Sentinel Scan

What the Sentinel Scan MCP server does

The Sentinel Scan MCP server provides local security analysis for MCP tool manifests and server configuration data. Its checks cover ten OWASP-mapped heuristic categories, including prompt injection in tool descriptions, tool-name shadowing, excessive-agency schema patterns, indirect-injection exposure, remote or unpinned sources, embedded credentials, wildcard permissions, absent provenance metadata, missing confirmation steps, and hidden Unicode or ASCII-smuggling instructions.

The scanner is intended for static review. It does not need an API key, account, telemetry service, or connection to Ventrova. The repository describes the MCP mode as an alternative to invoking the command-line scanner directly.

How it works

The Sentinel Scan MCP server receives manifest or configuration content through MCP and applies local rules to it. Findings are associated with OWASP LLM Top 10 and OWASP MCP Top 10 categories, giving reviewers a recognizable classification for issues found in the input.

The broader CLI package also contains a 15-attack prompt-injection and jailbreak suite. That suite targets an OpenAI-compatible chat-completions endpoint and is separate from the offline manifest checks: when used against a live endpoint, the machine communicates directly with that endpoint. The suite can test techniques such as direct overrides, roleplay attacks, prompt leakage, indirect tool-output injection, encoding tricks, and format-string exfiltration.

Setup and configuration

{
  "mcpServers": {
    "sentinel-scan": {
      "command": "npx",
      "args": ["-y", "sentinel-scan-cli", "mcp-server"]
    }
  }
}

That configuration can be added to an MCP client such as Claude Desktop or Cursor. The package also documents a Python installation through pipx, pip, or pipx run, plus a Node.js installation through npx or npm. Python 3.8 or newer is required for the documented Python usage, and the Python package has no dependencies.

Tools and capabilities

The MCP listing exposes the ruleId tool. The README identifies the manifest-scanning MCP operation as scan_mcp_manifest, which clients can call from the configured server. The CLI and MCP package are designed around manifest analysis rather than network-based vulnerability lookup.

For command-line endpoint testing, results can be written as JSON, including per-attack verdicts, response previews, token information, latency statistics, and OWASP classifications. A supplied marker can be checked for literal disclosure, while a refusal-language heuristic provides a second signal.

Limitations and notes

Manifest findings are heuristic results, not a complete security audit. The prompt-injection suite can produce false positives when a model refuses without using its expected refusal phrases, and false negatives when information is disclosed without the exact marker supplied to the scanner.

The --demo mode uses a built-in target and makes no network calls. Testing a user-supplied endpoint is different: it sends requests from the local machine to that endpoint.