feat(mcp): route hosted AI through OpenRouter with gpt-5.6-luna@high (#1213)

## Summary
Route hosted MCP AI through OpenRouter and default to
`openai/gpt-5.6-luna` with `reasoningEffort=high`.

### Key Changes
- Chat playground: hardcoded OpenAI `gpt-4o` → shared OpenRouter
provider
- Default OpenRouter model: `openai/gpt-5` → `openai/gpt-5.6-luna`
- Default OpenRouter reasoning effort: `high` (override with
`OPENROUTER_REASONING_EFFORT`)
- Chat `maxOutputTokens`: `2000` → `16000` so reasoning does not starve
text/tool output
- Worker/env docs/tests accept `OPENROUTER_*` +
`EMBEDDED_AGENT_PROVIDER`

## Why
Prod is moving off a direct OpenAI key onto OpenRouter. Luna@high keeps
the cheap GPT-5.6 tier while favoring query-translation quality over the
lower latency of medium effort. We can bump effort or model via env if
quality dips.

## Deploy notes
After merge, hosted worker should have:
- `OPENROUTER_API_KEY`
- `EMBEDDED_AGENT_PROVIDER=openrouter`
- optional `OPENROUTER_MODEL=openai/gpt-5.6-luna` (also the code
default)
- optional `OPENROUTER_REASONING_EFFORT=high` (also the code default;
lower it without redeploy if latency is too high)
- `OPENAI_API_KEY` can be removed once this is live

## How we'll measure
- Sentry error rate on embedded agents / chat (`callEmbeddedAgent`, LLM
provider failures, `NoObjectGeneratedError` rescues)
- Tool failure rate for `search_events` / `search_issues` /
`search_issue_events` (7d baseline ~11–12% on agent trio)
- Existing alert `444138` (global tool failure rate, critical 18%)
- Latency + OpenRouter spend vs prior OpenAI baseline

## Risks / follow-ups
- Luna may underperform on harder NL→query cases vs gpt-5 / sol / terra;
easy model override if needed
- Chat now requires `OPENROUTER_API_KEY`
- If both OpenAI and OpenRouter keys remain set without
`EMBEDDED_AGENT_PROVIDER`, provider selection still errors by design
- Did not run live OpenRouter evals in this PR

## Checks run
- `pnpm exec vitest run
packages/mcp-core/src/internal/agents/openrouter-provider.test.ts`
- `pnpm run tsc`
- `pnpm run lint`
- `pnpm run test`

<!-- junior-request-attribution:start -->
Requested by **David Cramer** via Junior.
<!-- junior-request-attribution:end -->

<!-- junior-session-footer:start -->
<!-- junior-conversation-id:slack%3AC08J1NSPU6S%3A1785362296.874629 -->

--

[View Junior
Session](https://junior-prod.sentry.dev/conversations/slack%3AC08J1NSPU6S%3A1785362296.874629)

<!-- junior-session-footer:end -->

---------

Co-authored-by: sentry-junior[bot] <264270552+sentry-junior[bot]@users.noreply.github.com>
Co-authored-by: David Cramer <david@sentry.io>

Author: sentry-junior[bot]

README.md

@@ -107,7 +107,8 @@ EMBEDDED_AGENT_PROVIDER=     # Required when multiple provider keys are set: 'op
 OPENAI_API_KEY=              # Required if using OpenAI
 ANTHROPIC_API_KEY=           # Required if using Anthropic
 OPENROUTER_API_KEY=          # Required if using OpenRouter
-OPENROUTER_MODEL=            # Optional OpenRouter model, defaults to 'openai/gpt-5'
+OPENROUTER_MODEL=            # Optional OpenRouter model, defaults to 'openai/gpt-5.6-luna'
+OPENROUTER_REASONING_EFFORT= # Optional OpenRouter reasoning effort, defaults to 'high'
 
 # Optional overrides
 SENTRY_HOST=                 # For self-hosted deployments

docs/operations/embedded-agents.md

@@ -72,8 +72,9 @@ For OpenRouter:
 
 ```bash
 export OPENROUTER_API_KEY=sk-or-...
-# Optional; defaults to openai/gpt-5
-export OPENROUTER_MODEL=openai/gpt-5
+# Optional; defaults to openai/gpt-5.6-luna with reasoning effort high
+export OPENROUTER_MODEL=openai/gpt-5.6-luna
+export OPENROUTER_REASONING_EFFORT=high
 # Recommended, and required when multiple provider keys are set
 export EMBEDDED_AGENT_PROVIDER=openrouter
 ```
@@ -219,8 +220,9 @@ export OPENAI_MODEL=gpt-4
 # Anthropic (default: claude-opus-4-5-20251101)
 export ANTHROPIC_MODEL=claude-sonnet-4-5-20250929
 
