# Sentry Init

> Paste the Sentry initialisation your project already ships and work it in one sitting: audit the
> configuration option by option, harden what it sends about your users, size its sample rates to
> the quota you pay for, and name the monitoring signals it still cannot see.

URL: https://sentry-init.skillsafe.ai/
API: https://sentry-init.skillsafe.ai/api.html
Tokens: https://sentry-init.skillsafe.ai/tokens.html
Model: gpt-terra (resolves to gpt-5.6-terra) · metered, priced per run, free to estimate

## What it takes as input

One work object: the `init` call a project already ships. It may be several blocks across several
files and several platforms in one paste, separated by `// file: path` marker lines. Files can also
be dropped onto the page; they are read with FileReader in the browser and never uploaded.

The page parses eight SDK surface syntaxes across three underlying grammars:

- braces — `Sentry.init({ ... })` (JavaScript, TypeScript), `sentry.Init(sentry.ClientOptions{ ... })`
  (Go), `\Sentry\init([ 'dsn' => ... ])` (PHP)
- keyword arguments — `sentry_sdk.init(dsn=..., traces_sample_rate=...)` (Python)
- property setters — `Sentry.init do |config| config.dsn = ... end` (Ruby),
  `SentrySdk.Init(o => { o.Dsn = ...; })` (.NET), `Sentry.init(options -> { ... })` (Java, Android)

Option names are normalised across platforms, so `traces_sample_rate`, `TracesSampleRate` and
`tracesSampleRate` are one row in the report.

## What runs for free, in your browser, before anything is sent

- every init block found, with its file, platform and syntax
- every option read, classified as a string, number, boolean, list, object, function or a runtime
  expression the parser deliberately refuses to guess at
- the DSN parsed into scheme, public key, legacy secret half, host, region, organisation and
  project id — and a critical finding when the legacy secret half is still present
- about thirty lint rules across identity, sampling, privacy, transport, noise and session tracking
- credential masking: DSN keys, legacy DSN secrets, `sntrys_`/`sntryu_` tokens, bearer tokens, JWTs
  and email addresses are replaced with placeholders. The scan itself runs on the masked text, so
  no field of the run input can carry a secret — there is no second path for one to travel down.
- quota arithmetic: the monthly errors, spans, replays and profiles the configured rates produce at
  the traffic you type, against the plan allowance you type, plus the rate that would exactly fit

## The four lanes

Every lane takes the same work object and the same prescan facts, and routes on a `task` field.

| task | what it produces |
| --- | --- |
| `audit` | option-by-option verdict per init block, findings, and the corrected init call |
| `privacy` | the data categories that can reach Sentry, and a complete `beforeSend` scrubber |
| `budget` | a sampling plan sized to the quota, with a `tracesSampler` where a flat rate is wrong |
| `signals` | signal-by-signal coverage, the alert rules worth creating, and OTel exporter wiring |

Lane A's result carries a button that pre-fills lane B, so the sitting runs
audit → privacy → budget → signals without re-pasting.

## The output contract

One JSON object per run, the same envelope in every lane:

`lane`, `title`, `verdict`, `headline`, `summary`, `checks[]`, `findings[]`, `rates[]`, `artifact`
(Markdown), `artifact_json` (one of `config_audit`, `privacy_plan`, `sampling_plan`, `signal_plan`),
`coverage_check[]`, `questions[]`, `confidence`.

`coverage_check` is the accountability mechanism: every prescan flag carries a unique `flag_id` and
the model must confirm, clear or set aside each one exactly once. The page shows any flag that went
unanswered and any id that was invented.

Verdicts by lane: audit — `production-ready`, `minor-gaps`, `incomplete`, `misconfigured`;
privacy — `contained`, `needs-scrubbing`, `exposed`; budget — `within-quota`, `tight`,
`over-quota`; signals — `covered`, `partial`, `blind`.

## What it does not do

It has not connected to Sentry, has not read your project settings and has not seen an event. It
reads the text you paste. Anything that needs the Sentry UI to confirm is said to need it.

## Sources

Derived from five open-source Agent Skills in the `getsentry/sentry-for-ai` repository:

- `@getsentry/sentry-sdk-setup` and `@getsentry/sentry-node-sdk` — the audit lane
- `@getsentry/sentry-browser-sdk` — the privacy lane
- `@getsentry/sentry-nextjs-sdk` — the budget lane
- `@getsentry/sentry-feature-setup` and `@getsentry/sentry-otel-exporter-setup` — the signals lane

This app is a derived work. It is not affiliated with Sentry or with the authors of those skills.