QuerySentinel

Inspiration

Your AI doesn't remember anything. Your database does.

Every modern AI app has quietly turned MongoDB into its memory : the documents, embeddings, and context an LLM reads back as truth. So we asked an uncomfortable question: what happens when that memory gets poisoned, and nobody notices? A single contaminated document doesn't crash anything. It just sits there, getting read, shaping outputs, training the next model : silently corrupting everything downstream. Existing tools watch your queries. Nobody was watching your data's meaning. That blind spot is where QuerySentinel was born.

What it does

QuerySentinel inverts database monitoring. Instead of watching query performance, it watches the shape, size, and meaning of every document the moment it enters MongoDB through Change Streams.

It catches what structural monitors are blind to: document-size explosions, schema drift, AI Memory Poisoning (OWASP LLM01), and our novel detection — Semantic Velocity: the cosine drift between consecutive hourly embedding centroids. When the meaning of your data shifts spam injection, model mismatch, a category quietly changing it fires a CRITICAL incident before the damage spreads. Then a six-agent Gemini pipeline investigates the anomaly live through the official MongoDB MCP server, returning root cause, weighted evidence, and ranked fixes. Nothing executes until a human types APPROVE and every decision is sealed into a tamper-evident Ed25519 audit trail.

How we built it

We built it backwards on purpose — and that's the whole trick.

The detection core is pure math: regex, statistical Z-scores, $bsonSize byte measurement, and semantic-velocity centroid drift. Zero LLM calls. It cannot be rate-limited, cannot hallucinate, and physically cannot return "I'm not sure." On top of that deterministic foundation, Google ADK orchestrates a Gemini 3.5 Flash pipeline — an IncidentOrchestrator plus five specialist agents — that reaches into MongoDB through the official MCP server's 29 tools to investigate live. Atlas supplies Change Streams, Vector Search, and voyage-4 embeddings; the dashboard is Next.js, the backend FastAPI.

The result: Gemini makes it brilliant, but Gemini is never load-bearing. Pull the API key and detection keeps running. We made the AI a passenger, not the engine.

Challenges we ran into

We're showing you the scars, because they're where the real engineering happened:

• MongoDB's MCP server uses anyio cancel scopes that flatly refuse to run under ADK's ParallelAgent — we had to detect that and force a SequentialAgent whenever MCP is live.
• The MCP stdio connection hung until we tuned a 60-second timeout and rebuilt its lifecycle handling.
• Our Atlas Vector Search index was silently built for the wrong embedding dimension — so $vectorSearch returned nothing and our health endpoint went "degraded." We turned that scar into a feature: a self-healing index check that detects a dimension mismatch and rebuilds automatically.
• A 512MB free tier OOM'd under fastembed + onnxruntime + google-adk, forcing us to make embeddings optional and prove our "graceful degradation" claim under real memory pressure.
• Gemini's free-tier quota is brutally small — which is precisely what forced the deterministic core. Our biggest constraint became our strongest design decision.

Accomplishments that we're proud of

We proved something most AI demos can't survive: pull the plug on the AI, and it still works.

And we didn't hide behind vibes — we measured. AI Memory Poisoning detection at 0.169% false-positive across 1,186 documents. Semantic Velocity at 100% true-positive / 2.0% false-positive across 400 window. 88 of 88 adversarial tests passing. We didn't "call an MCP tool" for the checkbox — we closed the loop: Performance Advisor → suggested index → create-index gated behind human approval. Then we went further and exposed QuerySentinel's own detectors as an MCP server. This isn't a wrapper. It's infrastructure.

What we learned

The most reliable AI system is the one where the AI is optional.

Building the deterministic baseline first, then layering Gemini on top, made the product simultaneously smarter and impossible to fully break the opposite of the usual fragile-demo tradeoff. And Semantic Velocity taught us there's an entire category of corruption drift in meaning, not structure that every monitor on the market is blind to. Once you can see it, you can't unsee how exposed the AI memory layer really is.

What's next for QuerySentinel

This is the wedge, not the whole product. Next: real MCP write-execution behind the APPROVE gate, multi-cluster monitoring, per-collection semantic-velocity tuning, and packaging the detection core as a drop-in Atlas integration so any team can secure their AI memory layer in minutes, not sprints. The AI memory layer is about to become critical infrastructure. We intend to be the system watching it.

Built With

• atlas-vector-search
• change-streams
• ed25519
• fastapi
• google-adk
• google-gemini
• model-context-protocol
• mongodb
• mongodb-atlas
• mongodb-mcp-server
• next.js
• python
• react
• render
• typescript
• vercel
• voyage-ai