A signed audit trail
+Every decision is appended to an HMAC-chained ledger with sequence numbers and a signed head, so edits, deletions and truncation are all detected. Secrets are redacted before anything is written.
+🛡️ SentinelAgent
-A deny-by-default security gateway for AI agents. It checks tool calls going out, guards tool
- output coming back, and holds risky calls for a human. This page runs the real sentinel package
- from main in your browser with Pyodide. No server, nothing leaves the page.
- GitHub - PyPI - Architecture - Benchmarks -
-Loading the Python runtime…
-
- Try the gateway
-Pick an attack or benign call from the evaluation corpus, or write your own.
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
-
-
+
-
-
+
+ Open-source agent security
+
+
+ Guard your agents’ tool calls.
+A deny-by-default gateway for AI agents. Risky calls wait for a human, and untrusted tool output is tracked.
+
+ Run the agents
+ GitHub
- The decision will appear here.
+
+
+
+
+
+ Inspect a tool call
+ Starting Python in your browser
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ pip install sentinel-agent-gateway
+ Python 3.10+. Import name sentinel.
+
+ Checks both directions of every call.
+Attacks on agents arrive in what tools return, not just in what the agent asks to do. Sentinel covers both, then asks a person.
+
+
+
+
+
+
Calls going out
+Arguments are normalised, then scored by pluggable detectors. Shell is parsed into argv, so rm -r -f / is caught under any tool name. URL hosts are parsed as IP addresses, so decimal, hex and IPv6 forms can't slip past the SSRF check.
The policy can only make a decision stricter. Unknown tools wait for approval by default.
+unknown_tool_action: "REQUIRE_APPROVAL"
+aggregation: "noisy_or"
+taint_sinks:
+ send_email: "high"
+ execute_bash: "high"
+
+
Output coming back
+Web pages, emails and files are fenced as untrusted data and fingerprinted. If that text reaches a high-risk tool later in the session, a human decides.
+
+
One call, one approval
+An approval is an HMAC token bound to a digest of the exact arguments. It expires, works once, and fails if anything changed while you were deciding.
+
+
+
+
+
Multi-agent demo
-A researcher agent and a mailer agent summarise a release-notes page that contains a hidden - instruction to email the customer list to an outside address. A reviewer agent screens every held call and - can only reject or escalate. The model turns are scripted here, and the researcher is written to fall for the - injection. Everything else (gateway, taint tracking, approvals, audit ledger) is the real code. Escalations are - auto-approved as the human.
- - +Three agents, one gateway.
+They summarise a release-notes page with a hidden instruction to email the customer list out. Model turns are scripted here; the gateway is the real code.
+
+
+
+
+
+ Researcherfetch_url, read_file
Mailersend_email
Reviewercan reject or escalate, never approve
+
+
+
+ Task: research the Q3 notes, email team@example.com a summary
+
+
+ Press run to watch the agents work. A person approves what the reviewer escalates; here that step is automatic.
Evaluation
-Runs sentinel eval on the bundled corpora: attacks and benign calls under the default policy.
Measured, not claimed.
+Computed just now in this tab from the bundled corpus of attack and benign tool calls, under the default policy.
+
+
+
+
+
+
+ …
of attacks flagged
…
stopped on detector evidence alone
…
stopped under the default policy
…
false positives on benign calls
The corpus is small and hand-written, so treat these as regression numbers. Known misses and method.