sentarion-mcp — Give your AI agents rules, memory, and receipts.

Install: pip install sentarion-mcp · Command: sentarion · Apache-2.0 · Hosted endpoint

Sentarion is the open-source MCP control layer for governed multi-agent work. It governs, records, and coordinates agent work across Claude Code, Codex, Cursor, local models, and any MCP-compatible client.

It composes three open-source MCP servers into one governed substrate — it connects to them as an MCP client, it does not reimplement them:

• Algernon — fan-out planning/dispatch to cheap parallel workers on your key (or a free local Ollama, auto-detected since 0.2.2)

• ArkHive — hosted, tamper-evident audit/memory chain

• a local covenant chamber (Humane Intelligence, or the bundled arkhive-mcp package when Humane is not installed)

The first minute

Everything below was run, not written, against a clean pip install sentarion-mcp (2026-09-10).

you      > sentarion_birth(name="ember", covenant=["truth over comfort"])
sentarion> born_on: ["humane", "arkhive"]        # your local chain AND the hosted one; act as actor="ember"
you      > remember(actor="ember", action="decided: ship the 27-tool surface", data={"why": "87 was the tax"})
sentarion> humane:  immutably recorded · arkhive: immutably recorded
you      > verify()
sentarion> humane:  INTACT — context provably unbroken
           arkhive: INTACT — context provably unbroken

Now play the villain. Open ~/.sentarion/local_chamber.db and change one word of that record by hand (update blocks set action = replace(action, 'ship', 'cancel') where idx = 0). Then:

you      > verify()
sentarion> humane:  TAMPERED — 1 broken links

And the gate, with nothing configured:

you      > govern(action="delete the production database")
sentarion> block — Veto: irreversible -> refuse          (inferred_flags: ["irreversible"])
you      > govern(action="email all 4,000 customers a discount code")
sentarion> block — Veto: external_send -> refuse
you      > govern(action="write a summary file")
sentarion> approve

That is the whole idea. Your AI writes down what it did, reads it back next session, and a silent rewrite fails verification. Every record is hash-chained to the one before it; the hosted copy is a second witness. govern reads the obvious risks off the action text (delete / drop / force-push, send to everyone, pay, deploy to production), blocks them by default and fails closed when no chamber answers; orchestrate_and_record asks it first, fans work out to cheap workers and puts the receipt on the same chain.

Related MCP server: Astatide Conductor

Install

pip install sentarion-mcp

Then, from any MCP client, run sentarion_doctor. It checks git, Algernon, the local chamber, hosted ArkHive, the fleet provider, Ollama and your API key, reports ready: true when a run will work, and lists one fix per missing piece. It never prints a secret.

The seatbelt — hooks, not hope

An MCP tool only helps when the model decides to call it. sentarion seatbelt wires Claude Code (and Cursor, beta) hooks that run on every tool call whether the model remembers or not, using the same gate vocabulary and the same local chain as the server:

sentarion seatbelt install --client claude        # hooks + the sentarion MCP server + baseline policy
sentarion seatbelt check --command "rm -rf build"  # → ask (baseline) — what would the gate say?
sentarion seatbelt doctor                          # what is wired, the policies, and a live self-test
sentarion seatbelt recall                          # the project brief the next session will open with

Which chain. With arkhive-mcp >= 2 installed next to the seatbelt (the Sentarion v2 line), the hooks write to the same file and space the v2 server uses (~/.arkhive/v2/chain.db, space sentarion), tagged seatbelt, signed by the same key: the server's recall / verify see them and the brief reads back what the model itself remembered (the v2 server signs every record as its runtime seat and refuses any other actor, so the brief tells the model to pass the tag, not an actor). With arkhive-mcp 0.x the hooks use ~/.sentarion/local_chamber.db. ARKHIVE_DB overrides either; sentarion seatbelt doctor reports chain.mode (v2 / legacy). History left in the 0.x chamber is still read into the brief after a move; nothing is migrated or rewritten.

Policies are plain JSON (decision, tools, match, paths, content_match, reason; see seatbelt.POLICY_SCHEMA). The baseline asks before the irreversible verbs. The packaged version with five policies, three skills and one-click installers is the Claude Code Seatbelt Kit.

Quick start

Claude Code (examples/claude_code/)

claude mcp add sentarion -- sentarion

or in .mcp.json:

{ "mcpServers": { "sentarion": { "command": "sentarion", "args": [] } } }

Codex (examples/codex/) — in ~/.codex/config.toml:

[mcp_servers.sentarion]
command = "sentarion"
args = []

Cursor (examples/cursor/) — in .cursor/mcp.json:

{ "mcpServers": { "sentarion": { "command": "sentarion", "args": [] } } }

Provider keys come from your environment: set ANTHROPIC_API_KEY (or OPENAI_API_KEY), or leave both out and the fleet runs on your local Ollama if one is running (examples/ollama/). Then say: "Use sentarion: run sentarion_doctor, birth yourself as Scout, then orchestrate_and_record a plan for X with k=3."

