sentinel-prox 0.1.0__tar.gz

sentinel_prox-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Pali Krishna Harshith
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sentinel_prox-0.1.0/PKG-INFO

@@ -0,0 +1,258 @@
+Metadata-Version: 2.4
+Name: sentinel-prox
+Version: 0.1.0
+Summary: Provenance-aware security proxy for AI agents: block prompt-injection actions at the MCP tool boundary.
+Author: Pali Krishna Harshith
+License: MIT
+Project-URL: Homepage, https://github.com/Harshith029/Sentinel
+Project-URL: Repository, https://github.com/Harshith029/Sentinel
+Project-URL: Issues, https://github.com/Harshith029/Sentinel/issues
+Project-URL: Demo, https://sentinel-i63x.onrender.com
+Keywords: mcp,model-context-protocol,ai-security,prompt-injection,ai-agents,llm-security,agentic-ai,security-proxy,information-flow-control,provenance
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Application Frameworks
+Classifier: Topic :: System :: Networking :: Monitoring
+Classifier: Typing :: Typed
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: azure-ai-projects==2.0.0
+Requires-Dist: azure-identity>=1.17
+Requires-Dist: azure-cosmos>=4.7
+Requires-Dist: azure-monitor-opentelemetry>=1.6
+Requires-Dist: mcp>=1.2
+Requires-Dist: openai>=1.50
+Requires-Dist: opentelemetry-api>=1.27
+Requires-Dist: opentelemetry-sdk>=1.27
+Requires-Dist: fastapi>=0.115
+Requires-Dist: uvicorn[standard]>=0.32
+Requires-Dist: sse-starlette>=2.1
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic<3,>=2.9
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: pytest>=8.3; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.24; extra == "dev"
+Requires-Dist: httpx>=0.27; extra == "dev"
+Requires-Dist: pre-commit>=3.8; extra == "dev"
+Requires-Dist: ruff>=0.6; extra == "dev"
+Requires-Dist: mypy>=1.11; extra == "dev"
+Requires-Dist: types-PyYAML>=6.0; extra == "dev"
+Dynamic: license-file
+
+# SENTINEL
+
+**A provenance-aware security proxy for AI agents.** It sits between your agent and
+your MCP tool servers, tracks where every byte of context came from, and refuses
+actions whose data originated in untrusted content — even when the attack slipped
+past your content filter.
+
+```bash
+pip install sentinel-prox    # imports and CLI are both `sentinel`
+sentinel init             # write sentinel.yaml
+sentinel check            # validate config, connect to your servers, vet their tools
+sentinel scaffold > policy.yaml
+sentinel serve            # your agent points at http://127.0.0.1:8765/mcp
+```
+
+Your agent needs **no code changes**: point its MCP endpoint at SENTINEL instead of
+directly at your tool servers. Interception is guaranteed by topology, not by asking
+the agent to cooperate.
+
+---
+
+## The problem
+
+AI agents don't just answer questions any more — they send email, query business
+systems, and read the open web. That makes **indirect prompt injection** an action
+problem, not a text problem: an attacker hides an instruction inside content the
+agent will read, and it executes with the agent's full privileges.
+*"Summarize this pricing page"* quietly becomes *"email this customer's SSN to the
+attacker."*
+
+Content filters scan the words. Microsoft's own Prompt Shields documentation says it
+"may not catch all attack vectors" and recommends additional validation layers.
+**The gap: security is applied to the words, while the damage is done by the actions.**
+
+SENTINEL closes it by judging an action on **where its data came from**, not on how
+the request was phrased.
