sentinel-ai - Real-time AI safety guardrails for LLM apps. 10 sc

项目说明

Sentinel AI

![Python]()
![Live Demo]()

Real-time safety guardrails for LLM applications. Try the live demo

Sentinel AI is a lightweight, zero-dependency safety layer that protects your LLM applications from prompt injection, PII leaks, harmful content, hallucinations, and toxic outputs — with sub-millisecond latency.

Why Sentinel AI?

Architecture

Installation

Claude Code Plugin (recommended)

Then use /sentinel-ai:scan, /sentinel-ai:check-pii, and /sentinel-ai:check-safety commands directly in Claude Code. The plugin also includes an auto-invoked safety-scanning skill and 4 MCP tools.

Python Package

Or install directly from GitHub:

With optional integrations:

Ja / TypeScript

Standalone scanning in Node.js, Deno, Bun, and browsers — zero runtime dependencies. The JS SDK includes CodeScanner (OWASP Top 10), DependencyScanner (supply chain attacks), PromptHardener, CanaryToken, and all core scanners. See sdk-js/README.md for details.

Code & Supply Chain Scanning

Use as a Claude Code PostToolUse hook to scan code as it's written — blocks Write/Edit on high/critical .

Ad E

Test your safety pipeline against injection, obfuscation, PII, harmful content, toxicity, and benign false-positi. Also a in the live demo under the "E" tab.

Production Features

Quick Start

Basic Scanning

Claude Agent SDK Integration

Claude SDK Integration

Streaming with real-time safety scanning:

OpenAI SDK Integration

LangChain Integration

LlamaIndex Integration

Streaming Protection

REST API Server

Quick Setup

CLI

Project-Wide Security Scan

Run every scanner in one command — get a unified security score (0-100) across your entire project:

Runs 6 security checks in one pass:
1. CLAUDE.md injection — hidden instructions, authority impersonation
2. Supply chain attacks — typosquatting, malicious packages, install scripts
3. Hardcoded secrets — API keys, tokens, private keys, connection strings
4. Code — SQL injection, XSS, command injection (OWASP Top 10)
5. Security configuration — hooks, permissions, MCP settings
6. MCP tool schemas — prompt injection in tool definitions

Claude Code Hooks

Automatically scan every tool call in Claude Code for safety issues. Add to .claude/settings.json:

This blocks dangerous shell commands (rm -rf /, credential access), data exfiltration attempts, and prompt injection in tool arguments — before they execute.

MCP Server (Model Context Protocol)

Sentinel AI runs as an MCP server, making safety scanning a to Claude Desktop, Claude Code, and any MCP-compatible client.

Add to your claude_desktop_config.json:

A MCP tools (14): scan_text, scan_tool_call, check_pii, get_risk_report, scan_con, test_robustness, scan_code, scan_secrets, check_canary, harden_prompt, generate_rsp_report, compliance_check, threat_lookup, guard_tool_call.

CLAUDE.md Security Scanner

Scan project instruction files (CLAUDE.md, .cursorrules, copilot-instructions.md) for hidden injection :

Detects: hidden HTML comment injections, authority impersonation, API URL hijacking, zero-width character smuggling, base64 payloads, Unicode homoglyphs, dangerous permission grants, and safety-disabling instructions. Returns exit code 1 if critical issues are found.

FastAPI Middleware

Drop-in safety scanning for any FastAPI application:

LLM API Firewall

Transparent reverse proxy that sits between your app and any LLM API, scanning all requests and responses:

The firewall scans input messages for injection/harmful content, scans output for PII/dangerous content, blocks dangerous tool calls, auto-redacts PII in responses, and adds X-Sentinel-* headers with scan metadata. Stats a at /_sentinel/stats.

Git Pre-Commit Hook

Automatically scan staged code for OWASP before each commit:

The pre-commit hook scans .py, .js, .ts, .jsx, .tsx, .rb, .php, .java, .go, .rs files for SQL injection, command injection, XSS, hardcoded secrets, and other OWASP .

Security Audit

Audit your project's Claude Code security configuration and get a score out of 100:

Checks 6 areas: Claude Code hooks, permissions allowlist, security policy, en files, git pre-commit hooks, and MCP ser. Returns exit code 1 if critical issues are found.

