sentinel-mcp

The Threat Model

As autonomous developer agents (Claude Code, Cursor, OpenCode) become standard, they are granted broad tool execution powers via the Model Context Protocol (MCP). If an LLM encounters untrusted input or prompt injection, it can be tricked into invoking tools that read sensitive credentials (~/.ssh/id_rsa, .env) or trigger Server-Side Request Forgery (SSRF) against cloud metadata endpoints like 169.254.169.254.

Architecture & Design

Sentinel sits transparently between the agent client and upstream MCP tool servers over standard IO (stdio). It decodes JSON-RPC 2.0 frames on the fly with zero memory copies where possible:

• Declarative Capability Sandboxing: Enforces granular directory whitelisting and blocks path traversal (../).
• SSRF Egress Guard: Intercepts network calls targeting RFC 1918 private subnets and cloud metadata services.
• Shannon Entropy Taint Detection: Computes real-time byte entropy on tool response outputs to flag and redact leaked API tokens, private keys, and high-entropy secrets before they enter the LLM's context window.
• Tamper-Proof Audit Stream: Emits structured JSONL audit logs with sub-millisecond timestamps, tool names, latency, and enforcement verdicts (ALLOW, BLOCK, REDACT).

Benchmarks & Results

Target Alignment

Directly tailored to high-scale backend systems and AI security architectures (such as Pragmatike, RightWalk Foundation, Cursor, and Robinhood Systems).