SentinelAgent Guard — Enterprise MCP & AI-Agent Security Firewall
SentinelAgent Guard: Protocol-Native MCP Security Firewall
SentinelAgent Guard (developed under the SentinelReign parent technology organization by Syed Zada Abrar) is the world's first protocol-native security firewall for Model Context Protocol (MCP) servers and autonomous AI agent workloads.
While traditional Web Application Firewalls (WAFs) and LLM prompt filters inspect text strings, SentinelAgent Guard sits directly in front of your MCP servers or inside your application process to enforce 22 deterministic security checks across 5 layers with $0 AI token cost and sub-millisecond execution.
Two Distinct Deployment Flavors
⚡ Flavor A: Hosted Cloud Proxy Firewall
- Target Audience: Startups and mid-market teams desiring instant, 0-code setup.
- Endpoint:
POST https://guard.sentinelreign.com/<org>/mcp - How it works: Route your AI agent's tool calls through our protected cloud proxy. Enforces Bearer token auth, parameter injection sanitization (
/etc/passwd, command injection, SQLi, traversal), leaky-bucket rate limiting, and audit logging.
🛡️ Flavor B: Embedded Enterprise 0ms RAM SDK (@sentinelreign/guard)
- Target Audience: Regulated enterprise buyers (e.g. Semrush, Cloudflare, Stripe) and software vendors.
- npm Package:
npm install @sentinelreign/guard - How it works: Runs 100% locally in your server's RAM. Evaluates rules on your local CPU with 0ms network overhead. On startup, the SDK executes a boot-up handshake with
https://sentinelreign.com/api/v1/license/validate, caching signed CISO rules in local RAM and issuing a 5-minute background heartbeat sync.
3 Lines of Code Integration
import { SentinelGuard } from '@sentinelreign/guard';
// 1. Initialize SDK with your Enterprise License Key
const guard = new SentinelGuard({
licenseKey: process.env.SENTINEL_LICENSE_KEY,
serverId: 'production-mcp-node'
});
// 2. Evaluate incoming AI agent request in local RAM (0ms latency!)
const result = await guard.verifyRequest({ headers: req.headers, body: req.body });
// 3. Intercept and block malicious tool calls before execution
if (!result.allowed) {
return res.status(403).json({ error: result.reason });
}5-Layer Detection Core (22 Checks)
| Layer | Domain | Attack Vector Caught | Latency |
|---|---|---|---|
| Layer 0 | Protocol Conformance | JSON-RPC envelope mismatch, header spoofing | < 1 µs |
| Layer 1 | Tool Integrity | Rug pulls (CVE-2025-54136), Unicode TAG concealment, tool poisoning | ~ 2 µs |
| Layer 2 | Call-Time Policy | Parameter injection (/etc/passwd), path traversal, schema validation | ~ 2 µs |
| Layer 3 | Response Inspection | Egress DLP secret leaks (AWS keys, JWTs, private keys) | ~ 1.5 µs |
| Layer 4 | Tamper-Evident Audit | Cryptographic SHA-256 hash-chained log audit trail | < 1 µs |