Skip to main content
Glama
Sentinel Gateway

Sentinel Gateway

by jaisimha18

Sentinel Gateway โ€” an MCP zero-trust gateway

MCP zero-trust gateway that sits in front of every internal MCP server, detects tool-poisoning/metadata drift in real time, and maintains a cryptographic provenance ledger of every agent tool call.

Model Context Protocol Built with Nitrostack Status

Sentinel Gateway โ€” an MCP zero-trust gateway is an MCP (Model Context Protocol) server that extends AI assistants โ€” like Claude, Cursor, and any MCP-compatible client โ€” with new, real-world capabilities. It is built and deployed on Nitrostack, the fastest way to build, deploy, and share MCP apps.

Table of Contents

Related MCP server: Proofpane

Overview

MCP zero-trust gateway that sits in front of every internal MCP server, detects tool-poisoning/metadata drift in real time, and maintains a cryptographic provenance ledger of every agent tool call.

What is MCP?

The Model Context Protocol (MCP) is an open standard that lets AI assistants securely connect to external tools, data sources, and services. Instead of being limited to what it was trained on, an AI model can call MCP servers to fetch live data, run actions, and integrate with real systems.

This project is one such MCP server. Learn more about building and shipping MCP apps at nitrostack.ai.

Features

  • ๐Ÿ”Œ MCP-native โ€” works with any MCP-compatible client (Claude, Cursor, and more)

  • ๐Ÿ›ก๏ธ Zero-Trust Policy Engine โ€” per-agent RBAC permission enforcement

  • ๐Ÿ” Tool Poisoning & Drift Detection โ€” cryptographic SHA-256 fingerprinting catches malicious description modifications

  • โšก Prompt Injection Scanner โ€” pattern-matching engine flags exfiltration directives (e.g. BCC directives)

  • ๐Ÿ“œ Cryptographic Provenance Ledger โ€” immutable SHA-256 hash-chained audit log

  • ๐Ÿ–ผ๏ธ 7 Interactive UI Widgets โ€” built with Next.js 14, React 18, and Tailwind CSS

  • โšก Deployed on Nitrostack โ€” reliable, hosted, and instantly shareable

  • ๐Ÿ” Secure by design โ€” secrets stay in environment variables, never in code

Getting Started

Prerequisites

  • Node.js 18+ (Node 20 recommended)

  • An MCP-compatible client (NitroStudio, Claude Desktop, Cursor, etc.)

Installation

git clone https://github.com/jaisimha18/nebula-ninjas.git
cd nebula-ninjas
npm install

Configuration

Copy the example environment file and add your own values:

cp .env.example .env

Run

npm run dev

For production build & start:

npm run build
npm start

Connect to an MCP Client

Add this server to your MCP client configuration. A typical entry looks like:

{
  "mcpServers": {
    "sentinel-gateway": {
      "command": "npx",
      "args": ["-y", "tsx", "src/index.ts"]
    }
  }
}

Restart your client and the tools from this MCP server will be available to your AI assistant.

Deploy Your Own MCP App

Want to build and ship an MCP server like this one? Nitrostack lets you create, deploy, and host MCP apps in minutes โ€” no infrastructure to manage.

๐Ÿ‘‰ Start building: https://nitrostack.ai

Explore More MCP Apps

  • ๐ŸŒ™ Discover and share MCP projects with the community on r/mcptothemoon

  • ๐Ÿงฐ Browse a growing catalog of MCP apps on Nitrostack

FAQ

What is an MCP server?

An MCP server implements the Model Context Protocol to expose tools, resources, and prompts that AI assistants can call. It lets an AI model take real actions and access live data.

What does Sentinel Gateway do?

Sentinel Gateway sits in front of internal MCP servers to detect tool poisoning, prompt injections, and metadata drift in real time, logging every call to a cryptographic provenance ledger.

Which AI clients does this work with?

Any MCP-compatible client, including NitroStudio, Claude Desktop, and Cursor.

How do I deploy my own MCP app?

Use Nitrostack to build, deploy, and host MCP apps without managing infrastructure.

Keywords

Enterprise AI & Workplace Automation ยท Sentinel Gateway โ€” an MCP zero-trust gateway ยท MCP ยท Model Context Protocol ยท MCP server ยท MCP app ยท AI security ยท Tool Poisoning ยท Zero Trust ยท Provenance Ledger ยท Nitrostack ยท deploy MCP server ยท build MCP app

License

MIT ยฉ 2026


Built with โค๏ธ using the Model Context Protocol on Nitrostack. Share your MCP app on r/mcptothemoon.

Available Tools

20 tools
sentinel_add_policy_ruleB

Grant an agent access to a specific tool on a specific server. Use toolName="*" to grant access to all tools on that server.

Inputs: agentId (required), toolName (required), serverName (required), maxAmount.

sentinel_approve_reviewB

Approve a review item. For drift detections, this re-pins the tool fingerprint with the new description. For injection flags, this allows the call to proceed.

Inputs: itemId (required).

sentinel_call_toolB

Route a tool call through Sentinel Gateway's security pipeline. The gateway verifies tool integrity (fingerprint check), enforces RBAC policy, logs to the provenance ledger, and only then forwards the call to the downstream MCP server.

Inputs: agentId (required), toolName (required), serverName (required), args.

sentinel_check_agent_accessB

Test whether a specific agent is allowed to call a specific tool. Returns the policy decision and reason.

