1. Information Collected & Processed

When AI agents, MCP clients, or operators interact with the SentinelMCP Gateway and Dashboard, the application processes and records the following categories of data:

• MCP Tool Invocation Payloads: Tool names (tool_name), complete serialized JSON input parameters (input_payload), and tool handler return values (output_payload). Depending on the tools invoked, these payloads may include account identifiers, transfer amounts, invoice identifiers, free-form record text (content), and email parameters (recipient address to, subject, and body).
• Cryptographic Capability Token Claims: Signed capability tokens submitted to or issued by the gateway (POST /api/tokens/issue), including target action, resource scope, maximum transaction amount ceiling, expiration Unix timestamp, and UUIDv4 nonces.
• Transaction & Client Context Identifiers: Generated transaction IDs (tx_*), step IDs (stp_*), and initiator/client labels (such as mcp-client, dashboard-lab, or saga-multi-step-agent).
• Browser UI Preferences: The dashboard stores the desktop sidebar navigation state (sentinel_sidebar_collapsed) in the user's browser window.localStorage.

2. Security Events, Logs & Telemetry

SentinelMCP is an observability and policy enforcement gateway; telemetry and security logging are active by design:

• Persisted Audit Events: Every policy evaluation in PolicyEnforcer writes a record to the SQLite audit_events table containing event_type (TOOL_INVOCATION), tool_name, verdict (ALLOWED or BLOCKED), the detailed reason, and an ISO-8601 timestamp.
• Real-Time SSE Telemetry Stream: The gateway broadcasts live events over GET /sse (including SYSTEM_CONNECT, TOKEN_ISSUED, TRANSACTION_INITIATED, TOOL_REQUEST, TOOL_VERDICT, SAGA_ROLLBACK_INITIATED, COMPENSATION_EXECUTED, ROLLBACK_COMPLETED, and TRANSACTION_COMMITTED). These events include tool arguments (params) and denial reasons. The browser dashboard buffers up to 100 live events in client memory.
• HTTP Server & Console Logs: The Fastify server runs with structured JSON logging enabled (logger: true), which writes request methods, URLs, status codes, response times, process IDs, hostnames, and client remoteAddress values to standard output/error.

3. Purpose of Processing

Information processed by SentinelMCP is used strictly for the following operational security functions:

• Verifying cryptographic capability tokens and enforcing least-privilege action and amount boundaries before executing MCP tools.
• Detecting and blocking prompt injections, cross-site scripting patterns, and unauthorized system overrides in untrusted tool inputs.
• Preventing single-use capability token replay attacks by checking and recording consumed UUIDv4 nonces.
• Maintaining transactional consistency across multi-step AI agent workflows by storing step input/output snapshots required to execute reverse Saga rollbacks on failure.
• Providing security operators with real-time monitoring, forensic incident timelines, and audit trail visibility.

4. Storage, Retention & Deletion

Local SQLite Persistence: By default, the gateway persists data on the local host filesystem using @libsql/client in a SQLite database file located at data/sentinel_ledger.db (with Write-Ahead Logging PRAGMA journal_mode = WAL enabled). The database contains six tables: audit_events, transactions, transaction_steps, nonces, records, and mock_accounts.

Retention & Deletion Behavior:

• The application codebase does not currently implement automated TTL pruning, scheduled background deletion, or a UI/API endpoint that permanently purges historical rows from audit_events, transactions, transaction_steps, or nonces.
• Clicking Clear Stream in the dashboard clears only the volatile in-memory browser array of SSE events; it does not delete persisted records in data/sentinel_ledger.db.
• When the delete_record tool deletes a row from the records table, its previous_content is captured in transaction_steps.output_payload so that Saga compensation can restore the record if a multi-step transaction fails.
• Permanent removal of stored ledger and audit data currently requires administrative deletion or rotation of the SQLite database file (data/sentinel_ledger.db) on the host machine.
• Organizational Retention Schedule: [PLACEHOLDER: Specify organizational log retention period, archival policy, and database purge schedule before publication]

5. Third-Party Integrations & External Services

• Default Deterministic Local Guardrail (BEDROCK_ENABLED=false): In its default configuration, SentinelMCP inspects tool text inputs locally using regular expressions (LocalDemoGuardrailProvider) and does not send tool payloads to external cloud guardrail APIs.
• Optional AWS Bedrock Guardrails Integration (BEDROCK_ENABLED=true): When operators explicitly enable AWS Bedrock in the environment configuration (BEDROCK_ENABLED=true, AWS_REGION, BEDROCK_GUARDRAIL_ID), inspected text fields (such as content, subject, and body) are sent over HTTPS to Amazon Web Services via @aws-sdk/client-bedrock-runtime (ApplyGuardrailCommand) for content evaluation. Data processed through AWS Bedrock is governed by your organization's AWS account configuration and the AWS Service Terms.
• Typography Assets: The Next.js dashboard configures the Geist and Geist_Mono fonts via next/font/google.

6. Data Sharing & Disclosure

The SentinelMCP codebase does not embed third-party marketing trackers, advertising beacons, or external analytics SDKs. Data is only transmitted externally if the operator enables AWS Bedrock Guardrails (BEDROCK_ENABLED=true) or exposes the gateway network port to external hosts.

Organizational Disclosure Policy: [PLACEHOLDER: Specify circumstances under which the deploying organization may share audit logs with internal security teams, auditors, subprocessors, or law enforcement]

7. User Rights & Privacy Choices

Depending on how SentinelMCP is deployed and your applicable jurisdiction, operators and users have the following technical controls and privacy choices:

• Offline / Local-Only Inspection: Keep BEDROCK_ENABLED=false in .env so all guardrail evaluations run locally without external API calls.
• Local Database Access & Erasure: Self-hosted operators have direct filesystem access to inspect, query, export, or delete data/sentinel_ledger.db.
• Browser Storage Reset: Users can clear sentinel_sidebar_collapsed at any time via browser site data settings and clear in-memory SSE events via the Clear Stream button.
• Data Subject Requests (Hosted Deployments): [PLACEHOLDER: Describe procedures for submitting access, rectification, restriction, or erasure requests if deployed as a managed or multi-user service]

8. Security Measures & Operational Caveats

Implemented Technical Controls:

• Constant-Time HMAC-SHA256 Verification: Capability tokens are signed with CAPABILITY_SECRET (enforced minimum length of 32 characters via Zod configuration validation) and verified using crypto.timingSafeEqual to mitigate timing side-channel attacks.
• Single-Use Nonce & TTL Enforcement: Consumed token nonces are persisted in SQLite to block replay attacks, and expired tokens are rejected prior to handler execution.
• Fail-Closed Guardrails & Payload Limits: If AWS Bedrock is enabled without a valid guardrail identifier or encounters a runtime error, the gateway fails closed and blocks the tool call. Fastify enforces a 1 MB request payload limit (bodyLimit: 1048576).

9. Children's Privacy

SentinelMCP is an infrastructure security and developer operations tool designed for software engineers and security teams managing Model Context Protocol agents. It is not directed at children, and it is not intended to collect personal information from children. [PLACEHOLDER: Insert jurisdiction-specific minimum age language and contact procedure if applicable]

10. Policy Updates & Contact Information

This policy should be updated whenever new MCP tools, external guardrail providers, authentication layers, or database retention mechanisms are added to SentinelMCP.