AI-Sentinel

Shield Your Multi-Agent army.

Comment

Inspiration

As AI agents become the new frontend for enterprise applications, they also become the new attack surface. Traditional security tools like WAFs and API gateways are blind to prompt injection, agent collusion, and multi-agent emergent threats. We saw a gap: security teams need a Splunk-native, AI-powered guardian that can watch agent-to-agent communication in real time, understand natural language security policies, and act automatically. Our inspiration came from real-world red-teaming of LLM agents and the lack of operator-friendly tooling to protect autonomous agent systems in production.

What it does

AI-Sentinel is an AI-driven security orchestration platform that protects multi-agent systems from external attacks and internal collusion. It provides:

  • Real-time threat detection for LLM-powered agents, including prompt injection, sensitive data leakage, and abnormal agent collaboration patterns.
  • Natural language rule configuration – non-security experts can define custom detection and blocking policies by simply describing what they want to monitor, and AI-Sentinel translates their intent into executable rules and Splunk queries.
  • Automated response actions – the platform can instantly block malicious requests at the gateway, quarantine suspicious agents, and alert human analysts with detailed incident reports.
  • Splunk-native observability – a dedicated Splunk MCP server streams all agent activities into Splunk in real time, enabling powerful search, dashboards, and AI-assisted investigations.
  • Collaboration integrity monitoring – detects when agents bypass predefined protocols, engage in unauthorized negotiations, or form emergent behaviours that deviate from their design.
  • Interactive security command center – a cyberpunk-themed web UI lets analysts investigate incidents, visualize decision paths, toggle between auto-block and observation modes, and manage detection rules with one click.

How we built it

We built AI-Sentinel as a modular, MCP-powered platform with four core layers:

  1. Security Gateway – A lightweight FastAPI middleware that intercepts all requests to LLM agents. It runs pluggable detection modules (prompt injection, PII leaks, suspicious patterns) and sends structured events to Splunk via HTTP Event Collector.
  2. MCP Server Mesh – We implemented three MCP servers:
    • Splunk Query MCP for real-time log retrieval and search.
    • Rule Engine MCP for hot-reloading detection rules from YAML.
    • Gateway Control MCP for issuing block commands and mode switching. These servers enable the AI analyst to dynamically query data, enforce policies, and respond to threats without hardcoded dependencies.
  3. AI Analyst Agent – The brain of the system. It accepts natural language instructions from human analysts, uses an LLM to generate Splunk SPL queries, correlates events, matches rules, and decides when to block or alert. It also constructs simplified decision trees to explain multi-agent interactions.
  4. Visual Command Center – A Flask-based web UI with D3.js visualizations. Analysts can search threats in plain English, toggle between automatic and human-in-the-loop modes, view real-time alerts, and manage the rule library without touching code.

The entire system runs on Splunk for log storage and analysis, leveraging Splunk’s AI capabilities for anomaly detection and trending.

Challenges we ran into

  • Turning natural language into precise SPL – Early versions produced syntactically incorrect queries. We iterated on few-shot prompting and added validation layers to ensure generated queries were safe and accurate.
  • Real-time MCP coordination – Managing multiple MCP servers from a single analyst agent required careful timeout handling and graceful degradation when a server became unresponsive.
  • Balancing automation and human control – We learned that security teams have different risk appetites; some want immediate blocking, others prefer observation. Implementing a seamless auto/observe toggle that applies globally without breaking ongoing analyses was trickier than expected.
  • Simulating realistic multi-agent collusion – To demo the detection engine, we had to craft believable scenarios where agents secretly negotiated refunds. Balancing realism with clarity took several iterations.

Accomplishments that we're proud of

  • Democratizing agent security – With natural language rule creation, even non-security users can deploy sophisticated protections. During our demo, a marketing intern described a policy in plain English and AI-Sentinel turned it into a working rule in seconds.
  • Seamless Splunk integration – Our Splunk MCP server makes agent data instantly searchable and dashboard-ready. Analysts can now query agent behaviour with the same tools they use for infrastructure monitoring.
  • Real-time blocking with zero false positives on known attacks – Our detection modules caught all prompt injection attempts in our test suite without impacting legitimate traffic.
  • Automatic collusion detection – We successfully flagged agent negotiations that bypassed standard workflows, a capability no existing APM or security tool provides.
  • Unified operator experience – The command center hides the complexity of multi-agent observability behind an intuitive interface, reducing incident investigation time from hours to minutes.

What we learned

  • Agent security is fundamentally a data problem – Without rich, structured event logs, detection is impossible. We invested heavily in a self-describing event schema that captures agent thoughts, tool calls, and inter-agent messages.
  • Natural language is a double-edged sword – It makes security accessible, but requires guardrails to prevent ambiguous or dangerous rule interpretations.
  • MCP is a game-changer for AI integration – Decoupling data sources, rule engines, and actuators into separate MCP servers made our system vastly more modular and testable than a monolithic architecture.
  • Human-in-the-loop remains essential – Fully automated blocking can be risky in production; offering an observation mode with clear escalation paths was critical for building trust.

What's next for AI-Sentinel

  • Multi-Splunk deployment support – Enable AI-Sentinel to query and correlate events across distributed Splunk instances for large-scale enterprise deployments.
  • Pre-built rule packs – Ship community-contributed detection packs for common multi-agent frameworks (AutoGen, CrewAI, LangGraph) so teams can get started in minutes.
  • Federated learning for anomaly detection – Train models on anonymized agent behaviour across organizations to improve collusion and emergence detection without sharing sensitive data.
  • Integration with SIEM/SOAR platforms – Allow AI-Sentinel alerts to flow into existing security workflows (e.g., Splunk SOAR, PagerDuty, Slack) for enterprise adoption.
  • Policy-as-code for agent governance – Let teams define acceptable agent behaviours in version-controlled policy files, bridging the gap between security and DevOps in the agent era.

Built With

Share this project:

Updates