-# OpenRouter (default: openai/gpt-5)
+# OpenRouter (default: openai/gpt-5.6-luna @ high)
 export OPENROUTER_MODEL=anthropic/claude-sonnet-4
+export OPENROUTER_REASONING_EFFORT=high
 ```
 
 ### Verify Configuration

packages/mcp-cloudflare/package.json

@@ -46,7 +46,6 @@
   },
   "dependencies": {
     "@ai-sdk/mcp": "catalog:",
-    "@ai-sdk/openai": "catalog:",
     "@ai-sdk/react": "catalog:",
     "@cloudflare/workers-oauth-provider": "catalog:",
     "@modelcontextprotocol/sdk": "catalog:",

packages/mcp-cloudflare/src/server/lib/mcp-handler.test.ts

@@ -104,7 +104,9 @@ function createTestEnv(): Env {
     SENTRY_CLIENT_ID: "test-client-id",
     SENTRY_CLIENT_SECRET: "test-client-secret",
     SENTRY_HOST: "sentry.io",
-    OPENAI_API_KEY: "test-openai-key",
+    OPENROUTER_API_KEY: "test-openrouter-key",
+    OPENROUTER_MODEL: "openai/gpt-5.6-luna",
+    EMBEDDED_AGENT_PROVIDER: "openrouter",
     OAUTH_KV: {} as KVNamespace,
     OAUTH_PROVIDER: {
       listUserGrants: vi.fn().mockResolvedValue({ items: [] }),

packages/mcp-cloudflare/src/server/routes/chat.env.test.ts

@@ -0,0 +1,99 @@
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { syncOpenRouterEnvFromBindings } from "./chat";
+
+describe("syncOpenRouterEnvFromBindings", () => {
+  const originalApiKey = process.env.OPENROUTER_API_KEY;
+  const originalModel = process.env.OPENROUTER_MODEL;
+  const originalEffort = process.env.OPENROUTER_REASONING_EFFORT;
+
+  beforeEach(() => {
+    delete process.env.OPENROUTER_API_KEY;
+    delete process.env.OPENROUTER_MODEL;
+    delete process.env.OPENROUTER_REASONING_EFFORT;
+  });
+
+  afterEach(() => {
+    if (originalApiKey === undefined) {
+      delete process.env.OPENROUTER_API_KEY;
+    } else {
+      process.env.OPENROUTER_API_KEY = originalApiKey;
+    }
+
+    if (originalModel === undefined) {
+      delete process.env.OPENROUTER_MODEL;
+    } else {
+      process.env.OPENROUTER_MODEL = originalModel;
+    }
+
+    if (originalEffort === undefined) {
+      delete process.env.OPENROUTER_REASONING_EFFORT;
+    } else {
+      process.env.OPENROUTER_REASONING_EFFORT = originalEffort;
+    }
+  });
+
+  it("returns false when neither binding nor process.env has a key", () => {
+    expect(syncOpenRouterEnvFromBindings({})).toBe(false);
+    expect(process.env.OPENROUTER_API_KEY).toBeUndefined();
+  });
+
+  it("copies worker bindings into process.env for provider helpers", () => {
+    expect(
+      syncOpenRouterEnvFromBindings({
+        OPENROUTER_API_KEY: "from-binding",
+        OPENROUTER_MODEL: "openai/gpt-5.6-luna",
+        OPENROUTER_REASONING_EFFORT: "high",
+      }),
+    ).toBe(true);
+
+    expect(process.env.OPENROUTER_API_KEY).toBe("from-binding");
+    expect(process.env.OPENROUTER_MODEL).toBe("openai/gpt-5.6-luna");
+    expect(process.env.OPENROUTER_REASONING_EFFORT).toBe("high");
+  });
+
+  it("falls back to process.env when the binding is missing", () => {
+    process.env.OPENROUTER_API_KEY = "from-process";
+
+    expect(syncOpenRouterEnvFromBindings({})).toBe(true);
+    expect(process.env.OPENROUTER_API_KEY).toBe("from-process");
+  });
+
+  it("prefers the worker binding over an existing process.env key", () => {
+    process.env.OPENROUTER_API_KEY = "from-process";
+
+    expect(
+      syncOpenRouterEnvFromBindings({
+        OPENROUTER_API_KEY: "from-binding",
+      }),
+    ).toBe(true);
+
+    expect(process.env.OPENROUTER_API_KEY).toBe("from-binding");
+  });
+
+  it("clears stale model and effort when bindings are removed", () => {
