MCP Detection & Response

See every MCP server. Stop the rug-pull.

Sentinel is the local, open-source EDR for MCP servers. Discover what your AI agents can reach, fingerprint every tool surface, and catch poisoning, drift and dangerous scope combinations before they become an incident.

View on GitHub Download Quickstart

$ brew install MattJeff/sentinel/sentinel

100% local Read-only by default No account or telemetry

Reachability map monitoring

AI clients14

FingerprintSHA-256

CloudNone

Tool surface changed after approvalfilesystem-mcp · schema drift detected

High

Discovers across 14 AI clients Claude CodeClaude DesktopCursorWindsurfVS CodeCodexZed

One local command center

Your entire MCP surface, finally visible.

Inventory servers and tools, probe live traffic, resolve alerts, gate risky calls and map the blast radius — without sending your configs to a vendor cloud.

SENTINEL MCP · LOCAL monitoring

Sentinel MCP inventory showing detected MCP servers, transports and scopes

Know what is connectedSearch and filter every discovered server by transport, status, scope and capability.

mcp.jsonunreviewed

"mcpServers": {
  "filesystem": {
    "command": "npx",
    "args": ["-y", "@scope/server"]
  }
}

Code will execute with your agent's permissions.

The Shadow MCP problem

A config entry is executable infrastructure.

AI clients make MCP easy to add and hard to govern. A server can read files, touch databases and call the network — yet most teams cannot list what is connected, prove what was approved, or see when it changes.

Identity can be spoofed.

Typosquats and Unicode lookalikes impersonate trusted packages.

Tools can change silently.

A clean server today can expose a different surface tomorrow.

Safe permissions become dangerous together.

Untrusted input + private-data read + external write creates an exfiltration path.

MCPDR, not another one-shot scan

Find it. Baseline it. Defend it while it runs.

Sentinel joins discovery, deterministic fingerprinting and runtime response in one auditable local pipeline.

Persistent baseline

Catch the rug-pull

Canonical, sorted-key SHA-256 fingerprints capture the complete tool surface. Every later observation is diffed against what you actually approved.

Hybrid detection

Expose hidden instructions

40+ poisoning patterns, Unicode anti-smuggling, normalization, line-jumping and embedded YARA — with an optional local Ollama judge.

Before relay

Approve before run

Detection-only by default. Opt into enforcement to hold high-risk tool calls until an operator decides.

Session-aware

See the lethal trifecta

Correlate untrusted input, private-data reads and external writes across a session — not just one tool at a time.

Supply chain

Verify what will execute

Attest npm integrity, maintainers and pinned versions. Match known MCP CVEs from an embedded offline base.

Local client configsDiscovery across 14 AI clients

read

MCP probe & proxystdio + Streamable HTTP

observe

Detection engineFingerprint · diff · YARA · correlation

local

Local SQLite stateInventory, baselines, findings, history

private

Private by architecture

The control plane stays on your machine.

Sentinel does not need your MCP inventory, configs or tool descriptions in someone else's cloud. Outbound calls are off by default; the local database remains yours.

Zero accountNo sign-up to see your own surface.

Zero telemetryNo product analytics or inventory upload.

Read-only defaultBlocking and quarantine are explicit opt-ins.

Open & auditableRust core under the MIT license.

Built for the SOC, not a silo

Evidence your existing stack can use.

Route findings directly from the endpoint. Export open formats. Hand auditors an offline-verifiable, signed bundle instead of a screenshot.

SOC 2ISO 27001OWASP MCPSAFE-MCP

Splunk · ElasticNative endpoint-to-SIEM alert routing.

Syslog TLSRFC 5425 without a Sentinel cloud.

STIX · TAXIIPortable CTI bundles and collection push.

Ed25519 signedPDF + JSON audit evidence, verifiable offline.

Start with the machine in front of you

Turn Shadow MCP into an inventory.

Install in one line, run a local scan, and see what your agents can actually reach.

INSTALL

# macOS / Linux — Homebrew
brew install MattJeff/sentinel/sentinel
# or the one-liner:
curl -fsSL https://sentinelmcp.dev/install.sh | sh
sentinel scan # local, read-only

Windows & all platforms: download the binary (with SHA-256) from the latest release. From source: git clone & cargo install --path crates/sentinel-cli.

Download binaries Explore the repository

Honest answers

What Sentinel is — and isn't.

Security tools should be precise about their boundaries.

Does Sentinel execute MCP tools during a scan?

No. Active probing performs the MCP handshake and requests tools/list to capture the declared surface and input schemas. It does not invoke the tools it discovers.

Does this “solve” prompt injection?

No security product can honestly make that claim. Sentinel detects documented poisoning patterns, Unicode smuggling, line-jumping and YARA matches; it can optionally add a local LLM judge. The full detection matrix makes partial and uncovered areas explicit.

What leaves my machine?

By default, nothing. The outbound gate starts off. SIEM, TAXII, email, webhook, registry and threat-feed connections only run after an operator enables outbound calls.

Is blocking automatic?

No. Sentinel is advisory and read-only by default. Approve-before-run enforcement and quarantine are opt-in controls, so adding visibility does not silently break developer workflows.

Is the local product really free?

Yes. The current local tool, detectors, SIEM integrations, STIX/TAXII export and signed reports are MIT-licensed. The planned paid layer is for net-new team and fleet features, not a paywall around the local engine.