A trust layer your agent calls before a response ships.
Sentinel is an MCP server that scores agent responses mid-turn. Not a dashboard someone checks after the damage is done. It catches fabricated citations and prompt-injection compliance before either reaches a user.
Confident cases resolve with zero model calls. Only the ambiguous middle escalates, the common case stays fast and auditable.
Most eval tooling scores transcripts after the fact. This scores the response before it goes out.
An agent or the orchestrator wrapping it calls a Sentinel tool with the response it's about to send, plus the context it was grounded in. Sentinel returns allow, warn, or block. It's a call in the request path, cheap enough in the common case not to be a UX problem.
A document that says "no section 9.2 exists" contains the literal substring "section 9.2." Sentinel scans for negation before it credits a citation — a claim that’s only ever negated counts as unresolved, same bucket as never appearing at all.
An injection attempt living in retrieved context is one signal. The agent’s response actually going along with it is another. Both firing together is a confident block with no judge call needed — either alone is ambiguous and escalates.
Start free. Pay when it's carrying real traffic.
The free tier is the actual product, not a crippled trial. Clone it, run it against your own agent, decide if the pattern fits before you owe anyone anything.
Full source, both metrics, offline judge. Everything you need to prove the pattern works before you commit to anything.
- flag_injection + check_groundedness, fully implemented
- stdio MCP server (Claude Desktop, Cursor, local dev)
- Offline judge stub — no API key needed
- Full test suite + typecheck
- In-memory policy registry
- Not licensed for production traffic
Everything you need to put Sentinel in front of real agent traffic, plus a worked example of extending it.
- Everything in Clone & Run
- License to run in production
- Streamable HTTP deploy target + auth pattern
- End-to-end HTTP smoke test
- Walkthrough: adding a third metric
- Email support for integration questions
The gaps that are genuinely specific to your environment, closed by hand instead of self-serve.
- Postgres-backed policy registry, built to your schema
- Real model-backed judge, wired to your provider
- A custom metric built to your actual failure modes
- Trust score calibration against your own incident data
- Architecture review of your agent/orchestrator setup
clone & run proves the pattern works on your own agent → production gets you shipped fast on your own infra → built for your stack closes what's genuinely yours to solve, not generic to productize.
If your agent touches contracts, customer data, or figures a person will act on without double-checking
it's not whether you need this layer. It's whether you find the gap from your own testing, or from your customer's lawyer.