Open Source · Apache 2.0 · Written in Rust

Your AI Agents Have
Your API Keys.
Sentinel Controls What They Do With Them.

An authorization gateway for AI agent tool calls. Session-scoped whitelists, intent-matched policies, behavioral anomaly detection, and a full forensic audit trail — all in under 1ms per request. Drop it in front of any MCP server. No agents to install.

One command
$ sentinel --config sentinel.toml
INFO proxy listening  addr=0.0.0.0:8080  ← your agents now go through Sentinel
INFO admin API      addr=0.0.0.0:3000  ← manage sessions, view audit trail
6
Tool Calls
2
Allowed
4
Blocked
< 1ms
Per Decision
0
Bytes Out

Live adversarial scenario: QuantumBank financial services. Full case study — every request, every audit entry →

The Gap Nobody Has Filled

Traditional IAM was built for humans. It authenticates identities and controls which resources they can access. AI agents are different: they authenticate once and then make thousands of autonomous tool calls — each one a real action with real consequences. RBAC doesn't see individual tool calls. Nothing has been watching.

Machine-Speed Exfiltration

A compromised agent can export your entire customer database before a human detects anything. Traditional monitoring wasn't built for autonomous actors operating at API speed.

No Intent Enforcement

An agent authorized to "read customer data" can call write, export, and delete tools unless something enforces the boundary between its declared intent and its actual operations.

No Forensic Trail

When something goes wrong, there's no structured log tying agent identity to tool call to arguments to decision. You're reconstructing events from scattered access logs.

Compliance Exposure

SOC 2, PCI-DSS, HIPAA, and GDPR all require access controls and audit trails. AI agents bypass every control designed for human users. IBM 2024: avg breach cost $4.88M.

How Sentinel Works

A transparent proxy that sits between your agents and your MCP server. Every tool call passes through 9 inspection stages. Zero changes to your existing agents or MCP server. Average overhead: under 1ms.

Stages 1–3

Observe Everything

Distributed tracing, Prometheus metrics, and structured audit capture initialize on every request — before any enforcement decision is made.

Stages 4–6

Verify Identity & Scope

OAuth 2.1 JWT validation, MCP protocol parsing (tool name + full arguments), and session enforcement — whitelist, time limit, call budget. No session header? 403.

Stages 7–9

Evaluate, Detect, Act

Deny-by-default policy engine. Intent-keyword matching. Behavioral anomaly detection flags when actual operations contradict declared intent. Forward or block.

Full architecture documentation →

We Ran the Attacks. Here's What Happened.

We deployed Sentinel in front of a financial services MCP server and ran an adversarial stress test. Data exfiltration attempt. Account manipulation. Privilege escalation. Audit destruction. Every tool call is logged. Every decision is explained. Every number is real and reproducible.

QuantumBank Attack Scenario

Agent risk-analyzer-7 — authorized for transaction analysis only — attempted 4 unauthorized operations. Sentinel blocked all 4 before a single byte reached the upstream server. Full audit trail, raw Prometheus metrics, and reproduction commands included.

Read the full case study — including what the demo doesn't cover →
4
Blocked
0
Bytes Out
<1ms
Latency

One Command to Protected

A single Rust binary. No agents to install. No sidecars. No service mesh changes. Point it at your MCP server — your tool calls are now enforced, audited, and observable.

sentinel.toml Minimal config — 3 fields to get started
[proxy] upstream_url = "http://your-mcp-server:8081" [audit] enabled = true file_path = "/var/log/sentinel/audit.jsonl" redaction_patterns = ["ssn", "credit_card", "password"] [admin] api_key = "your-secure-key"
terminal Install and run
# Download the binary (Linux and macOS, amd64 and arm64) OS=$(uname -s | tr '[:upper:]' '[:lower:]' | sed 's/darwin/macos/') \ ARCH=$(uname -m | sed 's/x86_64/amd64/') && \ curl -fsSL "https://github.com/ireland-samantha/sentinel/releases/latest/download/sentinel-${OS}-${ARCH}" \ -o /usr/local/bin/sentinel && chmod +x /usr/local/bin/sentinel # That's it — all your agents now go through Sentinel sentinel --config sentinel.toml INFO proxy listening addr=0.0.0.0:8080 INFO admin API addr=0.0.0.0:3000

Full quickstart guide  ·  Reproduce the attack scenario

Why This Problem Is Unsolved and Why Now

The gap between AI agent deployment velocity and AI agent security infrastructure is the largest unaddressed risk surface in enterprise software. Every company shipping AI agents is exposed. Almost none of them know it.

Agent Deployment is Accelerating

Anthropic, OpenAI, Google, and Microsoft all shipped agent frameworks in 2024-2025. MCP is becoming the standard interface for AI agent tool use. Enterprise deployments are live today.

No Authorization Layer Exists

Existing IAM enforces endpoint-level access. AI agents need tool-call-level authorization: which agent, which session, which intent, which tool, which parameters. Nothing does this today.

Regulation is Arriving

NIST AI RMF, the EU AI Act, and state-level AI governance are converging on accountability for autonomous AI decision-making. Audit trails aren't optional for much longer.

Open Source. Fully Inspectable.

Security infrastructure you can't read is infrastructure you can't trust. Apache 2.0. Every enforcement decision, every audit format, every policy rule is in the source code.

handler.rs
The 9-stage middleware chain
eval.rs
Policy engine, deny-by-default
integration.rs
Full lifecycle test suite

Your Agents Are Running.
One Command to Protected.

Open source. Apache 2.0. No vendor lock-in. No agents to install. Drop it in front of your MCP server and you have full visibility and control today.

Enterprise support and custom policy development available. Contact us.