# Sentinel MCP Server
**Sentinel** is a robust, enterprise-grade Security MCP (Model Context Protocol) Server designed for reliability, compliance, and easy integration with IDEs like VS Code and Antigravity.
## 🛡️ Features
- **Robust Execution**: Automatic retries for Docker commands, graceful timeout handling, and custom error reporting.
- **Compliance Ready**: Built-in support for **CIS Benchmark** scanning via Trivy.
- **Structured Logging**: All logs are output in JSON format for easy parsing and monitoring.
- **Dockerized Tools**: Runs all security tools in isolated Docker containers—no local tool installation required.
## 🧰 Included Tools
| Tool | Function | Docker Image |
| :--- | :--- | :--- |
| **Semgrep** | SAST (Static Analysis) | `returntocorp/semgrep` (Rules: OWASP Top 10, CWE Top 25, Security Audit) |
| **Trivy** | SCA & Compliance | `aquasec/trivy` |
| **Grype** | SCA (Vulnerability Scanning) | `anchore/grype` |
| **Gitleaks** | Secret Scanning | `zricethezav/gitleaks` |
| **OWASP ZAP** | DAST (Web Scanning) | `owasp/zap2docker-stable` |
| **ClamAV** | Malware Scanning | `clamav/clamav` |
| **Schemathesis** | API Fuzzing | `schemathesis/schemathesis:stable` |
| **EOL Scanner** | Runtime/Framework EOL Checks | *Built-in (endoflife.date API)* |
| **Crypto Scanner** | SSL/TLS Compliance | `drwetter/testssl.sh` |
| **AI Threat Modeler** | STRIDE Analysis | *Built-in (LLM Powered + Code Context + Mermaid DFD)* |
## 🚀 Getting Started
### Prerequisites
- **Docker**: Must be installed and running.
- **Python**: Version 3.13 or higher.
### Installation
1. **Clone the repository** (if applicable) or navigate to the project directory:
```bash
cd sentinel-mcp-server
```
2. **Create a virtual environment**:
```bash
python3 -m venv .venv
source .venv/bin/activate
```
3. **Install dependencies**:
```bash
pip install .
```
### Running the Server
To start the MCP server manually (for testing):
```bash
mcp run python src/sentinel/server.py
```
### Manual Scanning (CLI)
You can also scan any project directory directly from the terminal using the included utility script:
```bash
# Scan a specific project directory
python3 scan_project.py /path/to/your/project
# Run only specific scans (e.g., secrets)
python3 scan_project.py /path/to/your/project --type secrets
```
## 💻 IDE Configuration
### VS Code
To use Sentinel with the **MCP Servers** extension in VS Code, add the following to your MCP settings file (typically `~/Library/Application Support/Code/User/globalStorage/mcp-servers.json`):
```json
{
"mcpServers": {
"sentinel": {
"command": "/Users/pranjalsharma/Documents/SourceCode/appsec/sentinel-mcp-server/.venv/bin/python3",
"args": [
"/Users/pranjalsharma/Documents/SourceCode/appsec/sentinel-mcp-server/src/sentinel/server.py"
],
"env": {
"SENTINEL_LOG_LEVEL": "INFO"
}
}
}
}
```
*Replace `/ABSOLUTE/PATH/TO/...` with the actual full path to your project directory.*
## ⚙️ Configuration
You can configure Sentinel using environment variables:
| Variable | Description | Default |
| :--- | :--- | :--- |
| `SENTINEL_LOG_LEVEL` | Logging level (DEBUG, INFO, WARN, ERROR) | `INFO` |
| `SENTINEL_DOCKER_TIMEOUT` | Timeout for Docker commands in seconds | `600` |
| `SENTINEL_SEMGREP_IMAGE` | Custom Docker image for Semgrep | `returntocorp/semgrep` |
| `SENTINEL_TRIVY_IMAGE` | Custom Docker image for Trivy | `aquasec/trivy` |
| `SENTINEL_GRYPE_IMAGE` | Custom Docker image for Grype | `anchore/grype` |
| `SENTINEL_TESTSSL_IMAGE` | Custom Docker image for testssl.sh | `drwetter/testssl.sh` |
| `SENTINEL_SCHEMATHESIS_IMAGE` | Custom Docker image for Schemathesis | `schemathesis/schemathesis:stable` |
| `SENTINEL_LLM_API_KEY` | API Key for AI Threat Modeling (e.g., OpenAI) | `None` (Falls back to heuristic) |
| `SENTINEL_LLM_MODEL` | LLM Model to use | `gpt-4o` |
## 🏗️ Project Structure
```text
src/sentinel/
├── core/ # Core logic (logging, exceptions, config)
├── services/ # Business logic (scanners, compliance)
├── tools/ # Tool execution (Docker runner)
└── server.py # Main MCP entry point
```
