# SENTINEL — agent digest > Autonomous supply-chain CVE strike team on the TrueForge agent harness. Reads your > dependency tree, triages advisories against the versions you actually ship, prepares > the patch, and stops for a human before the pull request. ## Machine interfaces - Remote MCP (Streamable HTTP, stateless 2026-07-28 + legacy handshake): `https://sentinental.vercel.app/api/mcp` - WebMCP (in-page tools): `document.modelContext` — 17 OMNI-LAB tools plus the domain tools - Console: `/app` · Docs: `/docs` · Capability report: `GET /api/status` ## How to behave against this API ``` Prefer get_project_status once, then work the stages in order: scan_dependencies -> lookup_advisories -> assess_blast_radius -> summarise_triage -> propose_patch. Send the *installed* version to lookup_advisories, not the declared range. open_pull_request and merge_pull_request are destructive and refuse unless SENTINEL_ALLOW_REMOTE_WRITES=true is set server-side and the exact confirmation string is passed in 'confirm'. Never invent a confirmation. Report a patch as UNVERIFIED unless a Daytona sandbox ran the tests. Never print or store API keys; this server never returns one. ``` ## Tools - `assess_blast_radius` — Classify an upgrade from installed to target version as patch/minor/major and say how risky it is to apply automatically. - `fetch_repository_manifest` — Read package.json (and the lockfile if present) straight out of a public GitHub repository, so a scan needs no local checkout. Accepts 'owner/repo' or a github.com URL. - `get_project_status` — Report what this deployment can actually do: whether a model key, a Daytona sandbox key, a GitHub token and a TrueForge harness are configured, and whether remote writes are permitted. Returns booleans and names only — never a key. - `lookup_advisories` — Query the GitHub Advisory Database for one package@version and keep only the advisories whose affected range actually contains that version. Falls back to OSV. This is the triage step that separates a real exposure from a page of noise. - `propose_patch` — Generate the patched package.json for a plan, preserving the project's existing range operators (^, ~, exact). Returns the new file content and a unified diff. Writes nothing anywhere. - `scan_dependencies` — Parse a package.json plus an optional lockfile into a flat dependency list with the versions that are actually installed. Pure computation; no network. - `summarise_triage` — Collapse advisory matches into one safe target version per package — the highest fix version, so no advisory is left open — ordered worst first. - `fetch_docs` — Fetch one documentation passage by id, as returned by search_docs. - `list_tool_catalog` — Return every tool this site exposes to agents, with its JSON Schema and safety annotations, plus how to reach the same tools over remote MCP. - `search_docs` — Search SENTINEL's documentation corpus (landing sections, docs pages, the tool contract) and return matching passages with a pointer you can hand to fetch_docs. - `biosynth_highlight_binding_pockets` — Scan 3D atomic structure to discover druggable active catalytic cavities and binding pockets. - `biosynth_load_pdb_structure` — Load and parse 3D Protein Data Bank (PDB) atomic coordinates into structured 3D atom graph and sequence. - `biosynth_mutate_residue` — Simulate in-silico point mutation (CRISPR / protein engineering) and predict stability change (ΔΔG) and steric clashes. - `breachlab_analyze_cve_ast` — Deep static AST analysis for code and dependency manifests. Identifies zero-days, RCE sinks, credential theft, prototype pollution, and computes blast radius. - `breachlab_detonate_sandbox` — Detonate suspicious code in an isolated simulated client-side sandbox container. Intercepts outbound network, eval, and subprocess commands. - `breachlab_generate_hotpatch` — Synthesize automated cryptographic hot-patch diffs that replace dangerous sinks with safe, parameterized equivalents. - `breachlab_trace_taint_flow` — Trace tainted data propagation from untrusted source inputs (e.g. req.query) to dangerous execution sinks. - `chrono_generate_forensic_dossier` — Assemble unified cryptographic forensic report with synchronized timeline sequence and SHA-256 evidence