mcp-sentinel is a security control layer placed in front of MCP, the standard protocol through which agents communicate with external tools. The repository description states that it verifies the user, the agent, the server, and the tool individually to enforce RBAC and least privilege, and that it detects dangerous tool call sequences and prompt injection. The October 15, 2026 06:07 UTC commit 17ebf36 is this repository's very first commit, adding 32,050 lines all at once, with no deleted lines.
The scope shown by this commit is clear. .env.example binds the gateway to 127.0.0.1:8443 and spells out the allowed hosts and CORS origins directly, and it splits the risk score thresholds into 40 (restrict), 60 (require MFA), and 80 (block). The same file also contains tool definition hash pinning, tool integrity checks at 15-second intervals, server discovery on a 60-second cycle, output DLP masking, an allowed egress domain list, and RS256-based JWT verification. The commit also brings in a React dashboard (dashboard/), with the Alerts, Approvals, Audit, Policy, Scanner, and Servers screens separated individually.
DEMO.md lays out, as an 18-minute script, the flow of attaching the official reference MCP servers behind Sentinel so that Claude sees only four meta tools. Registering a server attaches to each tool a safety verdict and a toxicity check, a classification (READ, WRITE, EXTERNAL_LOOKUP, and the like), and a vulnerability scan grade, and if Docker is up, all local tool calls are executed in a container first. DEMO.md writes that the filesystem, Fetch, and Memory servers all receive SAFE verdicts and grade A, but adds that those figures are the results of rehearsing the same script in advance, and that risk scores fluctuate by a few points depending on timing and history.
The judgment stops here. Since the commit is only the initial commit, there is no change history or release record, and the license, star count, and external evaluation results are not in the given material. DEMO.md states that running without Docker substitutes a process sandbox and operates without isolation, and warns that if Claude Desktop's built-in Filesystem extension is left enabled, files can be read bypassing Sentinel, so it should be turned off. The default authentication mode is also demo. No material verifying by a third party the claim of being a security control layer exists yet, so whether to actually use it in deployment is better decided after testing in the environment.