A signed audit trail
Every decision is appended to an HMAC-chained ledger with sequence numbers and a signed head, so edits, deletions and truncation are all detected. Secrets are redacted before anything is written.
Open-source agent security
Guard your agents’ tool calls.
A deny-by-default gateway for AI agents. Risky calls wait for a human, and untrusted tool output is tracked.
Inspect a tool call
Starting Python in your browser
pip install sentinel-agent-gateway
Python 3.10+. Import name sentinel.
Checks both directions of every call.
Attacks on agents arrive in what tools return, not just in what the agent asks to do. Sentinel covers both, then asks a person.
Calls going out
Arguments are normalised, then scored by pluggable detectors. Shell is parsed into argv, so rm -r -f / is caught under any tool name. URL hosts are parsed as IP addresses, so decimal, hex and IPv6 forms can't slip past the SSRF check.
The policy can only make a decision stricter. Unknown tools wait for approval by default.
unknown_tool_action: "REQUIRE_APPROVAL"
aggregation: "noisy_or"
taint_sinks:
send_email: "high"
execute_bash: "high"
Output coming back
Web pages, emails and files are fenced as untrusted data and fingerprinted. If that text reaches a high-risk tool later in the session, a human decides.
One call, one approval
An approval is an HMAC token bound to a digest of the exact arguments. It expires, works once, and fails if anything changed while you were deciding.
Three agents, one gateway.
They summarise a release-notes page with a hidden instruction to email the customer list out. Model turns are scripted here; the gateway is the real code.
Researcherfetch_url, read_file
Mailersend_email
Reviewercan reject or escalate, never approve
Task: research the Q3 notes, email team@example.com a summary
Press run to watch the agents work. A person approves what the reviewer escalates; here that step is automatic.
Measured, not claimed.
Computed just now in this tab from the bundled corpus of attack and benign tool calls, under the default policy.
…
of attacks flagged
…
stopped on detector evidence alone
…
stopped under the default policy
…
false positives on benign calls
The corpus is small and hand-written, so treat these as regression numbers. Known misses and method.