# Sentinel-IR MCP 0.5: give your AI agent a library card, not the master key > Source: > Published: 2026-11-14 17:44:54+00:00 *A 10-minute read for developers, platform teams and whoever has to answer "wait, what can the agent read?" in a security review.* `io.github.jakcmencz/sentinel-ir-mcp`) `sentinel-ir-mcp` is a stdio [MCP](https://modelcontextprotocol.io) server with three read-only tools: `analyze_code`, `analyze_file` and `analyze_directory`. Instead of raw source, the agent gets a compact structural IR from [`sentinel-ir`](https://gitlab.com/jakubrojicek11/sentinel-ir): risk level, dangerous capabilities, routes, imports, env reads, network, filesystem, process and crypto calls, each with a line number. It works with JavaScript, TypeScript, Python and, since 0.5, Rust. The 0.5 line is about two things: **Rust**, and making sure the copy running on your machine is **the one with the fixes**. Plus a `doctor` that we tried very hard to break on three operating systems. Coding agents have discovered the filesystem, and they *love* it. Ask "is this repo safe to deploy?" and a typical agent `cat` s twenty files into its context. That's 50,000 tokens of business logic, license headers and a comment from 2019 that says `// TODO: remove before prod`. Then it answers from vibes. Three costs: `src/ast-facts.js` is 8,439 tokens. Its IR is 120.`curl … | sh`" is a real genre now.`~/.ssh` included. `sentinel-ir-mcp` is the opposite design: small facts, narrow scope, no writes. The intended workflow, which the tool descriptions spell out for the agent: `analyze_directory` the project. You get one short entry per file (path, risk, status, language, lines, operations, up to 3 risk signals), sorted from highest to lowest risk, plus `riskCounts`.` critical` and `high` files and the `incomplete` ones. Incomplete means "didn't fully parse", and its `low` is On a 190-file Node project the default summary was 35,856 characters (about 9,000 tokens) for the **whole folder**. That's less than a single mid-sized file read raw. ``` {"folder":".","analyzed":42,"riskCounts":{"critical":1,"high":2,"medium":6,"low":33}, "files":[{"path":"src/deploy.rs","risk":"critical","language":"rust", "operations":["processSpawn"],"riskSignals":["process_spawn:Cmd::new@14"]}, "..."]} ``` (Illustrative shape, trimmed.) This is the part your security team will read, so we wrote it like an interface contract. **It only reads.** The server never writes project files, never executes code and never opens a network connection. The tools are annotated `readOnlyHint: true`, `destructiveHint: false`, `openWorldHint: false`. **Only inside the folders you allowed.** Roots come from the command line or, without folder arguments, from the client's MCP roots. Every requested path is resolved to its real path and must land inside a root. In our audit of the published 0.5.5 package, the server refused all of these: ``` php ../outside/s.js -> Access denied: outside the allowed folders /etc/passwd -> Access denied: outside the allowed folders src/link.js (symlink out) -> Access denied secrets/x.js (excluded) -> Excluded by the user's settings. Do not try to read it another way. ``` **The boring attacks are handled too:** `O_NOFOLLOW` and directory scans skip every symlink.`node_modules`, `.git`, `venv`, hidden folders and Cargo `target/` (only when it has Cargo's `CACHEDIR.TAG`). **Exclusions belong to the human.** `setup --exclude secrets --exclude dist` writes them into the client config. The agent can't change them, and neither can the analyzed repo: there's deliberately no `.sentinelignore`, because a malicious repo would use it to hide its own payload. Excluded files are refused by `analyze_file` and only *counted* by `analyze_directory`, because file names can be sensitive too. **An audit log, for the "who asked for what" question.** It's opt-in (`setup --audit-log`). It records the tool, the path, the result and the SHA-256 of each file the agent was shown, and never the source. It must live outside the project, rotates daily, keeps 30 days and stays under 50 MB a day. Read it with `npx -y sentinel-ir-mcp@stable-0.5 log`: ``` 2026-10-18 10:32:05 [cursor] file src/app.js: critical 2026-10-18 10:32:09 [cursor] REFUSED file secrets/aws.js: excluded by your settings 2026-10-18 10:33:40 [cursor] folder .: 42 file(s) (1 critical, 6 medium, 35 low), 3 excluded ``` **The IR is still untrusted text.** Comments and string bodies are not copied, and since `sentinel-ir` 0.5.4 every string is capped at 128 characters and literals in evidence show up as `"…"`. Identifiers and route paths still come from the code. That *reduces* the injection surface; it doesn't remove it, and every tool description tells the agent to treat IR values as data, not instructions. `.rs` files go through `sentinel-ir`'s new Rust analyzer: `unsafe` and FFI, `std::process::Command`, file writes and deletes, HTTP clients and servers (`axum`, `actix-web`, ...). A `build.rs` or procedural macro that touches files, the network or secret env vars is at least `high`, because it runs on your machine during `cargo build`. For a supply-chain attacker that's the best seat in the house. Here's a fun fact we measured against a local npm registry: **`npx` never re-resolves a cached version range.