Stop prompt injection
at the action layer

SENTINEL is a security proxy for MCP. It tracks where every tool result came from, and refuses the actions you guard when their data came from untrusted content. Even when the attack got past your content filter.

Get started What is SENTINEL? GitHub

pip install "sentinel-prox>=0.2.2"

sentinel serve

An AI agent reaches its tools only through SENTINEL. Looking up a record and fetching a page are allowed; emailing the record afterwards is refused, because its lineage includes the page.

1
get_customer_recordALLOW
Allowed. The records service is marked trusted, so nothing is tainted yet.
2
web_fetchALLOW
Allowed, but the page it returns is labelled RETRIEVED_CONTENT.
3
send_emailBLOCK
Refused before it runs: its lineage includes the page, whatever the page said.

No agent code changes Default-deny policy Fail-closed authentication No eval, anywhere Free and local

The problem

Filters judge the words. The damage is done by the actions.

An attacker hides an instruction in content your agent will read: a web page, a document, a ticket. Content filters scan the text, and no filter catches everything. When one misses, the instruction runs with the agent's full privileges.

SENTINEL judges each action by where its data came from. Rewording or obfuscating the injection does not change that.

Read the full story →

Outbox0 messages

send_email refused

rule: block-untrusted-origin
why: the action's lineage includes RETRIEVED_CONTENT
record: an immutable span, ready to replay or export

Nothing was sent. The agent got a tool error, and the attack is on record.

The bundled demo's data. The record is a labelled fake.

How it works

Four stages on every tool call

To your agent, SENTINEL is an ordinary MCP server. To your tools, it is the only client they ever see.

Trace

Label the origin of everything the agent sees: SYSTEM, USER, AGENT or RETRIEVED_CONTENT.

Authorize

Your policy decides each call from that lineage. Deny-only rules, deny-overrides, unknown tools denied.

Contain

A trust score drops on denied calls and other signals, and can quarantine the agent.

Record

Each decision becomes an immutable span. Replay a run, or export it as JSONL for a SIEM.

Observability

Every decision, logged where you're looking

Blocks at WARNING, allowed calls at INFO, each with the trace id that ties it to the full forensic record.

Tool arguments are never written to logs
--log-format json for your aggregator
Replay any run, or export it as JSONL for a SIEM

Logs and forensics →

terminal

Built for security teams

Enforcement you can reason about

Small, explicit rules over a precise model of where data came from.

Judged by origin, not wording

Every message and tool result carries a trust label. An action's provenance is the set of labels over its whole ancestry, never just the latest step.

Deny-only policy, no eval

YAML compiled to a typed condition tree. Unknown tools are denied until you write a rule.

send_email:
  rules:
    - id: block-untrusted-origin
      deny_if: "RETRIEVED_CONTENT in
        effective_provenance"

Catalogue integrity

Attacks that arrive in a tool's definition never reach the agent.

Tool poisoning scanned at connect
Shadowing fails closed
Rug pulls fingerprinted and re-checked

A record of every decision

Immutable spans, with arguments and results redacted before they are stored.

Free to run

Enforcement is local and identical everywhere. Paid Azure services are optional upgrades.

Shield local detector
Storage SQLite
Hosting any Docker host

Read before you deploy

Honest about its limits

SENTINEL is beta software. Each limitation changes what it protects you from, so they are documented, with their consequences, before anything else.

Status and limitations →

Taint is tracked per MCP session
Only the tools you write rules for are guarded
Downstream servers must speak streamable HTTP
State lives in one process

Put SENTINEL in front of your agent

No agent code changes. No paid services. Five commands from install to enforcement.