+
+## What it protects against
+
+| Attack | How SENTINEL stops it |
+|---|---|
+| **Indirect prompt injection** | Actions whose lineage includes untrusted content are denied — regardless of phrasing, so obfuscation doesn't help |
+| **Data exfiltration** | A `send_email` built from a retrieved page is refused before it executes |
+| **Tool poisoning** | Tool descriptions *and* input schemas are scanned at connect; a poisoned catalogue is refused |
+| **Cross-server shadowing** | Two servers claiming one tool name fails closed — SENTINEL won't guess which is authoritative |
+| **Rug pulls** | The catalogue is fingerprinted at approval and re-checked; post-approval mutation is detected |
+| **Privilege escalation** | Unknown tools are default-denied until you write a rule |
+| **Repeated abuse** | A trust score degrades on blocked calls and quarantines the agent |
+
+Every decision becomes an immutable, replayable forensic record, exportable as
+SIEM-ready JSONL.
+
+## How it works
+
+```
+ your agent  ──MCP──▶  SENTINEL  ──MCP──▶  your MCP servers
+                          │
+       1. trace    label the origin of everything the agent has seen
+       2. authorize  policy decides each call using that lineage (deny-overrides)
+       3. contain   trust score + automatic quarantine
+       4. record    immutable spans → replay + SOC export
+```
+
+Provenance is a **set of trust labels** (`SYSTEM > USER > AGENT > RETRIEVED_CONTENT`)
+unioned over an action's transitive `derived_from` ancestry — computed by a real
+cycle-safe graph walk, not a mutable flag. An action is tainted iff
+`RETRIEVED_CONTENT` is in that set. Taint clears only through an explicit, auditable
+`StructuredExtractor` (strict schema validation produces a fresh SYSTEM-trust value
+with no inherited ancestry), and a sanitized value **cannot launder a tainted
+sibling** — recombination re-taints.
+
+Policy compiles to a **typed condition AST** and is evaluated by tree-walk;
+there is no `eval` anywhere in the codebase. Rules are deny-only with
+deny-overrides, and **unknown tools are default-denied**.
+
+## Configuration
+
+`sentinel.yaml` (created by `sentinel init`):
+
+```yaml
+servers:                      # YOUR MCP servers — SENTINEL ships no tools
+  - name: github
+    url: https://mcp.example/gh
+policy: ./policy.yaml         # your rules; generate with `sentinel scaffold`
+host: 127.0.0.1
+port: 8765
+dashboard: false              # the bundled UI is a DEMO, opt-in only
+catalogue_strict: true        # refuse catalogues containing injection markers
+```
+
+Precedence is **CLI flag > environment variable > config file > default**, so a
+container can override a checked-in file. Every key has an env equivalent
+(`SENTINEL_MCP_SERVERS`, `SENTINEL_POLICY_FILE`, …) — see [`.env.example`](./.env.example).
+
+### Writing policy
+
+Rules are **deny-only**: a call is allowed when no deny rule matches. `sentinel
+scaffold` emits every discovered tool explicitly denied, with its description and a
+recommended starting rule, so you edit rather than invent.
+
+```yaml
+policy_version: 1
+tools:
+  send_email:
+    rules:
+      - id: block-untrusted-origin
+        deny_if: "RETRIEVED_CONTENT in effective_provenance"
+      - id: domain-allowlist
+        deny_if: "recipient_domain not in allowed_domains"
+  delete_record:
+    rules:
+      - id: never
+        deny_always: true
+```
+
+Predicates support `== != < >= in "not in"`, set literals (`{USER}`), tool arguments,
+and config values.
+
+## Deployment
+
+```bash
+docker build -t sentinel -f deploy/Dockerfile .
+docker run --rm -p 8765:8765 -v $(pwd)/sentinel.yaml:/app/sentinel.yaml sentinel
+```
+
+Put your tool servers on an internal network reachable **only** by SENTINEL — that
+topology is what makes interception unbypassable. An Azure Container Apps blueprint
+(internal-ingress tool servers, KEDA scaling, managed identity, Cosmos persistence)
+is in [`deploy/`](./deploy).
+
+Gate the endpoint on any public deploy with `SENTINEL_API_TOKEN`.
