Overview
Security Stream
Security Analysis
Security Analysis
Capability Token Studio
Capability token claims inspector
Attack Lab & Simulations
Interactive Tool Simulation Runner
Forensic and incident timeline
Audit Incident logs and rollbacks
Risk Intelligence Matrix
Risk-to-Control Relationships
Audit & Compliance / Persisted Security Ledger
Audit & Compliance / Privacy Policy

Inspiration

Inspiration The rapid adoption of the Model Context Protocol (MCP) bridged a major gap between large language models and production environments by giving AI agents direct access to databases, APIs, and file systems. However, giving an LLM direct execution authority introduces severe systemic vulnerabilities: prompt injection attacks, unconstrained multi-step actions, and out-of-bounds parameter execution. Traditional enterprise security relies on the principle of least privilege, whereas agent architectures frequently depend on non-deterministic model self-policing—effectively trusting the AI to follow its own system prompt. I built SentinelMCP to enforce deterministic boundaries around agentic operations, ensuring that any action with real-world side effects is intercepted, verified against cryptographic capability constraints, and audited before execution ever occurs.

What it does: SentinelMCP serves as a zero-trust execution firewall and transactional proxy between AI models and MCP-enabled tools. Instead of relying on non-deterministic LLM self-policing, it intercepts tool invocations in real time to validate cryptographic capability tokens, enforce policy guardrails, guarantee transactional rollbacks on failures, and stream telemetry verdicts (⁠ALLOWED⁠, ⁠DENIED⁠, ⁠INTERCEPTED⁠) directly to a live monitoring dashboard.

How we built it Proxy & Transport Engine: Built a lightweight Node.js/TypeScript core supporting dual transport modes—JSON-RPC 2.0 over standard I/O for local CLI/MCP Inspector compatibility, and Fastify for high-throughput HTTP/SSE microservices. Security & Token Layer: Engineered a capability-based authorization engine that validates cryptographic tokens bound with strict TTLs, argument whitelists, and threshold limits (e.g., maximum dollar amount per tool call) before forwarding executions. Reliability & State Ledger: Implemented a saga-pattern orchestrator backed by an embedded, immutable SQLite write-ahead log to track state transitions and trigger deterministic compensation/rollback routines if an intermediate tool action fails. Observability Dashboard: Created a Next.js real-time security console that consumes server-sent events (SSE) to render live verdict streams and audit logs.

Challenges we ran into Protocol Transport Parity: Ensuring uniform interceptor behavior across both stream-based Stdio pipes and stateless HTTP/SSE transports without introducing packet fragmentation or latency overhead. Deterministic Rollbacks on Tool Invocations: AI actions are non-linear; designing idempotent rollback steps (compensating transactions) for third-party tools that lack native undo/rollback endpoints proved complex. Balancing Latency vs. Deep Verification: Parsing and validating cryptographic token chains and state signatures on high-frequency tool calls without bottlenecking the real-time response stream of the underlying LLM.

Accomplishments that we're proud of Zero Trust for MCP: Successfully eliminated LLM prompt-tampering exploits by taking execution authority completely out of the model's hands and enforcing it deterministically at the protocol layer. Dual-Mode Plug-and-Play: Achieved 100% specification compliance with the official MCP Inspector over standard I/O while maintaining enterprise Fastify HTTP capabilities. Bulletproof Ledgering: Delivered an immutable audit trail that tracks tool arguments, security verdicts, and automated compensations with sub-millisecond local SQLite overhead.

What we learned LLM Prompts Aren’t Guardrails: Natural language instructions will always be vulnerable to prompt injection; authorization boundaries must be cryptographic and architectural, not conversational.

Observability Builds Trust: Enterprise adoption of autonomous agentic tools hinges on human-in-the-loop visibility; streaming real-time security verdicts turns opaque agent workflows into auditable pipelines.

What's next for SentinelMCP Multi-Signature Human-in-the-Loop (HITL): Introduce instantaneous mobile/Slack webhook approvals for transactions flagged as INTERCEPTED.

Distributed Key Management (KMS): Integrate enterprise cloud vault providers (AWS KMS, HashiCorp Vault) for decentralized token signing and rotation.

Cross-Agent Zero-Knowledge Proofs: Research lightweight ZK proofs to verify policy compliance across multi-agent handoffs without exposing sensitive payload data.