Inputs: agentId (required), toolName (required), serverName (required).

sentinel_deny_reviewA

Deny a review item. The block remains active โ€” the flagged tool/call stays blocked.

Inputs: itemId (required).

sentinel_get_call_historyB

Get recent tool call history through the gateway, with status and timing information.

Inputs: limit, agentId.

sentinel_get_dashboard_statsB

Get summary statistics for the Sentinel Gateway dashboard โ€” total calls, blocks, drift detections, chain status.

Inputs: no named parameters.

sentinel_get_review_queueA

Get all items in the human review queue. Shows pending drift detections, injection flags, and policy violations that need human approval.

Inputs: status.

sentinel_list_policy_rulesB

List all RBAC policy rules. Optionally filter by agent ID.

Inputs: agentId.

sentinel_list_serversB

List all registered downstream MCP servers and their connection status.

Inputs: no named parameters.

sentinel_list_toolsB

List all discovered tools across all registered servers, with their fingerprint status and trust level.

Inputs: serverName.

sentinel_query_ledgerB

Search and filter the provenance ledger. Returns cryptographically linked entries with hash-chain validation.

Inputs: limit, status, agentId, serverName.

sentinel_register_serverB

Register a new downstream MCP server with Sentinel Gateway. The gateway will discover all tools, fingerprint their descriptions, and begin monitoring for drift.

Inputs: url (required), name (required).

sentinel_remove_policy_ruleA

Revoke an agent's access to a specific tool.

Inputs: agentId (required), toolName (required), serverName (required).

sentinel_reset_demoA

Reset all mock servers to their original, clean state after running attack simulations.

Inputs: no named parameters.

sentinel_run_attackC

Run a simulated attack scenario to demonstrate Sentinel Gateway's security capabilities. Scenarios: tool_poisoning (rewrites a tool description), rbac_violation (unauthorized agent call), ledger_tampering (modifies a ledger entry), description_injection (hidden instructions in tool description).

Inputs: scenario (required).

sentinel_run_full_demoB

Run the complete demo sequence: setup servers โ†’ configure policies โ†’ normal traffic โ†’ tool poisoning attack โ†’ RBAC violation. Shows the full security pipeline in action.

Inputs: no named parameters.

sentinel_setup_demoA

Quick setup: Register all 3 demo mock servers (filesystem, CRM, email) with the gateway in one step. Useful for demo initialization.

Inputs: no named parameters.

sentinel_setup_demo_policiesA

Quick setup: Create demo RBAC policies for demonstration. Grants "sales-bot" access to CRM and email, "data-analyst" access to filesystem, and leaves "rogue-agent" with no access.

Inputs: no named parameters.

sentinel_verify_chain_integrityA

Verify the cryptographic integrity of the entire provenance ledger. Each entry is hash-chained to the previous one โ€” if any entry has been tampered with, this check will detect it.

Inputs: no named parameters.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelogโ€ฆ

    TDQS

    B3.4/5.0

    Scored across 20 tools

    Disambiguation4/5

    Tools are largely distinct, each targeting a specific operation: registration, RBAC policies, ledger queries, review queue, demo setup, attacks. However, sentinel_call_tool, sentinel_get_call_history, and sentinel_run_full_demo have some conceptual overlap (all involve executing calls), and the demo/attack/reset tools blur boundaries for agents trying to pick between setup, run, and attack flows.

    Naming Consistency4/5

    All tools follow a consistent sentinel_[verb]_[noun] pattern with snake_case throughout, which is excellent. Minor inconsistency exists with get_dashboard_stats vs get_call_history (both use 'get') and the setup tools using 'setup' vs 'run' verbs that could be more uniform, but the pattern is strongly predictable overall.

    Tool Count3/5

    At 20 tools, this sits at the upper edge of the acceptable range. The core security pipeline (register, list, policy, call, ledger, review) is about 12 tools, but the demo helpers (setup_demo, setup_demo_policies, run_full_demo, reset_demo, run_attack) add 5 tools that are more for demonstration than real operation, inflating the count beyond what a production gateway would need.

    Completeness4/5

    The surface covers the full security workflow: server registration, RBAC management, call routing, ledger querying/integrity, review queue with approve/deny, and attack simulation. Minor gaps include no tool to unregister/remove a server, and no tool to view all agents' detailed permissions in one place, but the core lifecycle is largely complete.

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      C
      maintenance
      A zero-trust security gateway for MCP tool calls, inspecting tool identity, arguments, execution decisions, and returned content before risk reaches your coding agent.
      Apache 2.0
    • A
      license
      B
      quality
      B
      maintenance
      A governance proxy for AI tools โ€” every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.
      13
      MIT
    • A
      license
      Not graded
      quality
      D
      maintenance
      Governed MCP gateway that lets AI agents call tools with policy enforcement, prompt-injection screening, a kill-switch, and tamper-evident signed audit logs.
      Apache 2.0
    • A
      license
      Not graded
      quality
      C
      maintenance
      Enables AI agents to reach upstream MCP tool servers through a central policy gateway that authenticates each agent, enforces least-privilege and default-deny rules, and applies response obligations such as redaction, inference stripping, PII masking, and truncation. It also records every decision in a tamper-evident, hash-chained audit log that can be verified later.
      Apache 2.0