+
+## Try the demo
+
+A bundled demo shows the whole pipeline on a scripted attack — useful for seeing what
+a block looks like, but **not** the product surface:
+
+```bash
+sentinel serve --dashboard     # → http://localhost:8765
+```
+
+Hosted: **https://sentinel-i63x.onrender.com** (free tier — first load may take ~50 s
+to wake). A poisoned page induces the agent to email a synthetic customer record to an
+attacker; the Layer-1 filter misses the obfuscated variant and authorization blocks it
+anyway. All demo data is synthetic — the record is a labelled fake
+(SSN `000-00-0000`, a non-functional `sk-synthetic-DO-NOT-USE` key) and `send_email`
+writes to an in-memory sink. Nothing is ever sent.
+
+### With a real model
+
+The default agent is a real LLM whenever a credential is present — set
+`OPENAI_API_KEY`, or `AZURE_OPENAI_ENDPOINT` + `AZURE_OPENAI_DEPLOYMENT`. With no
+credential it falls back to a deterministic scripted transcript so CI stays key-free.
+For a free local model, point `OPENAI_BASE_URL` at any OpenAI-compatible endpoint:
+
+```bash
+ollama serve && ollama pull llama3.2
+export OPENAI_BASE_URL=http://localhost:11434/v1 OPENAI_MODEL=llama3.2
+```
+
+## What SENTINEL does *not* protect against
+
+Stating the boundary precisely is what separates a security product from a demo.
+
+- Provenance is tracked at **message / tool-result granularity**, not token-level
+  inside model reasoning. Taint spreads conservatively unless a sanitizer clears it.
+- It secures the **action layer**, not the model's cognition. It does not stop a model
+  being *persuaded* — it stops the resulting unauthorized **action**.
+- The proxy and the policy store are **trusted** components.
+- One trace is handled by one proxy instance; horizontal scaling is *across* traces.
+- **Conservative tainting is intentional.** Some benign workflows will need explicit
+  sanitization. Taint saturation is the correct bias for action-layer security.
+- **Sanitization is syntactic, not semantic.** A schema-valid `{"price": 999999}` is
+  well-formed but still subject to argument-level rules such as an amount cap.
+
+## Development
+
+```bash
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev]" -c versions.lock   # Windows: .venv\Scripts\python.exe
+.venv/bin/python -m pytest        # 370 tests
+.venv/bin/python -m ruff check src tests
+.venv/bin/python -m mypy src      # strict
+```
+
+Install `-c versions.lock` so local matches CI and the container — a floating
+dependency is how a production deploy once broke. Requires Python 3.11+.
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for the security invariants a change must
+preserve, and [CHANGELOG.md](./CHANGELOG.md) for release notes. Design notes live in
+[`docs/`](./docs): the scoping analysis for proxying arbitrary MCP servers, and the
+competitive/threat-landscape research behind the roadmap.
+
+## License & credits
+
+MIT — see [LICENSE](./LICENSE).
+
+Built on the [Model Context Protocol](https://modelcontextprotocol.io) Python SDK,
+FastAPI, Starlette, `sse-starlette`, Uvicorn, Pydantic, OpenTelemetry, PyYAML, httpx,
+pytest, ruff, mypy, gitleaks, and the Azure SDKs for Python. Thank you to their
+maintainers.
+
+**AI tools used in development:** Claude Code (Anthropic) and GitHub Copilot.
+SENTINEL also *integrates* Azure OpenAI (attack classification) and Azure AI Content
+Safety / Prompt Shields (Layer-1 screening) as optional components.
+
+Originally built for the Microsoft Build AI Hackathon 2026 — *Security in the Agentic
+Future* — by Pali Krishna Harshith.

sentinel_prox-0.1.0/README.md

@@ -0,0 +1,208 @@
+# SENTINEL
+
+**A provenance-aware security proxy for AI agents.** It sits between your agent and
+your MCP tool servers, tracks where every byte of context came from, and refuses
+actions whose data originated in untrusted content — even when the attack slipped
+past your content filter.
