[ FREQUENTLY ASKED ]
Questions about governing AI agents, answered.
Auditing agents, blocking MCP tool calls, gateway vs governance, VPC deployment, pricing — everything teams ask before putting an MCP firewall in front of their agents.
[ 10 QUESTIONS ON FILE ]
How do I audit what my AI agents did?
Every MCP tool call passes through the SentnelOps proxy before the MCP server sees it, and every call is logged with the agent identity, tool name, parameters, timestamp, the permit/block decision, and the exact policy rule that matched. Logs are stored in your own database — never ours — and export as CSV with a structure built for SOC 2 Type II evidence collection.
How do I block an MCP tool call?
Write a rule in a plain-YAML policy file that matches the agent, server, tool, or parameter condition, and set the action to block. Policies are version-controlled, GitOps-friendly, and testable in CI. The proxy evaluates every call against the policy before the MCP server ever sees it, so a blocked call never reaches the server — and the decision is logged with the rule that matched.
MCP gateway vs governance — what's the difference?
An MCP gateway routes, aggregates, and brokers connections to MCP servers — it answers 'how do my agents reach these servers?' Governance answers 'which agent did what, was it allowed, and can I prove it?' SentnelOps is the governance layer: per-agent identity, runtime YAML policy, inline block/approve enforcement, and audit evidence. It works alongside any gateway rather than replacing it.
Does my data leave my network?
No. SentnelOps deploys inside your own VPC with zero data egress. MCP call parameters, tool responses, and logs never transit our servers — all logs are written to your own database instance. You own the data, full stop.
Which agents and MCP servers are supported?
Any AI agent that speaks MCP — Claude Code, Cursor, or your own custom agents — and any MCP server, including GitHub, AWS, Postgres, and internal APIs. The proxy sits between the two, so no changes to the agent or the server are required.
How long does setup take?
Under 10 minutes from install to your first logged call. Deploy the proxy in your VPC, point your agents at it, and calls start flowing through with less than 15ms of p99 overhead.
What happens when a call is blocked?
The proxy stops the call before the MCP server sees it, returns a policy-denied response to the agent, and writes a log entry with the agent identity, tool, parameters, timestamp, and the policy rule that triggered the block. Nothing reaches the server, and you have a full record of the attempt.
Can a human approve a call before it runs?
Yes. Set any policy rule's action to require_approval instead of block. The call pauses, the approver gets a Slack DM with the full context — agent, tool, parameters — and the agent resumes only after explicit approval.
How long are logs retained?
Retention depends on your tier: 7 days on Scout (free), 90 days on Sentnel Starter, and 1 year on Command Team. Since logs live in your own database, you can also archive them on your own schedule.
How much does SentnelOps cost?
Scout is free: 1 MCP server and 1,000 calls per day. Sentnel Starter is $299/mo: 5 servers with unlimited calls. Command Team is $799/mo: 20 servers plus RBAC and a REST API for SIEM integration. Start free and upgrade when ready — or begin with the free 10-Day Agent Governance Assessment.
Still have questions?
Spin up SentnelOps in your VPC and get your first logged call in under 10 minutes — or watch it intercept a live agent first.