MCP Tool Schema

that MCP tool definitions don't contain prompt injection, authority impersonation, or data exfiltration instructions hidden in tool descriptions:

Detects:

Dependency Scanner

Scan dependency files for supply chain attacks — typosquatting, known malicious packages, suspicious install scripts, and more:

Detects:

Supports: requirements.txt, package.json, pyproject.toml, Pipfile

Secrets Scanner

Scan source code for hardcoded credentials, API keys, tokens, and private keys:

Detects 40+ secret patterns:

MCP Safety Proxy

Proxy any MCP ser Sentinel's safety layer. Scans all tool arguments before forwarding and auto-redacts PII in responses:

The proxy transparently intercepts tool calls, blocks dangerous operations (shell injection, data exfiltration), and redacts PII in tool responses — without modifying the upstream MCP server.

Scanners

| Scanner | Detects | Risk Levels |
|---------|---------|-------------|
| Prompt Injection | Instruction o, role injection, delimiter attacks, jailbreaks, prompt extraction, multilingual (12 languages), cross-lingual injection, Claude Code attack (HTML comment injection, authority impersonation, base URL exfil, config injection) | LOW — CRITICAL |
| PII Detection | Emails, SSNs, credit cards (Luhn-), phone numbers, API keys, tokens | LOW — CRITICAL |
| Harmful Content | Weapons/drug synthesis, self-harm, hacking, fraud instructions | HIGH — CRITICAL |
| Hallucination | Fabricated citations, false confidence markers, self-contradictions | LOW — MEDIUM |
| Toxicity | Threats, severe insults, profanity, aggressive tone | LOW — CRITICAL |
| Blocked Terms | Custom enterprise-specific blocked terms and phrases | Configurable |
| Tool Use | Dangerous shell commands, data exfiltration, credential access, pri escalation | MEDIUM — CRITICAL |
| Structured Output | XSS, SQL injection, template injection, path tra in JSON ; schema | LOW — CRITICAL |
| Code Scanner | SQL injection, command injection, XSS, path tra, insecure deserialization, hardcoded secrets, weak crypto, SSRF in generated code | MEDIUM — CRITICAL |
| Obfuscation | Base64-encoded payloads, hex-encoded commands, ROT13-encoded instructions, unicode escape sequences, leetspeak of dangerous terms | MEDIUM — HIGH |

Obfuscation Detection

Catches attack payloads hidden through encoding or obfuscation — the kind of thing keyword filters miss:

Multilingual Prompt Injection Detection

Detects prompt injection in 12 languages plus cross-lingual attacks (English injection keywords embedded in non-Latin text):

Supported languages: Chinese (Simplified + Traditional), Japanese, Korean, Russian, Arabic, Spanish, French, German, Portuguese, Hindi — plus cross-lingual injection detection for mixed-script attacks.

Agentic Tool-Use Safety

Structured Output

Scan LLM-generated JSON for injection attacks hidden in field , plus schema :

Code Scanner

Scan LLM-generated code for OWASP Top 10 before it's committed:

Detects: SQL injection, command injection, XSS, path tra, insecure deserialization (pickle/eval/yaml), hardcoded secrets (AWS keys, passwords, API tokens), weak cryptography (MD5/SHA1/DES/ECB), and SSRF.

RSP-Aligned Risk Reports

Generate safety risk reports aligned with Anthropic's Responsible Scaling Policy (RSP) v3.0:

Reports include threat domain assessments, risk distribution, acti, and actionable recommendations -- mapping directly to RSP risk categories.

Multi-Turn Con Safety

Track safety across entire con -- detects gradual jailbreak escalation, topic persistence attacks, sandwich attacks, and re-attempts after blocks that single-message scanning misses:

Canary Tokens for Prompt Leak Detection

Plant in markers in system prompts. If they appear in model output, your prompt was leaked:

Supports two styles: comment (HTML comments) and zero-width (truly in Unicode encoding).

Prompt Hardening

Make system prompts injection-resistant with multiple defense layers:

Also a: fence_user_input() to wrap untrusted input in delimiters, and xml_tag_sections() to structure prompts with clear boundaries.

Ad Robustness Testing

Red-team your safety scanners with automated e generation. Tests 10+ techniques including homoglyphs, zero-width characters, leetspeak, payload splitting, and synonym substitution:

Regulatory Compliance Mapping

Map scan results to EU AI Act, NIST AI RMF, and ISO/IEC 42001 controls. Get automated compliance status and remediation recommendations:

Assesses 21 controls across three frameworks with automated risk classification, per-control status, and actionable remediation guidance.