** Configure your client with `sentinel-ir-mcp@0.5` and npx keeps starting the first 0.5.x it downloaded, forever, even after security fixes ship. It's like a fridge that only ever restocks the milk you bought in March. A dist-tag *is* re-resolved on every start. So `setup` now writes `sentinel-ir-mcp@stable-0.5`, and CI moves that tag forward on every release (never backwards). Without network access, the cached copy still starts. The server also requires `sentinel-ir` ≥ 0.5.6, which pulls in the comment-hiding, parse-budget and broken-file fixes. `doctor` warns about pinned entries and stale `_npx` cache copies, with the exact folder to delete. Each tool description is now short lines in a fixed order: what it does, what it returns, the parameters, the risk scale, when it refuses, and **which sibling tool to use instead** ("for a folder use `medium` (network, writes, crypto) is normal in`fetch()`.` doctor`, the part we tried hardest to break (0.5.4–0.5.5) `npx -y sentinel-ir-mcp@stable-0.5 doctor` checks Node, the package versions, the client configs, exclusions, the audit log, a real MCP handshake and a real `analyze_directory` call. Since 0.5.4 it also asks npm whether a newer `stable-0.5` exists (3 s timeout, skipped offline) and tells you where the old copy runs from: the npx cache, a global install, `npm link`, Homebrew, nvm-windows or Volta. Then we spent a day trying to break it on Linux, macOS and Windows, with a fake registry that answered in 28 different wrong ways (slow drips, gzip bombs, redirect loops, `__proto__`, ANSI escapes with newlines) and 17 proxy setups. Things we found and fixed before 0.5.5 shipped: `%` in a password crashed the check.`NO_PROXY` was ignored under npx, because npm sets an empty `npm_config_noproxy`.` cafile` and `strict-ssl` from `.npmrc` were ignored, so corporate proxies looked "offline".`[warn]`. Now it counts the warnings. Every case ends with a sensible message and exit code 0, in at most about 3.5 s. Behind a corporate proxy, `doctor` now behaves like npm does. After 0.5.5 we audited the published package as a whole instead of trying to break one feature. Nothing security-relevant turned up. Four small fixes shipped: `guide` (the agent's manual) still said "JavaScript and TypeScript".`..cache` was treated as "outside".`npm audit` in the lock file showed two moderate advisories in a transitive Hono dependency of the MCP SDK. The stdio server never loads Hono, and fresh installs were already clean. The lock file now reports 0 vulnerabilities.`@modelcontextprotocol/sdk`, `zod` and `sentinel-ir`. About 100 packages in ``` # interactive: picks the client, the project folder, exclusions, audit log npx -y sentinel-ir-mcp@stable-0.5 setup # or explicit npx -y sentinel-ir-mcp@stable-0.5 setup --client cursor --project ~/code/app \ --exclude secrets --exclude dist --audit-log # then npx -y sentinel-ir-mcp@stable-0.5 doctor ``` `setup` shows what it will write, makes a backup, writes atomically, and refuses to give an agent your whole home folder or a whole disk. Claude Desktop, Cursor and Windsurf are supported directly. Any other MCP client just runs `npx -y sentinel-ir-mcp@stable-0.5 /path/to/project`. `build.rs` and proc-macro behaviour in new dependencies before `cargo build` runs them on 200 laptops.`rustc`). Go is next. Because the server speaks the shared `sentinel-ir` IR, a new language in the library lands in the MCP server and the [playground](https://sentinel-ir-playground-dc30c8.gitlab.io/) without a new output format, so your agent's prompts don't change. Bug reports and merge requests are welcome on [GitLab](https://gitlab.com/jakubrojicek11/sentinel-ir-mcp). If you manage to make the server read `/etc/passwd`, we'd genuinely like to hear about it before your glama.ai followers do. Independent Engineering Projects Built as independent engineering experiments across AI, software analysis, security, and autonomous systems. Evaluated by reproducible evidence, not by the number of layers. Explore the projects: Sentinel Ecosystem: AutoDoc-Sentinel, Sentinel-IR, Sentinel-IR-MCP and related tools. Agentix Lite: Independent security and system-observation project. Find the projects: GitLab repositories | NPM packages Support the work: ⭐ Star the repositories on GitLab. Connect: Follow me here on DEV Community or explore the Playground. Each project is distributed under its own license. Check the corresponding repository or NPM package for licensing terms. Copyright © 2026 jackymenCZ. All rights reserved. Written for the community.