Sentinel MCP

Safe, allowlisted tool execution for AI agents.

Sentinel is a production-minded Model Context Protocol server that lets Cursor (and other MCP clients) call a tiny set of harmless tools — only against hosts you put on an explicit allowlist.

Safety over power. No shell. No scanners. No surprises.

Why Sentinel?

Most “give the AI tools” demos hand the model a shell. That scales poorly with trust.

Sentinel keeps the useful pattern (agent → tools → results) and hardens the middle:

Read the story in ABOUT.md.

Related MCP server: mcp-server

Tools (intentionally boring)

If a tool would be useful for attacking systems, it does not belong in this repo.

Quick start

Local (Python 3.11+)

git clone https://github.com/JureJan/sentinel.git
cd sentinel
python3 -m venv .venv && source .venv/bin/activate
pip install -r requirements.txt
cp .env.example .env
python server.py   # stdio MCP server

Docker

docker compose up --build

Cursor MCP config

Add to your MCP settings (see docs/cursor-setup.md):

{
  "mcpServers": {
    "sentinel": {
      "command": "python3",
      "args": ["/absolute/path/to/sentinel/server.py"],
      "env": {
        "ALLOWED_TARGETS": "127.0.0.1,example.com"
      }
    }
  }
}

Configuration

Tests

pytest

Project layout

sentinel/
├── server.py           # entire MCP server (~400 lines)
├── ABOUT.md            # product story
├── SECURITY.md         # disclosure policy
├── docs/               # setup + architecture
├── tests/              # allowlist & sanitisation tests
├── Dockerfile          # python:slim + dig/curl/whois
└── docker-compose.yml  # hardened runtime

Star history / support

If Sentinel helps you ship safer agent tooling, a ⭐ on GitHub helps others find it.

Issues and PRs that improve safety, docs, or tests are welcome — see CONTRIBUTING.md.

License

MIT © JureJan