+    process.env.OPENROUTER_API_KEY = "from-process";
+    process.env.OPENROUTER_MODEL = "stale-model";
+    process.env.OPENROUTER_REASONING_EFFORT = "stale-effort";
+
+    expect(
+      syncOpenRouterEnvFromBindings({
+        OPENROUTER_API_KEY: "from-binding",
+      }),
+    ).toBe(true);
+
+    expect(process.env.OPENROUTER_API_KEY).toBe("from-binding");
+    expect(process.env.OPENROUTER_MODEL).toBeUndefined();
+    expect(process.env.OPENROUTER_REASONING_EFFORT).toBeUndefined();
+  });
+
+  it("preserves empty-string reasoning effort as omit-provider-option", () => {
+    expect(
+      syncOpenRouterEnvFromBindings({
+        OPENROUTER_API_KEY: "from-binding",
+        OPENROUTER_REASONING_EFFORT: "",
+      }),
+    ).toBe(true);
+
+    expect(process.env.OPENROUTER_REASONING_EFFORT).toBe("");
+  });
+});

packages/mcp-cloudflare/src/server/routes/chat.ts

@@ -1,6 +1,9 @@
 import { experimental_createMCPClient } from "@ai-sdk/mcp";
-import { openai } from "@ai-sdk/openai";
 import { StreamableHTTPClientTransport } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+import {
+  getOpenRouterModel,
+  getOpenRouterProviderOptions,
+} from "@sentry/mcp-core/internal/agents/openrouter-provider";
 import { logInfo, logIssue, logWarn } from "@sentry/mcp-core/telem/logging";
 import {
   convertToModelMessages,
@@ -22,6 +25,40 @@ import { analyzeAuthError, getAuthErrorResponse } from "../utils/auth-errors";
 
 type MCPClient = Awaited<ReturnType<typeof experimental_createMCPClient>>;
 
+/**
+ * Ensure OpenRouter provider helpers can read worker bindings via process.env.
+ * Returns false when no API key is available from either source.
+ */
+export function syncOpenRouterEnvFromBindings(
+  env: Pick<
+    Env,
+    "OPENROUTER_API_KEY" | "OPENROUTER_MODEL" | "OPENROUTER_REASONING_EFFORT"
+  >,
+): boolean {
+  const openRouterApiKey =
+    env.OPENROUTER_API_KEY || process.env.OPENROUTER_API_KEY;
+  if (!openRouterApiKey) {
+    return false;
+  }
+
+  process.env.OPENROUTER_API_KEY = openRouterApiKey;
+
+  // Always mirror or clear optional bindings so a reused worker isolate cannot
+  // keep a previous request's model/effort after the binding is removed.
+  if (env.OPENROUTER_MODEL) {
+    process.env.OPENROUTER_MODEL = env.OPENROUTER_MODEL;
+  } else {
+    delete process.env.OPENROUTER_MODEL;
+  }
+  if (env.OPENROUTER_REASONING_EFFORT !== undefined) {
+    process.env.OPENROUTER_REASONING_EFFORT = env.OPENROUTER_REASONING_EFFORT;
+  } else {
+    delete process.env.OPENROUTER_REASONING_EFFORT;
+  }
+
+  return true;
+}
+
 async function refreshTokenIfNeeded(
   c: Context<{ Bindings: Env }>,
 ): Promise<{ token: string; authData: AuthData } | null> {
@@ -93,9 +130,10 @@ async function refreshTokenIfNeeded(
 }
 
 export default new Hono<{ Bindings: Env }>().post("/", async (c) => {
-  // Validate that we have an OpenAI API key
-  if (!c.env.OPENAI_API_KEY) {
-    logIssue("OPENAI_API_KEY is not configured", {
+  // OpenRouter helpers in mcp-core only read process.env. Bridge worker
+  // bindings first so validation and provider calls stay in sync.
+  if (!syncOpenRouterEnvFromBindings(c.env)) {
+    logIssue("OPENROUTER_API_KEY is not configured", {
       loggerScope: ["cloudflare", "chat"],
     });
     return c.json(
@@ -307,7 +345,7 @@ export default new Hono<{ Bindings: Env }>().post("/", async (c) => {
     });
 
     const result = streamText({
-      model: openai("gpt-4o"),
+      model: getOpenRouterModel(),
       messages: modelMessages,