+
+```bash
+pip install sentinel-prox    # imports and CLI are both `sentinel`
+sentinel init             # write sentinel.yaml
+sentinel check            # validate config, connect to your servers, vet their tools
+sentinel scaffold > policy.yaml
+sentinel serve            # your agent points at http://127.0.0.1:8765/mcp
+```
+
+Your agent needs **no code changes**: point its MCP endpoint at SENTINEL instead of
+directly at your tool servers. Interception is guaranteed by topology, not by asking
+the agent to cooperate.
+
+---
+
+## The problem
+
+AI agents don't just answer questions any more — they send email, query business
+systems, and read the open web. That makes **indirect prompt injection** an action
+problem, not a text problem: an attacker hides an instruction inside content the
+agent will read, and it executes with the agent's full privileges.
+*"Summarize this pricing page"* quietly becomes *"email this customer's SSN to the
+attacker."*
+
+Content filters scan the words. Microsoft's own Prompt Shields documentation says it
+"may not catch all attack vectors" and recommends additional validation layers.
+**The gap: security is applied to the words, while the damage is done by the actions.**
+
+SENTINEL closes it by judging an action on **where its data came from**, not on how
+the request was phrased.
+
+## What it protects against
+
+| Attack | How SENTINEL stops it |
+|---|---|
+| **Indirect prompt injection** | Actions whose lineage includes untrusted content are denied — regardless of phrasing, so obfuscation doesn't help |
+| **Data exfiltration** | A `send_email` built from a retrieved page is refused before it executes |
+| **Tool poisoning** | Tool descriptions *and* input schemas are scanned at connect; a poisoned catalogue is refused |
+| **Cross-server shadowing** | Two servers claiming one tool name fails closed — SENTINEL won't guess which is authoritative |
+| **Rug pulls** | The catalogue is fingerprinted at approval and re-checked; post-approval mutation is detected |
+| **Privilege escalation** | Unknown tools are default-denied until you write a rule |
+| **Repeated abuse** | A trust score degrades on blocked calls and quarantines the agent |
+
+Every decision becomes an immutable, replayable forensic record, exportable as
+SIEM-ready JSONL.
+
+## How it works
+
+```
+ your agent  ──MCP──▶  SENTINEL  ──MCP──▶  your MCP servers
+                          │
+       1. trace    label the origin of everything the agent has seen
+       2. authorize  policy decides each call using that lineage (deny-overrides)
+       3. contain   trust score + automatic quarantine
+       4. record    immutable spans → replay + SOC export
+```
+
+Provenance is a **set of trust labels** (`SYSTEM > USER > AGENT > RETRIEVED_CONTENT`)
+unioned over an action's transitive `derived_from` ancestry — computed by a real
+cycle-safe graph walk, not a mutable flag. An action is tainted iff
+`RETRIEVED_CONTENT` is in that set. Taint clears only through an explicit, auditable
+`StructuredExtractor` (strict schema validation produces a fresh SYSTEM-trust value
+with no inherited ancestry), and a sanitized value **cannot launder a tainted
+sibling** — recombination re-taints.
+
+Policy compiles to a **typed condition AST** and is evaluated by tree-walk;
+there is no `eval` anywhere in the codebase. Rules are deny-only with
+deny-overrides, and **unknown tools are default-denied**.
+
+## Configuration
+
+`sentinel.yaml` (created by `sentinel init`):
+
+```yaml
+servers:                      # YOUR MCP servers — SENTINEL ships no tools
+  - name: github
+    url: https://mcp.example/gh
+policy: ./policy.yaml         # your rules; generate with `sentinel scaffold`
+host: 127.0.0.1
+port: 8765
+dashboard: false              # the bundled UI is a DEMO, opt-in only
+catalogue_strict: true        # refuse catalogues containing injection markers
+```
+
+Precedence is **CLI flag > environment variable > config file > default**, so a
+container can override a checked-in file. Every key has an env equivalent
+(`SENTINEL_MCP_SERVERS`, `SENTINEL_POLICY_FILE`, …) — see [`.env.example`](./.env.example).
