Project Sentinel

Trust scores and signed certificates for MCP servers.

Every MCP server gets a trust score (0–100), a signed trust certificate, and a gateway that won't route traffic unless the certificate passes. Like SSL certificates created trust on the web — Sentinel creates trust for AI agent packages.

npx @sentinel-atl/scanner scan @modelcontextprotocol/server-filesystem

�️  Trust Score: 82/100 (Grade: B)
   Dependencies:  ✅ No known vulnerabilities
   Code Patterns: ⚠️  1 high (child_process usage)
   AST Analysis:  ✅ No obfuscation detected
   Permissions:   ✅ filesystem, network
   Publisher:     ✅ Verified on npm (2 years, 50K downloads/week)
   Poisoning:     ✅ No injection in tool descriptions
   Shadowing:     ✅ No tool name conflicts
   Toxic Flows:   ✅ No dangerous data paths

npm Tests License TypeScript Python

How it works: scan → certify → enforce

1. Scan — one command, 11 layers of analysis:

Auto-discover — scan every MCP server on your machine in one shot:

npx @sentinel-atl/cli discover --scan

🔍 Found 5 MCP server(s) across 3 configs

  🟤 Claude Desktop (2)
    filesystem: npx -y @modelcontextprotocol/server-filesystem /Users/me/Desktop
    github: npx -y @modelcontextprotocol/server-github

  🔵 Cursor (2)
    postgres: npx -y @modelcontextprotocol/server-postgres
    brave-search: npx -y @modelcontextprotocol/server-brave-search

  🟣 VS Code (1)
    everything: npx -y @modelcontextprotocol/server-everything

🛡️  Probing discovered servers...
  ✓ filesystem: 11 tools, no issues
  ⚠ postgres: 3 tool(s) with toxic data flows (query → send_webhook)

2. Certify — sign the scan results into a portable, Ed25519-signed trust certificate:

import { scan, issueSTC } from '@sentinel-atl/scanner';

const report = await scan({ packageName: 'some-mcp-server' });
const stc = await issueSTC({ issuer, subject, findings: report.findings });
// STC = Sentinel Trust Certificate — signed, verifiable, publishable

Publish certificates to a trust registry. Add badges to your README:

![Trust Score](http://registry.example.com/api/v1/packages/my-server/badge)

3. Enforce — the gateway only routes to certified, high-score servers:

# sentinel.yaml
gateway:
  mode: strict
  minTrustScore: 70

servers:
  - name: filesystem
    upstream: stdio://node ./fs-server.js
    trust:
      requireCertificate: true
      maxFindingsCritical: 0
    blockedTools: [delete_file]

npx sentinel-gateway --config sentinel.yaml

No certificate? Gateway rejects it. Score below threshold? Rejected. Critical findings? Rejected. This isn't scanning and hoping — it's enforcement.

Under the hood: agent identity layer

The scanner and gateway are the entry point. Underneath, Sentinel has a full cryptographic identity system for AI agents — for when you need to go beyond scanning:

import { createTrustedAgent } from '@sentinel-atl/sdk';

const agent = await createTrustedAgent({
  name: 'my-agent',
  capabilities: ['search', 'book'],
  enableSafety: true,
});

console.log(agent.did);  // did:key:z6Mk...

1️⃣  Alice → Init (nonce + DID + passport)
2️⃣  Bob → Response (nonce + DID)
3️⃣  Alice → VC Exchange → Bob verifies: ✅
4️⃣  Bob → VC Exchange → Alice verifies: ✅
🔐 Session established.

npx create-sentinel-app demo --template two-agent-handshake

Human → credential (scope: travel:search, travel:book)
  └─→ Agent A → delegates to Agent B (scope narrows: travel:search only)
        └─→ Agent B → calls search_flights()
              └─→ Intent Envelope: signed chain proves Human → A → B, scope ✅

await revMgr.killSwitch(principalKey, keyId, principalDid, compromisedDid, 'breach', { cascade: true });

const check = await agent.checkSafety('Ignore previous instructions...');
// { safe: false, blocked: true, violations: [{ category: 'prompt_injection' }] }

Packages

Scanning & enforcement (start here):

Install

# Scanner (zero config, works immediately)
npx @sentinel-atl/scanner scan <package-name>

# Full SDK
npm install @sentinel-atl/scanner @sentinel-atl/trust-gateway  # scanning + enforcement
npm install @sentinel-atl/core @sentinel-atl/sdk                # identity layer
pip install sentinel-atl                                         # Python

Production deployment

docker compose up -d  # Server + MCP Proxy + Approval UI + Redis

See the Operations Guide for scaling, monitoring, and hardening details.

Open protocol

Sentinel implements the Sentinel Trust Protocol (STP) v1.0 — an open specification, not a product. Test any implementation:

STP_SERVER_URL=http://localhost:3000 npx @sentinel-atl/conformance

Contributing

git clone https://github.com/sentinel-atl/project-sentinel.git
cd project-sentinel && npm install && npm run build && npm test
# 592 tests across 33 packages

See CONTRIBUTING.md.

License

Apache License 2.0