AI导哈

MCP安全网关

Sentinel 是一个 MCP 安全网关，拦截 AI 代理客户端与 MCP 服务器之间的 JSON-RPC 调用，执行工具/资源授权、高风险调用意图检查以及 PII 和机密信息编辑，适用于保护 AI 代理与 MCP 服务器通信安全。

  • by Damandeep02
  • Go
  • 本地部署
  • 更新于
在 GitHub 查看 Damandeep02/sentinel-mcp-gateway

使用说明

Sentinel

Sentinel is an MCP security gateway that intercepts JSON-RPC calls between an AI agent client and MCP servers.

It enforces:

  • tool/resource authorization
  • intent checks for high-risk tool calls
  • PII and secret redaction on both request params and response payloads

What is implemented

  • Protocol-aware interception for list_tools, call_tool, read_resource
  • Policy engine interface with:
    • in-memory rules (SENTINEL_POLICY_MODE=memory)
    • OpenFGA check adapter seam (SENTINEL_POLICY_MODE=openfga)
  • Intent validator interface with:
    • no-op validator
    • HTTP validator for a small external model
  • JSON redactor for emails, cards, tokens, secrets, and sensitive key names
  • Unit tests for tool filtering, policy denial, intent denial, and redaction

Project layout

cmd/sentinel/main.go
internal/proxy/gateway.go
internal/policy/*
internal/intent/*
internal/scrubber/*
internal/transport/upstream.go

Run

go run ./cmd/sentinel

Required environment variable:

  • SENTINEL_UPSTREAM_URL (example: http://localhost:9000/mcp)

Common configuration:

  • SENTINEL_LISTEN_ADDR default :8080
  • SENTINEL_POLICY_MODE default memory (memory or openfga)
  • SENTINEL_ALLOW_RULES memory rules format: user|agent|action|resource entries separated by commas
  • SENTINEL_HIGH_RISK_TOOLS comma-separated tool names
  • SENTINEL_INTENT_URL HTTP endpoint for intent validation
  • SENTINEL_INTENT_FAIL_CLOSED default true

OpenFGA options:

  • SENTINEL_OPENFGA_URL
  • SENTINEL_OPENFGA_STORE_ID
  • SENTINEL_OPENFGA_MODEL_ID

Example memory policy rules

Allow one agent to call only selected tools and read one resource namespace:

SENTINEL_ALLOW_RULES="*|finance-agent|call|tool:get_*,*|finance-agent|read|resource:ledger/*"

MCP endpoint

Send MCP JSON-RPC traffic to:

  • POST /mcp

Optional context headers:

  • X-User-Id
  • X-Agent-Id
  • X-Session-Id
  • X-Agent-Trace (reasoning trace passed into intent validation)

Test

go test ./...

Production hardening next

  • Add mTLS between Sentinel and MCP servers
  • Add authn for incoming agent clients (JWT/mTLS/API key)
  • Add decision caching with short TTL
  • Add structured logs + OpenTelemetry traces
  • Add circuit breakers for intent/OpenFGA dependencies
  • Add streaming redaction for large payloads

相关 MCP