Agent Safety Monitor

Track tool-use patterns across agentic AI sessions and detect anomalous behavior in real-time:

Detects: destructi, data exfiltration, credential access, runaway loops, write spikes, and read-then-exfiltrate attack chains.

Drop-in SDK Guard Wrappers

Add safety scanning to Anthropic or OpenAI API calls with one line of code:

Also a for OpenAI: guard_openai(OpenAI()). Supports scan callbacks, non-blocking mode, and custom guard configuration.

Threat Intelligence Feed

Query a MITRE ATLAS-aligned database of 27+ known LLM attack techniques:

Covers: prompt injection, jailbreaks, data exfiltration, model manipulation, pri escalation, social engineering, e techniques, and resource abuse.

Attack Chain Detector

Detect multi-step attack sequences that span multiple tool calls — where no single call is dangerous but the sequence reveals malicious intent:

Detects 6 chain patterns: recon→credential→exfiltrate, credential→exfiltrate, escalation→destruction, context poisoning→escalation, recon→escalation→persistence, and context poisoning→credential→exfiltration.

Session Audit Trail

Tamper-e audit logging for agentic AI sessions — every tool call, blocked action, and anomaly is recorded with SHA-256 hash chaining for integrity . Export to JSON for SIEM integration (Splunk, Datadog, Elastic) and compliance reporting (SOC 2, ISO 27001):

Features: hash-chained entries (tamper detection), integrity , JSON/SIEM export, risk timeline, finding categorization, tool usage breakdown, session metadata (user, agent, model), and duration tracking.

Session Guard (One-Line Safety for Agentic AI)

Drop-in safety layer that combines audit logging, attack chain detection, and threat intelligence into a single check() call. Wraps every tool call with allow/block , full audit trail, and real-time threat detection:

Combines: SessionAudit (tamper-e logging) + AttackChainDetector (multi-step attack detection) + ThreatFeed (known attack pattern matching). Configurable block threshold, custom rules, and full JSON export.

#### Policy-as-Code for SessionGuard

Define security policies as YAML files for , auditable safety configuration:

Session Replay & Forensic Analysis

Load an exported audit trail and replay it for forensic analysis — extract IOCs, identify attack chains, generate incident reports:

Enterprise Features

Policy Engine

Webhooks & Alerting

Obser

Authentication & Rate Limiting

GitHub Action

Add comprehensi scanning to any project in 3 lines:

Or use indi scans for fine-grained control:

SARIF Output (GitHub Code Scanning)

Generate SARIF v2.1.0 output for integration with GitHub Code Scanning, Azure DevOps, and other static analysis tools:

Benchmark

600-case benchmark suite co prompt injection (including ad jailbreaks and multilingual attacks), PII, harmful content, toxicity, hallucination detection, tool-use safety, obfuscation/encoding attacks, and secrets/credential detection:

Run the benchmark:

Comparison

| Feature | Sentinel AI | NeMo Guardrails | LLM Guard | Guardrails AI |
|---------|:-----------:|:---------------:|:---------:|:-------------:|
| Scan latency | ~0.05ms | 100ms+ | 50ms+ | |
| GPU required | No | Optional | Yes | Optional |
| Core dependencies | 1 (regex) | 10+ | 10+ | 5+ |
| Prompt injection | Yes | Yes | Yes | Yes |
| PII detection + redact | Yes | No | Yes | Yes |
| Tool-use safety | Yes | No | No | No |
| Structured output | Yes | No | No | Yes |
| Claude Code hooks | Yes | No | No | No |
| MCP server | Yes | No | No | No |
| Ad red-teaming | Yes | No | No | No |
| Multi-turn tracking | Yes | Yes | No | No |
| Streaming protection | Yes | No | No | No |
| Multilingual injection (12 langs) | Yes | No | No | No |
| SARIF output (GitHub Code Scanning) | Yes | No | No | No |
| Claude Agent SDK integration | Yes | No | No | No |

Architecture

De

License

Apache 2.0 — see LICENSE

项目信息

开发语言：Python

Star 数：24

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Real-time AI safety guardrails for LLM apps. 10 scanners: prompt injection, PII, harmful content, code vulnerabilities, obfuscation detection. Sub-ms latency. Python + TypeScript SDKs. MCP proxy. Claude Code hooks.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。