+
+### Writing policy
+
+Rules are **deny-only**: a call is allowed when no deny rule matches. `sentinel
+scaffold` emits every discovered tool explicitly denied, with its description and a
+recommended starting rule, so you edit rather than invent.
+
+```yaml
+policy_version: 1
+tools:
+  send_email:
+    rules:
+      - id: block-untrusted-origin
+        deny_if: "RETRIEVED_CONTENT in effective_provenance"
+      - id: domain-allowlist
+        deny_if: "recipient_domain not in allowed_domains"
+  delete_record:
+    rules:
+      - id: never
+        deny_always: true
+```
+
+Predicates support `== != < >= in "not in"`, set literals (`{USER}`), tool arguments,
+and config values.
+
+## Deployment
+
+```bash
+docker build -t sentinel -f deploy/Dockerfile .
+docker run --rm -p 8765:8765 -v $(pwd)/sentinel.yaml:/app/sentinel.yaml sentinel
+```
+
+Put your tool servers on an internal network reachable **only** by SENTINEL — that
+topology is what makes interception unbypassable. An Azure Container Apps blueprint
+(internal-ingress tool servers, KEDA scaling, managed identity, Cosmos persistence)
+is in [`deploy/`](./deploy).
+
+Gate the endpoint on any public deploy with `SENTINEL_API_TOKEN`.
+
+## Try the demo
+
+A bundled demo shows the whole pipeline on a scripted attack — useful for seeing what
+a block looks like, but **not** the product surface:
+
+```bash
+sentinel serve --dashboard     # → http://localhost:8765
+```
+
+Hosted: **https://sentinel-i63x.onrender.com** (free tier — first load may take ~50 s
+to wake). A poisoned page induces the agent to email a synthetic customer record to an
+attacker; the Layer-1 filter misses the obfuscated variant and authorization blocks it
+anyway. All demo data is synthetic — the record is a labelled fake
+(SSN `000-00-0000`, a non-functional `sk-synthetic-DO-NOT-USE` key) and `send_email`
+writes to an in-memory sink. Nothing is ever sent.
+
+### With a real model
+
+The default agent is a real LLM whenever a credential is present — set
+`OPENAI_API_KEY`, or `AZURE_OPENAI_ENDPOINT` + `AZURE_OPENAI_DEPLOYMENT`. With no
+credential it falls back to a deterministic scripted transcript so CI stays key-free.
+For a free local model, point `OPENAI_BASE_URL` at any OpenAI-compatible endpoint:
+
+```bash
+ollama serve && ollama pull llama3.2
+export OPENAI_BASE_URL=http://localhost:11434/v1 OPENAI_MODEL=llama3.2
+```
+
+## What SENTINEL does *not* protect against
+
+Stating the boundary precisely is what separates a security product from a demo.
+
+- Provenance is tracked at **message / tool-result granularity**, not token-level
+  inside model reasoning. Taint spreads conservatively unless a sanitizer clears it.
+- It secures the **action layer**, not the model's cognition. It does not stop a model
+  being *persuaded* — it stops the resulting unauthorized **action**.
+- The proxy and the policy store are **trusted** components.
+- One trace is handled by one proxy instance; horizontal scaling is *across* traces.
+- **Conservative tainting is intentional.** Some benign workflows will need explicit
+  sanitization. Taint saturation is the correct bias for action-layer security.
+- **Sanitization is syntactic, not semantic.** A schema-valid `{"price": 999999}` is
+  well-formed but still subject to argument-level rules such as an amount cap.