Tools

Governance — real, wired, fail-closed

Two governors, one decision rule: a rendered veto blocks; a chamber that fails to answer never manufactures a veto; if no chamber renders a verdict, the action is blocked. Every tool that executes work or mutates state (orchestrate_and_record, dispatch_with_dependencies, worktree create/remove) passes the gate first.

Examples

• examples/README.md — index

• examples/claude_code/ — register in Claude Code and walk six prompts

• examples/codex/ — the same from the Codex CLI

• examples/cursor/ — register in Cursor

• examples/ollama/ — run the fleet on a local Ollama for free

• examples/multi_agent/ — dispatch_example.py (dependency waves with {{id}} data flow) and the Claude-plans / Codex-builds loop

• examples/worktree/ — worktree_example.py (create / list / remove through the server)

Free vs v2

Join v2 early access

Trial key + pricing: https://inboxaxe.com/mcp — or, from any client that has Sentarion loaded, call sentarion_pro(email="you@company.com") and a 14-day v2 key is requested for that address. Nothing is sent unless you supply an email.

Changelog

0.4.0

• sentarion seatbelt: Claude Code / Cursor hooks (PreToolUse gate, PostToolUse memory, SessionStart brief, Stop gate), JSON policy files with a built-in baseline, install/uninstall/doctor/check/recall/policies CLI, 37 tests. Nothing in the MCP surface changed.

0.3.1

• sentarion_birth bears the identity on both chains and returns actor (your birth name, which resolves on each chain). Before, birth landed on the local chamber only, so a stranger's very first hosted remember was refused as "not a born soul".

• A chamber that cannot answer (for example a chain file written by ArkHive 2.x) is now a readable {error, fix} in the birth reply instead of an "unhandled errors in a TaskGroup" crash.

• govern infers the obvious risk flags from the action text (irreversible, external_send, financial - the same names v2 uses) and refuses them by default, on both chambers. Before, govern("delete the production database") was approved, and so was the same call with flags=["irreversible"], because no default rule named those triggers.

• README leads with the first minute, measured.

0.3.0

• Server instructions. The MCP initialize response now carries usage guidance (birth first, govern before acting, never invent results, {{id}} data flow, free vs paid).

• sentarion_doctor. Read-only health check of git, Algernon, the local chamber, hosted ArkHive, fleet provider, Ollama and API key, with one fix per failing check; never prints secrets.

• sentarion_quickstart. Six canonical, runnable example calls, one per capability.

• Run summary. orchestrate_and_record returns a run block with run_id and timing, a tasks/succeeded/failed summary, and a memory outcome per chain (recorded, not_configured, or error: <type>) instead of swallowing write failures.

• Contextual sentarion_pro. Optional topic (worktree, dispatch, govern, memory, review, jobs) returns what v2 adds to the capability you are using; the no-argument and email paths are unchanged.

• examples/. Claude Code, Codex, Cursor, Ollama, multi-agent dispatch and worktree examples, plus the Claude-plans / Codex-builds workflow.

• Tests + CI. tests/ with pytest; a GitHub Actions job runs them on Python 3.10 and 3.12 and fails on version drift.

• Birth fallback fix. The ArkHive birth fallback no longer raises NameError (tool_text was not imported).

• Version unification. pyproject.toml, sentarion_mcp.__version__ and server.json now agree; built wheels are no longer tracked.

0.2.2 — what changed (found by dogfooding)

• Fleet config is explicit. 0.2.1 passed the whole ambient environment to Algernon, so a stale OPENAI_API_KEY in your shell could silently override your Ollama setup (401). Now SENTARION_FLEET_PROVIDER=anthropic|openai|ollama wins, else a set key, else a local Ollama.

• Local chamber always exists. Without Humane installed, the bundled arkhive-mcp package is the local chamber (own chain at ~/.sentarion/local_chamber.db). "humane_not_configured" is gone.

• Dependencies carry data. {{t1}} in a dependent prompt is replaced with task t1's result.

• Hosted birth works (the hosted 0.x server typed covenant as a string; we retry with one).

• recall_and_replan no longer sends an argument the hosted recall never accepted.

• Removed the unused mcp-agent dependency; added project URLs.

Support this project

Sentarion, Algernon and ArkHive are free, open source, and built on our own hardware. Donate: https://dondatabrain.com · Business suite: https://inboxaxe.com