Sentinel-IR MCP 0.5: give your AI agent a library card, not the master key

A developer released sentinel-ir-mcp 0.5, a read-only stdio MCP server that gives coding agents a compact structural intermediate representation of code — risk level, dangerous capabilities, routes, imports, and env/network/filesystem/process/crypto calls with line numbers — instead of raw source, supporting JavaScript, TypeScript, Python and, new in 0.5, Rust. The server confines every path to operator-approved roots, refuses symlinks and excluded files, never writes or executes code, and offers an opt-in audit log recording tool, path, result and file SHA-256; on a 190-file Node project the default directory summary was about 35,856 characters (~9,000 tokens) versus 8,439 tokens for a single mid-sized file read raw.

A 10-minute read for developers, platform teams and whoever has to answer "wait, what can the agent read?" in a security review. io.github.jakcmencz/sentinel-ir-mcp sentinel-ir-mcp is a stdio MCP https://modelcontextprotocol.io server with three read-only tools: analyze code , analyze file and analyze directory . Instead of raw source, the agent gets a compact structural IR from sentinel-ir https://gitlab.com/jakubrojicek11/sentinel-ir : risk level, dangerous capabilities, routes, imports, env reads, network, filesystem, process and crypto calls, each with a line number. It works with JavaScript, TypeScript, Python and, since 0.5, Rust. The 0.5 line is about two things: Rust , and making sure the copy running on your machine is the one with the fixes . Plus a doctor that we tried very hard to break on three operating systems. Coding agents have discovered the filesystem, and they love it. Ask "is this repo safe to deploy?" and a typical agent cat s twenty files into its context. That's 50,000 tokens of business logic, license headers and a comment from 2019 that says // TODO: remove before prod . Then it answers from vibes. Three costs: src/ast-facts.js is 8,439 tokens. Its IR is 120. curl … | sh " is a real genre now. ~/.ssh included. sentinel-ir-mcp is the opposite design: small facts, narrow scope, no writes. The intended workflow, which the tool descriptions spell out for the agent: analyze directory the project. You get one short entry per file path, risk, status, language, lines, operations, up to 3 risk signals , sorted from highest to lowest risk, plus riskCounts . critical and high files and the incomplete ones. Incomplete means "didn't fully parse", and its low is On a 190-file Node project the default summary was 35,856 characters about 9,000 tokens for the whole folder . That's less than a single mid-sized file read raw. {"folder":".","analyzed":42,"riskCounts":{"critical":1,"high":2,"medium":6,"low":33}, "files": {"path":"src/deploy.rs","risk":"critical","language":"rust", "operations": "processSpawn" ,"riskSignals": "process spawn:Cmd::new@14" }, "..." } Illustrative shape, trimmed. This is the part your security team will read, so we wrote it like an interface contract. It only reads. The server never writes project files, never executes code and never opens a network connection. The tools are annotated readOnlyHint: true , destructiveHint: false , openWorldHint: false . Only inside the folders you allowed. Roots come from the command line or, without folder arguments, from the client's MCP roots. Every requested path is resolved to its real path and must land inside a root. In our audit of the published 0.5.5 package, the server refused all of these: php ../outside/s.js - Access denied: outside the allowed folders /etc/passwd - Access denied: outside the allowed folders src/link.js symlink out - Access denied secrets/x.js excluded - Excluded by the user's settings. Do not try to read it another way. The boring attacks are handled too: O NOFOLLOW and directory scans skip every symlink. node modules , .git , venv , hidden folders and Cargo target/ only when it has Cargo's CACHEDIR.TAG . Exclusions belong to the human. setup --exclude secrets --exclude dist writes them into the client config. The agent can't change them, and neither can the analyzed repo: there's deliberately no .sentinelignore , because a malicious repo would use it to hide its own payload. Excluded files are refused by analyze file and only counted by analyze directory , because file names can be sensitive too. An audit log, for the "who asked for what" question. It's opt-in setup --audit-log . It records the tool, the path, the result and the SHA-256 of each file the agent was shown, and never the source. It must live outside the project, rotates daily, keeps 30 days and stays under 50 MB a day. Read it with npx -y sentinel-ir-mcp@stable-0.5 log : 2026-10-18 10:32:05 cursor file src/app.js: critical 2026-10-18 10:32:09 cursor REFUSED file secrets/aws.js: excluded by your settings 2026-10-18 10:33:40 cursor folder .: 42 file s 1 critical, 6 medium, 35 low , 3 excluded The IR is still untrusted text. Comments and string bodies are not copied, and since sentinel-ir 0.5.4 every string is capped at 128 characters and literals in evidence show up as "…" . Identifiers and route paths still come from the code. That reduces the injection surface; it doesn't remove it, and every tool description tells the agent to treat IR values as data, not instructions. .rs files go through sentinel-ir 's new Rust analyzer: unsafe and FFI, std::process::Command , file writes and deletes, HTTP clients and servers axum , actix-web , ... . A build.rs or procedural macro that touches files, the network or secret env vars is at least high , because it runs on your machine during cargo build . For a supply-chain attacker that's the best seat in the house. Here's a fun fact we measured against a local npm registry: npx never re-resolves a cached version range. Configure your client with sentinel-ir-mcp@0.5 and npx keeps starting the first 0.5.x it downloaded, forever, even after security fixes ship. It's like a fridge that only ever restocks the milk you bought in March. A dist-tag is re-resolved on every start. So setup now writes sentinel-ir-mcp@stable-0.5 , and CI moves that tag forward on every release never backwards . Without network access, the cached copy still starts. The server also requires sentinel-ir ≥ 0.5.6, which pulls in the comment-hiding, parse-budget and broken-file fixes. doctor warns about pinned entries and stale npx cache copies, with the exact folder to delete. Each tool description is now short lines in a fixed order: what it does, what it returns, the parameters, the risk scale, when it refuses, and which sibling tool to use instead "for a folder use medium network, writes, crypto is normal in fetch . doctor , the part we tried hardest to break 0.5.4–0.5.5 npx -y sentinel-ir-mcp@stable-0.5 doctor checks Node, the package versions, the client configs, exclusions, the audit log, a real MCP handshake and a real analyze directory call. Since 0.5.4 it also asks npm whether a newer stable-0.5 exists 3 s timeout, skipped offline and tells you where the old copy runs from: the npx cache, a global install, npm link , Homebrew, nvm-windows or Volta. Then we spent a day trying to break it on Linux, macOS and Windows, with a fake registry that answered in 28 different wrong ways slow drips, gzip bombs, redirect loops, proto , ANSI escapes with newlines and 17 proxy setups. Things we found and fixed before 0.5.5 shipped: % in a password crashed the check. NO PROXY was ignored under npx, because npm sets an empty npm config noproxy . cafile and strict-ssl from .npmrc were ignored, so corporate proxies looked "offline". warn . Now it counts the warnings. Every case ends with a sensible message and exit code 0, in at most about 3.5 s. Behind a corporate proxy, doctor now behaves like npm does. After 0.5.5 we audited the published package as a whole instead of trying to break one feature. Nothing security-relevant turned up. Four small fixes shipped: guide the agent's manual still said "JavaScript and TypeScript". ..cache was treated as "outside". npm audit in the lock file showed two moderate advisories in a transitive Hono dependency of the MCP SDK. The stdio server never loads Hono, and fresh installs were already clean. The lock file now reports 0 vulnerabilities. @modelcontextprotocol/sdk , zod and sentinel-ir . About 100 packages in interactive: picks the client, the project folder, exclusions, audit log npx -y sentinel-ir-mcp@stable-0.5 setup or explicit npx -y sentinel-ir-mcp@stable-0.5 setup --client cursor --project ~/code/app \ --exclude secrets --exclude dist --audit-log then npx -y sentinel-ir-mcp@stable-0.5 doctor setup shows what it will write, makes a backup, writes atomically, and refuses to give an agent your whole home folder or a whole disk. Claude Desktop, Cursor and Windsurf are supported directly. Any other MCP client just runs npx -y sentinel-ir-mcp@stable-0.5 /path/to/project . build.rs and proc-macro behaviour in new dependencies before cargo build runs them on 200 laptops. rustc . Go is next. Because the server speaks the shared sentinel-ir IR, a new language in the library lands in the MCP server and the playground https://sentinel-ir-playground-dc30c8.gitlab.io/ without a new output format, so your agent's prompts don't change. Bug reports and merge requests are welcome on GitLab https://gitlab.com/jakubrojicek11/sentinel-ir-mcp . If you manage to make the server read /etc/passwd , we'd genuinely like to hear about it before your glama.ai followers do. Independent Engineering Projects Built as independent engineering experiments across AI, software analysis, security, and autonomous systems. Evaluated by reproducible evidence, not by the number of layers. Explore the projects: Sentinel Ecosystem: AutoDoc-Sentinel, Sentinel-IR, Sentinel-IR-MCP and related tools. Agentix Lite: Independent security and system-observation project. Find the projects: GitLab repositories | NPM packages Support the work: ⭐ Star the repositories on GitLab. Connect: Follow me here on DEV Community or explore the Playground. Each project is distributed under its own license. Check the corresponding repository or NPM package for licensing terms. Copyright © 2026 jackymenCZ. All rights reserved. Written for the community.