SentinelCore
A security layer between an AI application and the models, tools and data it touches — inspecting prompts, retrieved context, tool calls, MCP tool definitions and model output, then enforcing a policy on what happens next.
The problem
An AI application exposes a model to untrusted user input, external documents, tools and other AI systems. That is a security boundary traditional AppSec never covered: the request is well-formed, the token is valid, the tool is permitted — and the content still decides what happens.
What it does
Five detectors run over every origin — input, each retrieved document, and output. Their findings feed a deterministic risk score and a configurable policy engine, which returns one of five decisions. As a reverse proxy it is OpenAI-path compatible, so it scans the response as well as the request, streaming included.
Evidence
- 96.8%precision
- 17.7%recall
- 0.5%false-positive rate
- 744labelled examples
345 malicious, 399 benign, from two MIT-licensed public sources. The recall is the honest signature of a rule-and-heuristic detector: it rarely cries wolf, and it misses most real-world attacks. The repository says so in those words, and an attack-replay lab tracks every version against the same set — v0.1 to v0.3, twenty attacks newly caught, zero regressions.
