Build-time security scanning for MCP servers — static + GPT-reviewed + Docker-verified findings mapped to the OWASP Agentic Top 10, with SARIF/GitHub Action support.
Drift inferred · capture-to-capture
- HIGH code analysis flagged dynamic code execution ×2 in BashaarJavaid/MCP-Sentinel
transport stdio counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed commit e717e95 · analyzer v28 · 1d ago
skills & prompt files 1
- agent-rules BashaarJavaid-MCP-Sentinel-e717e95/AGENTS.md
danger signals2
- dynamic code execution eval()/exec() BashaarJavaid-MCP-Sentinel-e717e95/tests/fixtures/gpt_review_eval/server.py :17
return eval(expression) - dynamic code execution eval()/exec() BashaarJavaid-MCP-Sentinel-e717e95/tests/fixtures/vulnerable_server/server.py :27
return eval(expression)
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 69
filesystem 17
- fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/cli.py :7
import shutil - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/config.py :11
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/dynamic/sandbox.py :9
import shutil - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/llm/cache.py :8
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/llm/context.py :9
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/llm/semantic_reviewer.py :14
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/llm/tools.py :6
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/orchestrator.py :7
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/permissions.py :5
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/report/validate_sarif.py :7
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/schema.py :8
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/ast_utils.py :7
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/model.py :8
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/rules/sent005.py :8
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/rules/sent007.py :7
from pathlib import Path - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/semgrep_adapter.py :7
import shutil - fs BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/traversal.py :9
from pathlib import Path
shell / exec 2
- shell BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/dynamic/sandbox.py :10
import subprocess - shell BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/semgrep_adapter.py :8
import subprocess
network 1
- net BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/static/rules/sent001.py :6
from urllib.parse import urlparse
secrets 1
- secrets BashaarJavaid-MCP-Sentinel-e717e95/src/sentinel/cli.py :118
api_key=os.environ.get("OPENAI_API_KEY"),
declared dependencies 22
- mcp@==1.23.3
- jsonschema@>=4.25.1,<5
- openai@==2.46.0
- packaging@>=25.0,<26
- pathspec@>=1.1.1,<2
- platformdirs@>=4.10.0,<5
- pydantic@>=2.13.4,<3
- PyYAML@>=6.0.3,<7
- sarif-om@>=1.0.4,<2
- semgrep@==1.170.0
- tiktoken@>=0.12.0,<1
- typer@>=0.27.0,<1
- tomli@>=2.4.1,<3; python_version <
- build@>=1.5.0,<2
- mypy@>=1.20.2,<2
- pip-audit@>=2.10.1,<3
- pytest@>=8.4.2,<9
- pytest-cov@>=6.3.0,<7
- ruff@>=0.15.22,<1
- types-jsonschema@>=4.26.0.20260518,<5
- types-PyYAML@>=6.0.12.20260518,<7
- uv@==0.8.22