The MCP gateway your AI agents already wish they had.
Drop the SDK in. Sentinel becomes the single chokepoint for every tool call, authenticating the caller, matching policy, injecting credentials, and writing an complete audit trail. Deny-by-default, minimal overhead in line.
Five stages. All inline. All audited.
Every mcp.call() your agent makes lands here first. Sentinel runs the pipeline and either forwards, rewrites, or refuses, never silently.
Everything you'd expect from a gateway, Nothing you'd have to write yourself.
Six primitives, every one auditable. Composed in a dashboard, enforced at the SDK, observed from Lens.
Policy engine
Deny-by-default. First-match-wins. Glob patterns on tool names & models. Four actions: allow, deny, alert, redact.
Content Guard
PII regex patterns and keyword blocklists scan tool args and LLM prompts pre-flight. Optional response inspection. Match → deny or redact.
Token Guard & rate limits
Cap input, output, and combined tokens per request. Sliding windows across three dimensions (requests, tokens, dollars) per minute, hour, or day.
Session control & kill switch
Track agent sessions through active, suspended, completed. Suspend any session, user, or tenant in one click, manually or auto-fired by anomaly detectors.
Anomaly detection
Rolling EWMA baselines flag volume spikes, never-before-seen tools, and sequence deviations. LLM side tracks cost burn, token burn, response length, model shift, error rate.
Alerts & audit fan-out
Async dispatch to Slack, Discord, and the tamper-evident audit log. Ingest external sources too (Portkey, Helicone, Cloudflare AI Gateway) into one trail.
Compose policy in a form. Enforce it in microseconds.
Glob patterns on tool and model names. Conditions on metadata with eq / neq / in / nin. No DSL, no YAML.
New policy rule
Composing into org:acme · production.
| Target | Pattern | Condition | Action |
|---|---|---|---|
| mcp.tool | repo.read | role eq "developer" | ALLOW |
| mcp.tool | delete_* | role nin ["admin"] | DENY |
| llm.model | gpt-4* | tokens.in ≤ 4096 | ALLOW |
| llm.endpoint | chat.completions | PII pattern match | REDACT |
| mcp.tool | stripe.charge.* | amount > $50 | ALERT |
| mcp.tool | repo.write | department in ["eng","sec"] | ALLOW |
| llm.endpoint | embeddings | $25 / hr cap | ALLOW |
| mcp.tool | * | — (catch-all) | DENY |
One vault upstream. One SDK call downstream.
Real credentials never reach your agent. They never reach your logs. They stay in the vault. Sentinel injects them on the wire and writes back the audit record.
// 1. Install · then add three lines to your agent. import { Igris } from "@igris-security/sdk"; const igris = new Igris({ apiKey: process.env.IGRIS_API_KEY }); // 2. Open a governed MCP connection for the current user. const mcp = await igris.connectStdio("github-prod", { user: "alice@acme.com", metadata: { role: "developer", tenant: "acme" }, }); // 3. Every tool call is now governed. await mcp.call("repo.read", { repo: "acme/api" }); // → ✓ allow · 0.4ms · audited await mcp.call("repo.delete", { repo: "acme/api" }); // → ✗ deny · role !∈ {admin}
Also available for Python, Go, and any HTTP runtime via the REST API. The SDK is open-core under Apache-2.0.
The boring kind. The kind that doesn't make the postmortem.
Agent attempts to drop a production database
A coding assistant with an off-by-one prompt called postgres.exec("DROP TABLE users") against the prod connection. Role lacked ddl:* scope.
Agent issues a refund $40 above policy cap
Support bot tried to refund $90 on a ticket. Policy capped autonomous refunds at $50. Sentinel routed to CONFIRM, an on-call human approved in Slack, ticket closed in 4 minutes.
GitHub token rotated mid-flight, zero downtime
Scheduled rotation of the github-prod connection. 1,247 in-flight calls held for 38ms, drained to the new credential. No agent code changed.
Questions, answered.
Stop trusting your agent to do the right thing.
Sentinel makes "the right thing" the only thing it can do. Three lines to install, deny-by-default from minute one.
- Deny-by-default from the first deploy
- Minimal in-line gateway overhead
- AES-256-GCM credential vault, HSM-backed
- Complete audit streamed to Lens & your SIEM