, PII-heavy tags, and default per-error log capture ([#204](https://github.com/getsentry/XcodeBuildMCP/issues/204))
+
 ## [2.0.7]
 
 ### Changed
@@ -273,4 +279,3 @@ Please note that the UI automation features are an early preview and currently i
 - Initial release of XcodeBuildMCP
 - Basic support for building iOS and macOS applications
 
-

README.md

@@ -285,7 +285,7 @@ For further information on how to install the skill, see: [docs/SKILLS.md](docs/
 
 ## Privacy
 
-XcodeBuildMCP uses Sentry for error telemetry. For more information or to opt out of error telemetry see [docs/PRIVACY.md](docs/PRIVACY.md).
+XcodeBuildMCP uses Sentry for internal runtime error telemetry only. For details and opt-out instructions, see [docs/PRIVACY.md](docs/PRIVACY.md).
 
 ## CLI
 

XcodeBuildMCP.code-workspace

@@ -1,13 +1,13 @@
 {
-	"folders": [
-		{
-			"path": "."
-		},
-		{
-			"path": "../XcodeBuildMCP-iOS-Template"
-		},
-		{
-			"path": "../XcodeBuildMCP-macOS-Template"
-		}
-	]
-}
+  "folders": [
+    {
+      "path": ".",
+    },
+    {
+      "path": "../XcodeBuildMCP-iOS-Template",
+    },
+    {
+      "path": "../XcodeBuildMCP-macOS-Template",
+    },
+  ],
+}

config.example.yaml

@@ -1,20 +1,20 @@
 schemaVersion: 1
-enabledWorkflows: ["simulator", "ui-automation", "debugging"]
+enabledWorkflows: ['simulator', 'ui-automation', 'debugging']
 experimentalWorkflowDiscovery: false
 disableSessionDefaults: false
 incrementalBuildsEnabled: false
 sessionDefaults:
-  projectPath: "./MyApp.xcodeproj"      # xor workspacePath
-  workspacePath: "./MyApp.xcworkspace"  # xor projectPath
-  scheme: "MyApp"
-  configuration: "Debug"
-  simulatorName: "iPhone 16"            # xor simulatorId
-  simulatorId: "<UUID>"                 # xor simulatorName
-  deviceId: "<UUID>"
+  projectPath: './MyApp.xcodeproj' # xor workspacePath
+  workspacePath: './MyApp.xcworkspace' # xor projectPath
+  scheme: 'MyApp'
+  configuration: 'Debug'
+  simulatorName: 'iPhone 16' # xor simulatorId
+  simulatorId: '<UUID>' # xor simulatorName
+  deviceId: '<UUID>'
   useLatestOS: true
-  arch: "arm64"
+  arch: 'arm64'
   suppressWarnings: false
-  derivedDataPath: "./.derivedData"
+  derivedDataPath: './.derivedData'
   preferXcodebuild: false
-  platform: "iOS"
-  bundleId: "io.sentry.myapp"
+  platform: 'iOS'
+  bundleId: 'io.sentry.myapp'

docs/CONFIGURATION.md

@@ -259,7 +259,7 @@ Default templates:
 
 ## Telemetry
 
-By default, error logs are sent to Sentry. To disable:
+By default, only internal XcodeBuildMCP runtime failures are sent to Sentry. User-domain errors (such as project build/test/config failures) are not sent. To disable telemetry entirely:
 
 ```yaml
 # Environment variable only (no config.yaml option)
@@ -268,6 +268,11 @@ By default, error logs are sent to Sentry. To disable:
 
 See [PRIVACY.md](PRIVACY.md) for more information.
 
+Notes:
+- Sentry SDK logging is enabled for internal observability.
+- Only explicitly opted-in internal logs are forwarded to Sentry; standard console logs are not auto-forwarded.
+- Tool arguments and tool outputs are not captured by MCP wrapper telemetry (`recordInputs: false`, `recordOutputs: false`).
+
 ---
 
 ## Quick reference

docs/PRIVACY.md

@@ -3,8 +3,11 @@
 XcodeBuildMCP uses Sentry for error monitoring and diagnostics. This helps track crashes and unexpected errors to improve reliability.
 
 ## What is sent to Sentry
-- Error-level logs and diagnostic information only.
-- Error logs may include error messages, stack traces, and in some cases file paths or project names.
+- Internal XcodeBuildMCP failures only (for example: daemon/MCP runtime faults and unexpected exceptions in server code).
+- User-domain errors are not sent (for example: project build/test failures, invalid user config, missing scheme/destination, simulator/app-state errors).
+- Tool inputs/outputs are not captured by default, and environment/system variables are not attached as telemetry tags.
+- Internal operational logs are sent only when explicitly marked for Sentry (`{ sentry: true }` in server code). Console logging is not automatically forwarded.
+- Event payloads are scrubbed before send to remove request/user context and redact user home paths (for example `/Users/<redacted>/...`).
 
 ## Opting out
 To disable error telemetry, set: