SENTINEL

Stop prompt-injection attacks at the action layer, where the damage happens.

Your content filter will miss an attack eventually. SENTINEL refuses the action anyway.

Website · Guides · Policy reference

Quick start · How it works · What it stops · See it in action · Limitations · FAQ · Documentation

pip install "sentinel-prox>=0.2.2"

[!IMPORTANT] Get SENTINEL from Harshith029/Sentinel, its website, or the sentinel-prox package on PyPI, and install 0.2.2 or later: the 0.1.x releases are insecure. SENTINEL is beta software, so read the known limitations before you rely on it.

---

AI agents now send email, query business systems and read the open web. That makes indirect prompt injection an action problem: an attacker hides an instruction in a page the agent reads, and "summarize this pricing page" quietly becomes "email this customer's SSN to the attacker." Content filters judge the words, and no filter catches everything.

SENTINEL is a security proxy for the Model Context Protocol (MCP). It sits between your agent and your MCP tool servers, labels where every message and tool result came from, and refuses the actions you guard when their lineage includes untrusted content, however the injection was worded.

Your agent needs no code changes: point its MCP endpoint at SENTINEL instead of at your tool servers. Everything runs locally and needs no paid service.

Visit the SENTINEL website for the quick start, the policy guide, and the full documentation.

Quick start

Install and declare your servers

Requires Python 3.11+ and MCP servers that speak the streamable HTTP transport.

pip install "sentinel-prox>=0.2.2"
sentinel init                    # writes sentinel.yaml; list your servers under `servers:`

Check, scaffold a policy, and serve

export SENTINEL_API_TOKEN="$(python -c 'import secrets; print(secrets.token_urlsafe(32))')"
sentinel check                   # connects and vets each catalogue; non-zero if serve would fail
sentinel scaffold > policy.yaml  # every discovered tool, denied, with a suggested rule
sentinel serve                   # agents connect to http://127.0.0.1:8765/mcp

SENTINEL is fail-closed: with no credential configured, every data route answers 503 rather than serving openly.

Point your agent at SENTINEL

Give your agent http://127.0.0.1:8765/mcp with Authorization: Bearer $SENTINEL_API_TOKEN. To your agent, SENTINEL is an ordinary MCP server; a refused call comes back as a tool error that starts with SENTINEL blocked. Then put your tool servers on a network that only SENTINEL can reach, so nothing can go around it. The quick start guide has a complete client example.

Or watch it block an attack first

SENTINEL_ALLOW_ANONYMOUS=1 sentinel serve --dashboard   # then open http://localhost:8765

The bundled demo runs a scripted attack against in-memory mock tools with synthetic data. Anonymous mode is only for this local demo; never use it in front of real tools.

How SENTINEL works

1. Trace. Everything the agent sees carries a trust label (SYSTEM > USER > AGENT > RETRIEVED_CONTENT). An action's provenance is the set of labels over its whole transitive ancestry, never just the most recent step. It is tainted if and only if RETRIEVED_CONTENT is in that set.
2. Authorize. Your policy compiles to a typed condition tree; there is no eval anywhere in the codebase. Rules are deny-only with deny-overrides, and unknown tools are denied by default.
3. Contain. A trust score drops on denied calls and other signals, and can quarantine the agent.
4. Record. Every decision becomes an immutable, replayable forensic span, exportable as JSONL for a SIEM. Tool arguments are redacted before storage and never logged.

Taint clears exactly one way: declassification, declared per tool, when the tool's output validates against a strict, closed schema. A tool whose output no outsider can write to can instead be marked trusted_output: true. Read more about how it works.

This is the beginning of the README. Read the rest at the original. Read the full README ↗