+
+## Development
+
+```bash
+python -m venv .venv
+.venv/bin/python -m pip install -e ".[dev]" -c versions.lock   # Windows: .venv\Scripts\python.exe
+.venv/bin/python -m pytest        # 370 tests
+.venv/bin/python -m ruff check src tests
+.venv/bin/python -m mypy src      # strict
+```
+
+Install `-c versions.lock` so local matches CI and the container — a floating
+dependency is how a production deploy once broke. Requires Python 3.11+.
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md) for the security invariants a change must
+preserve, and [CHANGELOG.md](./CHANGELOG.md) for release notes. Design notes live in
+[`docs/`](./docs): the scoping analysis for proxying arbitrary MCP servers, and the
+competitive/threat-landscape research behind the roadmap.
+
+## License & credits
+
+MIT — see [LICENSE](./LICENSE).
+
+Built on the [Model Context Protocol](https://modelcontextprotocol.io) Python SDK,
+FastAPI, Starlette, `sse-starlette`, Uvicorn, Pydantic, OpenTelemetry, PyYAML, httpx,
+pytest, ruff, mypy, gitleaks, and the Azure SDKs for Python. Thank you to their
+maintainers.
+
+**AI tools used in development:** Claude Code (Anthropic) and GitHub Copilot.
+SENTINEL also *integrates* Azure OpenAI (attack classification) and Azure AI Content
+Safety / Prompt Shields (Layer-1 screening) as optional components.
+
+Originally built for the Microsoft Build AI Hackathon 2026 — *Security in the Agentic
+Future* — by Pali Krishna Harshith.

sentinel_prox-0.1.0/pyproject.toml

@@ -0,0 +1,141 @@
+[build-system]
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
+
+[project]
+# Distribution name only — the import package and CLI command are both `sentinel`.
+# (`sentinel`, `sentinel-mcp`, `mcp-sentinel` and `sentinel-proxy` were all
+# unavailable on PyPI, so the published distribution is `sentinel-prox`.)
+name = "sentinel-prox"
+version = "0.1.0"
+description = "Provenance-aware security proxy for AI agents: block prompt-injection actions at the MCP tool boundary."
+requires-python = ">=3.11"
+authors = [{ name = "Pali Krishna Harshith" }]
+readme = "README.md"
+license = { text = "MIT" }
+keywords = [
+    "mcp", "model-context-protocol", "ai-security", "prompt-injection",
+    "ai-agents", "llm-security", "agentic-ai", "security-proxy",
+    "information-flow-control", "provenance",
+]
+classifiers = [
+    "Development Status :: 4 - Beta",
+    "Intended Audience :: Developers",
+    "Intended Audience :: System Administrators",
+    "License :: OSI Approved :: MIT License",
+    "Operating System :: OS Independent",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Application Frameworks",
+    "Topic :: System :: Networking :: Monitoring",
+    "Typing :: Typed",
+]
+
+# NOTE: keep `[project.urls]` (and every other sub-table) BELOW the plain keys of
+# `[project]` — in TOML, a table header ends the parent table, so anything after it
+# would be absorbed into the sub-table.
+
+# Phase 0 §3: dependencies are runtime-resolved.  pyproject.toml carries
+# minimum-floor constraints; the exact installed versions are written to
+# versions.lock and SDK facts to SDK_VERIFICATION.md.  BUILD_SPEC.md is NOT
+# mutated.
+dependencies = [
+    # Azure / Foundry
+    "azure-ai-projects==2.0.0",          # Foundry; AIProjectClient is THE entry point
+    "azure-identity>=1.17",
+    "azure-cosmos>=4.7",
+    "azure-monitor-opentelemetry>=1.6",
+
+    # MCP — official Python SDK (server + client)
+    "mcp>=1.2",
+
+    # OpenAI — exact pin written to versions.lock after resolve
+    "openai>=1.50",
+
+    # OpenTelemetry
+    "opentelemetry-api>=1.27",
+    "opentelemetry-sdk>=1.27",
+
+    # HTTP / SSE
+    "fastapi>=0.115",
+    "uvicorn[standard]>=0.32",
+    "sse-starlette>=2.1",
+    "httpx>=0.27",          # real web_fetch tool + Content Safety REST client
+
+    # Models / config
+    "pydantic>=2.9,<3",
+    "pyyaml>=6.0",
+]
+
+[project.urls]
+Homepage = "https://github.com/Harshith029/Sentinel"
+Repository = "https://github.com/Harshith029/Sentinel"
+Issues = "https://github.com/Harshith029/Sentinel/issues"
+Demo = "https://sentinel-i63x.onrender.com"
+
+[project.scripts]
+# The product surface: `sentinel init|check|scaffold|serve`.
