fix(sentry-api): prevent POST to GET conversion on 302 redirects

[sentry]

This PR addresses the ZodError: Failed to validate object occurring in SentryApiService.createClientKey.

Problem:
When SentryApiService.createClientKey makes a POST request to the Sentry API (/api/0/projects/.../keys/), if the Sentry instance is configured with region silos, the initial request can return a 302 Found redirect. The fetch API, with its default redirect: 'follow' behavior, automatically follows this redirect but incorrectly converts the POST request into a GET request. A GET request to the keys endpoint returns a list of all client keys (an array), not a single created key object. Consequently, ClientKeySchema.parse(body) fails because it expects a single object and receives an array.

Solution:
To resolve this, the request() method in packages/mcp-core/src/api-client/client.ts has been modified:

1. redirect: 'manual' is now explicitly set in the fetch options. This prevents fetch from automatically following redirects and converting methods.
2. After the initial fetch call, the code now manually checks for 3xx status codes (301, 302, 303, 307, 308) and the presence of a Location header.
3. If a redirect is detected, the original request (preserving the HTTP method and body) is re-issued to the URL specified in the Location header. This ensures that POST requests remain POST requests even after a redirect, allowing the client key to be created successfully and the response to be correctly parsed by ClientKeySchema.

Fixes MCP-SERVER-FYF

_{This PR was automatically generated by Sentry. You can adjust this setting at any time.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 1154428. Configure here.}

[cursor]

Relative redirect URLs break fetch

High Severity

Manual redirect handling passes the raw Location value into fetch. Relative or path-only locations (common for same-host redirects) are not resolved against the original request URL, so Node and Workers fetch reject them and previously successful redirects fail.

 

^{Reviewed by Cursor Bugbot for commit 1154428. Configure here.}