       tools,
       system: `You are an AI assistant designed EXCLUSIVELY for testing the Sentry MCP service. Your sole purpose is to help users test MCP functionality with their real Sentry account data - nothing more, nothing less.
@@ -332,8 +370,11 @@ Start conversations by exploring what's available in their account. Use tools li
 - \`get_sentry_resource\` to dive deep into a specific issue, event, or trace
 
 Remember: You're a test assistant, not a general-purpose helper. Stay focused on testing the MCP integration with their real data.`,
-      maxOutputTokens: 2000,
+      // Reasoning effort can consume completion budget before visible text/tool
+      // calls, so keep headroom above the old non-reasoning 2k cap.
+      maxOutputTokens: 16000,
       stopWhen: stepCountIs(10),
+      providerOptions: getOpenRouterProviderOptions(),
       experimental_telemetry: {
         isEnabled: true,
       },

packages/mcp-cloudflare/src/server/sentry.config.test.ts

@@ -13,7 +13,9 @@ function createEnv(overrides: Partial<Env> = {}): Env {
     SENTRY_CLIENT_SECRET: "test-client-secret",
     SENTRY_DSN: "https://public@example.ingest.sentry.io/1",
     SENTRY_HOST: "sentry.io",
-    OPENAI_API_KEY: "test-openai-key",
+    OPENROUTER_API_KEY: "test-openrouter-key",
+    OPENROUTER_MODEL: "openai/gpt-5.6-luna",
+    EMBEDDED_AGENT_PROVIDER: "openrouter",
     OAUTH_PROVIDER: {} as Env["OAUTH_PROVIDER"],
     AI: {} as Ai,
     ...overrides,

packages/mcp-cloudflare/src/server/types.ts

@@ -60,7 +60,12 @@ export interface Env {
   SENTRY_ENVIRONMENT?: string;
   SENTRY_DSN?: string;
   SENTRY_HOST?: string;
-  OPENAI_API_KEY: string;
+  /** @deprecated Prefer OPENROUTER_API_KEY for hosted MCP AI features. */
+  OPENAI_API_KEY?: string;
+  OPENROUTER_API_KEY?: string;
+  OPENROUTER_MODEL?: string;
+  OPENROUTER_REASONING_EFFORT?: string;
+  EMBEDDED_AGENT_PROVIDER?: string;
   MCP_URL?: string;
   OAUTH_PROVIDER: OAuthHelpers;
   AI: Ai;

packages/mcp-cloudflare/worker-configuration.d.ts

@@ -10,7 +10,11 @@ declare namespace Cloudflare {
 		SENTRY_CLIENT_ID: string;
 		SENTRY_CLIENT_SECRET: string;
 		SENTRY_DSN: string;
-		OPENAI_API_KEY: string;
+		OPENAI_API_KEY?: string;
+		OPENROUTER_API_KEY?: string;
+		OPENROUTER_MODEL?: string;
+		OPENROUTER_REASONING_EFFORT?: string;
+		EMBEDDED_AGENT_PROVIDER?: string;
 		COOKIE_SECRET: string;
 		CHAT_RATE_LIMITER: RateLimit;
 		SEARCH_RATE_LIMITER: RateLimit;
@@ -24,7 +28,7 @@ type StringifyValues<EnvType extends Record<string, unknown>> = {
 	[Binding in keyof EnvType]: EnvType[Binding] extends string ? EnvType[Binding] : string;
 };
 declare namespace NodeJS {
-	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "SENTRY_CLIENT_ID" | "SENTRY_CLIENT_SECRET" | "SENTRY_DSN" | "OPENAI_API_KEY" | "COOKIE_SECRET">> {}
+	interface ProcessEnv extends StringifyValues<Pick<Cloudflare.Env, "SENTRY_CLIENT_ID" | "SENTRY_CLIENT_SECRET" | "SENTRY_DSN" | "OPENAI_API_KEY" | "OPENROUTER_API_KEY" | "OPENROUTER_MODEL" | "OPENROUTER_REASONING_EFFORT" | "EMBEDDED_AGENT_PROVIDER" | "COOKIE_SECRET">> {}
 }
 
 // Begin runtime types

packages/mcp-cloudflare/wrangler.test.jsonc

@@ -14,7 +14,9 @@
     "SENTRY_CLIENT_ID": "test-client-id",
     "SENTRY_CLIENT_SECRET": "test-client-secret",
     "SENTRY_HOST": "sentry.io",
-    "OPENAI_API_KEY": "test-openai-key"
+    "OPENROUTER_API_KEY": "test-openrouter-key",
+    "OPENROUTER_MODEL": "openai/gpt-5.6-luna",
+    "EMBEDDED_AGENT_PROVIDER": "openrouter"
   },
   "kv_namespaces": [
     {