Sentinel MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| sentinel_evaluate_actionA | Evaluate a proposed AI-agent action against Sentinel policy BEFORE it executes. Returns a verdict of allow, hold (a human must approve first), or deny, with the risk score, the signals that fired, and reasons. Each evaluation is appended to a SHA-256 hash-chained audit log. |
| sentinel_explain_policyA | Explain how Sentinel scores a proposed action, the verdict thresholds, the independent action gate for consequential tool calls, and the signal categories it looks for. |
| sentinel_audit_statusA | Report the state of this server process's Sentinel audit log: entry count, genesis and tip hashes, and a full SHA-256 chain re-verification. The log is process-local and resets when the server restarts; it demonstrates the same hash-chain used by the full product. |
| sentinel_register_deviceA | Enroll a legacy/OT device (refrigeration controller, PLC, building system) that cannot route actions through the agent gate. Once registered, commands to it are accepted only through the NetGuard broker, inside its hard safety limits, and its observed state is watched for tampering. |
| sentinel_device_commandA | Evaluate a command for a NetGuard-registered device BEFORE it is forwarded. Verdicts: allow (forward it), hold (a human must approve first), deny (never forward). Unenrolled sources are denied; parameters outside hard safety limits are denied outright. Every decision is audit-chained. |
| sentinel_device_telemetryA | Report a protected device's observed setpoint and temperature. The watchdog compares them to the last brokered state: a change nobody brokered is treated as tampering, an out-of-limits state as unsafe. Either raises an audit-chained incident and quarantines the device. |
| sentinel_enforcement_planA | Generate the segmentation rules (portable JSON + nftables) that make the Sentinel broker the only reachable path to every registered device: default-deny inbound, no internet route to the devices, no device egress. Review before applying on the segment gateway. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 7 tools
Each tool targets a clearly distinct operation: agent-action evaluation, policy explanation, audit-log status, device command evaluation, enforcement planning, device enrollment, and device telemetry. The only nearby pair is sentinel_evaluate_action and sentinel_device_command, but the descriptions sharply separate generic AI-agent actions from NetGuard device commands.
All tools use the same sentinel_ prefix and snake_case style, which makes the set predictable. However, several names are noun phrases (sentinel_device_command, sentinel_enforcement_plan, sentinel_device_telemetry) rather than a consistent verb_noun pattern.
Seven tools is well-scoped for the server's purpose, covering policy evaluation, device control, registration, telemetry, enforcement planning, and audit verification without obvious redundancy. Each tool appears to earn its place in the workflow.
The core lifecycle is covered: evaluate actions and device commands, explain policy, enroll devices, inspect telemetry, generate enforcement rules, and verify audit integrity. Minor gaps remain, such as listing or unregistering devices and retrieving audit entries or incident details, but agents can still execute the main security workflows.