-
-
Interactive Threat Simulator and real-time zero-trust circuit breaker triggers
-
Adaptive token-bucket rate limiter with microsecond drain and sub-millisecond p50 latency
-
AI Threat Firewall inspecting OWASP LLM Top 10 prompts with Shannon entropy scoring
-
Multi-layer execution sandbox blocking shell injections and directory traversal
-
SentinelGate Titanium Security Cockpit with live enterprise telemetry and decision counters
-
25/25 automated unit test verification suite passing with 100% deterministic assertion
-
Cryptographic SHA-256 tamper-evident audit ledger and forensic replay chain
Inspiration
As autonomous AI agents are granted access to execute terminal commands, manage cloud resources, and process financial transactions, a critical vulnerability has emerged: the lack of zero-trust verification at the execution boundary. Standard LLM applications grant implicit trust to model outputs, allowing prompt injections, jailbreaks, and indirect prompt manipulation to execute catastrophic tool calls. We set out to build SentinelGate: a hardened, sub-millisecond, five-layer zero-trust gateway that treats every AI agent instruction as untrusted until cryptographically verified and sandboxed.
What it does
SentinelGate intercepts every inbound AI agent request and outbound tool execution through a five-layer zero-trust pipeline conforming to NIST SP 800-207 standards:
Layer 1 — Cryptographic Authentication: HMAC-SHA256 signature verification with timing-safe comparison, nonce deduplication, and replay attack prevention. Layer 2 — Adaptive Token-Bucket Rate Limiter: Microsecond-precision token drain with configurable tiers (Standard, Premium, Internal). Layer 3 — AI Threat Firewall: 9 OWASP LLM Top 10 detection rules, Shannon entropy analysis for exfiltration detection, and heuristic risk scoring. Layer 4 — Execution Sandbox & RBAC: Enforces strict least-privilege tool execution, intercepting shell injection, reverse shell pipes, and directory traversal. Layer 5 — Tamper-Evident Audit Ledger: Cryptographically linked SHA-256 block ledger providing immutable forensic event recording.
How we built it
We engineered SentinelGate with a strict Zero-Dependency Architecture, built exclusively with native Node.js standard libraries (crypto, fs, http, path) to ensure zero supply-chain risk and eliminate runtime vulnerabilities.
Automated Test Suite: 25/25 automated unit tests verifying cryptographic integrity, token-bucket drains, and attack interceptions. Titanium HUD Cockpit: A high-frequency telemetry dashboard (#04070D canvas) featuring interactive attack simulation triggers, live hash chain verification, and p50/p95/p99 latency tracking.
Challenges we ran into
Achieving sub-millisecond throughput while calculating cryptographic HMAC signatures and running Shannon entropy evaluations on every token was challenging. By optimizing string parsing and eliminating external library overhead, we reduced our median decision latency to 0.22ms (3,650 req/sec), making security practically invisible to the user
Accomplishments that we're proud of
25/25 Tests Passing with 100% deterministic assertion. p50 Latency of 0.22ms — orders of magnitude faster than conventional API gateways. 100% Zero NPM Dependencies — fully self-contained security engine. A production-grade Titanium HUD deployed live on GitHub Pages.
What we learned
We validated that defensive AI security doesn't require massive multi-gigabyte models. Deterministic heuristic rules, entropy measurements, and cryptographic hash chains provide airtight defenses against prompt injections and tool hijacking at a fraction of the compute cost.
What's next for SentinelGate
We are integrating SentinelGate with Model Context Protocol (MCP) servers and extending cross-chain automated callbacks for autonomous Web3 execution defense.
Built With
- ai-agents
- cryptography
- cybersecurity
- hmac
- javascript
- node.js
- owasp
- sha256
- zero-trust
