In-band sleeper sentinel
Server Details
In-band MCP sleeper sentinel — mid-session diff and quarantine inside your own client's session.
- Status
- Healthy
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-03-26
- URL
TDQS
Scored across 2 tools
The two tools have clearly distinct purposes: sentinel_inspect runs analysis over a transcript, while sentinel_verdicts lists stored verdicts. Although inspect also returns verdicts, the action of running versus listing is evident from names and descriptions.
Both tools use a consistent snake_case sentinel_ prefix. The suffixes differ in type (inspect is a verb, verdicts is a noun), but the overall pattern remains predictable.
Two tools is quite thin for the apparent sentinel-management domain. The count is not unreasonable for a narrow inspection surface, but it feels borderline and may push agents into workarounds.
The surface covers running an inspection and listing stored verdicts, but lacks operations for retrieving a specific verdict, clearing or deleting stored verdicts, or configuring sentinel behavior. These are notable gaps for managing per-(server, client) verdicts over time.
Available Tools
2 toolssentinel_inspectBInspect
Run the in-band sentinel over a session transcript; returns the per-(server, client) verdict and the context-safe delivered messages.
| Name | Required | Description | Default |
|---|---|---|---|
| client | Yes | ||
| server | Yes | ||
| messages | Yes | ||
| admission_complete | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does disclose the return shape (per-server/client verdict and context-safe delivered messages), which is useful, but it does not state whether the operation is read-only, idempotent, or has side effects, and it does not explain the significance of 'in-band' or 'context-safe' filtering.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. The specialized jargon ('in-band', 'context-safe') is dense but the structure itself is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a four-parameter tool with no annotations, no output schema, and zero schema description coverage, the definition is incomplete. It omits admission_complete semantics, side-effect/safety information, and any routing guidance against the sentinel_verdicts sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It implies meaning for three parameters: messages as the session transcript, and server/client as the dimensions of the verdict. However, admission_complete is entirely unexplained, leaving one of four parameters undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: running the in-band sentinel over a session transcript, returning a verdict and delivered messages. It does not differentiate this from the sibling sentinel_verdicts, so sibling differentiation is missing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus sentinel_verdicts, nor any stated preconditions or exclusions. Usage is only loosely implied by the mention of a session transcript.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sentinel_verdictsCInspect
List your stored per-(server, client) verdicts.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. "List" implies a read-only operation and "your stored" implies caller scoping, but there is no mention of result size, pagination, ordering, or whether verdicts are persisted across sessions — meaningful gaps for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. Its brevity is close to under-specification rather than wasteful, but nothing in the sentence fails to earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is structurally simple (no params, no nesting), but with no output schema and no annotations, the description should say at least roughly what a verdict record contains. Leaving the return shape entirely unexplained is a real gap for an agent deciding whether to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description correctly implies no filtering inputs are needed, and there are no parameter semantics left undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb ("List") and a resource ("stored per-(server, client) verdicts"), which is better than a tautology, but "verdicts" is unexplained domain jargon and nothing distinguishes this from the sibling sentinel_inspect. An agent knows it enumerates something, but not clearly what a verdict is.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no indication of when to call this rather than sentinel_inspect, nor any prerequisite or exclusion. The only hint is the possessive "your", which implies caller-scoped data but gives no routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
- First observed
sentinel_inspect - First observed
sentinel_verdicts
Related MCP Connectors
Diff and poisoning detection for MCP servers: catch schema drift and prompt poisoning.
Security research canary remote MCP server for owned-account testing.
Concurrent two-client overlap probe proving MCP servers do not cross-deliver tool results.
Monitor MCP servers, API contracts and AI outputs for schema drift. Alerts on breaking changes.
Related MCP Servers
- AlicenseAqualityAmaintenanceA local stdio proxy that pins every MCP tool definition when you approve a server and blocks the session with a diff if a description, schema or annotation changes later. A deterministic hash compare (RFC 8785 + SHA-256), with no model in the loop.434 npm3MIT
- AlicenseNot gradedqualityBmaintenanceA local-first stdio proxy for MCP servers that traps destructive tool calls and holds them for manual commit or discard, preventing accidental mutations.AGPL 3.0
- AlicenseNot gradedqualityBmaintenanceEnables transparent MCP proxying with a hash-chained effect ledger, classifying agent actions by reversibility, enforcing approval gates, and dry-run previews of sessions.MIT
- AlicenseNot gradedqualityAmaintenanceMCP server that watches upstream API providers for breaking changes, scans your codebase for impact, and drafts migration fixes locally, all offline-first with zero network.56 npm1AGPL 3.0
Glama MCP Gateway
Add one secure layer between your agents and this server.