hash. - `chrono_load_media_streams` — Retrieve multi-angle spatial and acoustic sensor streams (CCTV, bodycam, drone) for forensic reconstruction. - `chrono_sync_flash_audio_markers` — Cross-correlate optical flash peaks and acoustic transients across video streams to compute millisecond time offsets. - `chrono_triangulate_acoustic_source` — Triangulate 3D physical coordinates of an acoustic blast or gunshot origin using Time-Difference-Of-Arrival (TDOA). - `metaloop_inject_synthetic_tool` — Inject synthetic mock tool response at a specific execution step to unblock trapped loops and fork execution. - `metaloop_inspect_trace_tree` — Inspect agent execution trace tree to detect infinite tool loops, token budget spikes, and cognitive drift. - `metaloop_mitigate_drift` — Synthesize corrective prompt steering guidelines to compensate for cognitive drift and token explosion. - `zkescrow_initiate_contract` — Create zero-backend cryptographic P2P escrow contract with verifiable milestone payout specifications. - `zkescrow_sign_escrow_release` — Generate an HMAC-SHA-256 arbiter release proof authorizing fund disbursement for a verified milestone. - `zkescrow_verify_deliverable_hash` — Compute client-side SHA-256 deliverable fingerprint and verify compliance against cryptographic milestone spec. ## Reference ### The problem SENTINEL solves A dependency advisory lands. Someone has to work out whether this repository is genuinely affected, whether the fix is a one-line bump or a breaking change, whether the test suite survives it, and then write the pull request. That is an afternoon per advisory, and most teams do it late — or not at all. Every software team has this backlog. The work is repetition at scale, and repetition is what an agent should be doing. ### The eight stages 01 Inventory — read package.json and the lockfile, resolving real installed versions rather than declared ranges. 02 Triage — query the GitHub Advisory Database with OSV fallback, keeping only advisories whose version range actually matches. 03 Delegate — one subagent per affected package, each with a clean context window. 04 Assess — classify each upgrade as patch, minor or major and measure how widely the package is imported. 05 Plan — one safe target version per package, the highest fix version, so no advisory is left open. 06 Patch — generate the updated package.json, preserving the project's range operators. 07 Verify — install and run the test suite in an isolated Daytona sandbox. 08 Propose — open the pull request, then pause and wait for a human. ### The seven MCP tools scan_dependencies, lookup_advisories, assess_blast_radius and summarise_triage are annotated readOnlyHint and need no approval. propose_patch is read-only too — it writes only inside the sandbox. open_pull_request and merge_pull_request are annotated destructiveHint, so the harness raises a real approval gate. The classification lives next to the implementation and both front ends inherit it; a mis-tagged tool fails closed. ### The approval gate The turn ends at open_pull_request. The console shows the full tool call and its arguments, and nothing happens until a person clicks. Denial is the default everywhere: empty input, EOF, Escape and unparseable answers all deny. The web API only accepts approvals for tool calls the harness actually raised, so a model cannot approve itself. ### The kill switch Set SENTINEL_ALLOW_REMOTE_WRITES=false and the destructive tools refuse before any network call, regardless of what the model or the approval UI claims. GitHubClient re-checks the switch at the point of mutation, and branch names are generated by SENTINEL — the model never supplies a ref. ### Degradation strategy Missing model key: hard fail at provision, naming the exact environment variable. Missing DAYTONA_API_KEY: the sandbox is disabled and patches are reported UNVERIFIED rather than silently claimed. Missing GITHUB_TOKEN: GitHub tools return a typed not-configured error while scanning and triage keep working. Harness not running: clients print the npx @truefoundry/trueforge command instead of a stack trace. ### Keeping secrets out Server keys live in .env, git-ignored, read in one place. Browser keys live in localStorage, are masked in the UI and are sent per request