+sentinel = "sentinel.cli:main"
+
+[project.optional-dependencies]
+dev = [
+    "pytest>=8.3",
+    "pytest-asyncio>=0.24",
+    "httpx>=0.27",
+    "pre-commit>=3.8",
+    "ruff>=0.6",
+    "mypy>=1.11",
+    "types-PyYAML>=6.0",   # stubs so `import yaml` type-checks under mypy --strict
+]
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+# Ship the canonical authorization policy and trust config with the package so
+# they are loadable via importlib.resources in both editable and wheel installs.
+"sentinel" = ["py.typed"]                # PEP 561: ship inline types to consumers
+"sentinel.authorization" = ["policies/*.yaml"]
+"sentinel.trust" = ["config.yaml"]
+"sentinel.control" = ["static/*.html", "static/fonts/*.woff2"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+addopts = "-ra --strict-markers --strict-config"
+asyncio_mode = "auto"
+filterwarnings = [
+    "error",
+    # azure-* and opentelemetry occasionally emit deprecation noise we do not own
+    "ignore::DeprecationWarning:azure.*",
+    "ignore::DeprecationWarning:opentelemetry.*",
+    "ignore::PendingDeprecationWarning:azure.*",
+    # anyio/mcp in-memory streams are closed at GC time, which pytest surfaces as
+    # an *unraisable* ResourceWarning. Under "error" this intermittently fails the
+    # suite depending on GC timing (benign on Windows, fails on the Linux runner).
+    # It is a third-party cleanup artifact, not a defect in our code — ignore it
+    # like the azure/opentelemetry noise above.
+    "ignore::ResourceWarning",
+    "ignore::pytest.PytestUnraisableExceptionWarning",
+]
+
+[tool.ruff]
+line-length = 100
+target-version = "py311"
+
+[tool.ruff.lint]
+select = ["E", "F", "I", "B", "UP", "ANN", "S"]
+ignore = [
+    "ANN101",  # missing self type
+    "ANN102",  # missing cls type
+    "S101",    # assert in tests is fine
+]
+
+[tool.ruff.lint.per-file-ignores]
+"tests/*" = ["S101", "ANN"]
+
+[tool.mypy]
+python_version = "3.11"
+strict = true
+plugins = ["pydantic.mypy"]

sentinel_prox-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

sentinel_prox-0.1.0/src/sentinel/__init__.py

@@ -0,0 +1,6 @@
+"""SENTINEL — provenance-aware MCP security proxy.
+
+See README.md for the architecture, threat model, and quick start.
+"""
+
+__version__ = "0.1.0"

sentinel_prox-0.1.0/src/sentinel/authorization/__init__.py

@@ -0,0 +1,11 @@
+"""Authorization engine (BUILD_SPEC §2B) — the policy backstop behind provenance.
+
+Predicates are parsed into a TYPED condition AST (:mod:`ast`) by a hand-written
+tokenizer/parser (:mod:`parser`) — never ``eval``. Policy is declarative,
+versioned YAML validated at LOAD time (:mod:`policy`). The engine
+(:mod:`engine`) resolves a proposed call against the policy with DENY-OVERRIDES
+precedence (any matching deny short-circuits; unknown tools default-deny) and
+emits a complete :class:`~sentinel.forensics.events.AuthorizationDecided`
+decision trace.
+"""
+from __future__ import annotations