SentinelMCP — Policy Enforcement & Transaction Integrity for AI Agents
SentinelMCP sits between AI agent runtimes (such as Claude Desktop, custom agentic frameworks, and LLM orchestrators) and backend Model Context Protocol (MCP) tool servers. It acts as an active policy enforcement firewall that prevents unauthorized tool invocations, blocks prompt injection payloads before execution, guards sensitive operations with single-use cryptographic capability tokens, and restores database state on failure through compensating Saga rollbacks.
Why SentinelMCP Exists
The Security Gap in Autonomous Tool Execution
Standard MCP connections expose backend tools directly to LLM orchestrators. Without an intermediary enforcement boundary, autonomous agents face four operational risks:
- Unverified Intent: Agents invoking destructive or financial tools without cryptographic proof of authorization or scope boundaries.
- Token Replay & Stale Access: Intercepted or expired authorization credentials being reused to repeat privileged transfers or deletions.
- Prompt & Script Injection: Adversarial instructions embedded in untrusted inputs reaching downstream databases or email outboxes.
- Partial State Corruption: Multi-step agent plans failing at step N after earlier steps have already debited balances or mutated records.
Gateway Execution Pipeline
How the Security Workflow Operates
Intercept & Register Transaction
Every incoming MCP tool call is intercepted by the gateway before reaching the underlying tool handler and assigned a tracked transaction identifier (tx_*) in the SQLite ledger.
Evaluate Content Guardrails
Target text parameters are scanned for prompt injections, system overrides, destructive SQL commands, and script tags via LocalDemoGuardrailProvider or AWS Bedrock Guardrails.
Verify Capability & Consume Nonce
Privileged tools require an HMAC-SHA256 token verified with constant-time signature comparison, action binding, amount limit checks, TTL validation, and atomic nonce persistence.
Commit Step or Trigger Saga Rollback
Approved executions record forward outputs to transaction_steps. If a step is blocked or throws an error midway through a plan, registered compensations reverse prior mutations in reverse order.
Platform Architecture
Core Security & Investigation Capabilities
Real-Time MCP Security Monitoring
Streams live tool requests, pass/block policy verdicts, capability token issuances, and rollback alerts over Server-Sent Events (/sse) as autonomous agents invoke Model Context Protocol tools.
Dual-Tier Threat & Injection Detection
Inspects untrusted tool input fields (such as record content, email subjects, and message bodies) before execution using deterministic local regex patterns or AWS Bedrock Guardrails in fail-closed mode.
Cryptographic Capability Enforcement
Protects high-impact tools (execute_transfer, delete_record) with HMAC-SHA256 signed capability tokens bound to specific actions, resource scopes, transfer ceilings, TTL windows, and single-use SQLite UUIDv4 nonces.
Forensic Investigation & Saga Rollbacks
Tracks multi-step agent executions in a local SQLite ledger and automatically executes reverse-order compensating actions when a downstream tool call fails or violates security policy.
Persisted SQLite Audit Ledger & Data Governance
All policy verdicts, consumed nonces, and multi-step Saga states are persisted to the local SQLite database for audit verification. Explore the ledger or review our data handling practices.