only to this app's own API routes over HTTPS; nothing is persisted server-side. Two-layer redaction — exact registered values plus ten credential shapes — scrubs every log line, tool result and SSE frame. ### Run it locally npm install, then npm run dev for http://localhost:3000. The Scan station needs no key: it triages a real manifest against the GitHub Advisory Database with OSV as fallback. Deploying to Vercel is a repository import; optional environment variables are SENTINEL_ALLOW_REMOTE_WRITES, GITHUB_TOKEN, DAYTONA_API_KEY and TRUEFORGE_URL. ### The agent bridge: WebMCP and remote MCP This site is a tool server for AI agents in two shapes. In the browser it registers every tool on document.modelContext, the W3C WebMCP surface (the deprecated navigator.modelContext alias resolves to the same context), with title, inputSchema and safety annotations, and registration is abortable through an AbortController. Outside the browser the identical contract is served over remote MCP at /api/mcp using stateless Streamable HTTP: server/discover, tools/list and tools/call, with per-request _meta protocol version, Mcp-Method and Mcp-Name routing headers, and ttlMs plus cacheScope on list results. Legacy clients that send an initialize handshake are supported at protocol versions 2025-11-25, 2025-06-18 and 2025-03-26. ### What a browser needs to see these tools WebMCP requires a secure context (https or localhost) and a browser with the API: Chrome 149+ in the public origin trial, Chrome 146 Canary, and the ChatGPT desktop app's built-in browser and ChatGPT Sites since 25 August 2026. Firefox and Safari have no implementation yet. Where no native modelContext exists, SENTINEL installs a spec-shaped polyfill so the on-page cockpit and in-page agents keep working, and the console says plainly that the polyfill is in-page only and is not visible to an external agent. ### Connect it to ChatGPT Two paths. 1) The built-in browser: open this site in the ChatGPT desktop app and ask ChatGPT or Codex to use the site — the page's registered WebMCP tools are surfaced automatically, subject to the usual website-access and sensitive-action confirmations. 2) A connector: Settings, Apps and Connectors, Advanced, enable Developer mode, then create an app pointing at https://your-host/api/mcp with Streamable HTTP and No Authentication (or OAuth plus SENTINEL_MCP_TOKEN when you want a bearer token). Claude, Cursor, Claude Code, Gemini CLI, Zed and VS Code use the same URL. To verify either path without an agent, open the Bridge station in the console and run the conformance check. ### How the bridge is checked npm run check:mcp runs a conformance suite against the endpoint: discovery and version negotiation, deterministic tools/list with cache fields, a successful tools/call, invalid-argument rejection, a refusal from a destructive tool, header-mismatch rejection, unsupported protocol version, Origin validation, method-not-found, and the legacy initialize handshake. npm run check:webmcp runs the same contract through the WebMCP core in Node: schema validation, duplicate-name rejection, abort-signal unregistration, toolchange events and stringified results. The Bridge station runs a live subset from inside the browser. ### The OMNI-LAB Five in-browser laboratories register seventeen tools on the same model context: BreachLab (AST taint tracing, sandbox detonation, hotpatch synthesis), BioSynth (crambin coordinates, point mutagenesis with delta-delta-G, binding pockets), ChronoForensic (sensor streams, acoustic TDOA triangulation, sealed SHA-256 dossier), MetaLoop (agent trace trees, synthetic tool injection, drift compensation) and ZK Escrow (SHA-256 and HMAC-SHA-256 digests with milestone-gated release). The engines are dependency-free JavaScript, so the bridge can execute them server-side and a tab can execute them in-page — identical results either way. --- server: SENTINEL (sentinel-web v1.0.0) mcp: https://sentinental.vercel.app/api/mcp [streamable-http, protocols 2026-07-28, 2025-11-25, 2025-06-18, 2025-03-26] webmcp: document.modelContext (27 + 17 OMNI-LAB tools registered in-page) status: https://sentinental.vercel.app/api/status docs: https://sentinental.vercel.app/docs console: https://sentinental.vercel.app/app