[ MCP FIREWALL ]
An MCP firewall stops bad tool calls before they execute.
Reading logs after an AI agent has already dropped a table or pushed to production is incident response, not security. SentnelOps intercepts every MCP tool call inline — evaluated against policy before the MCP server ever sees it.
[ WHY INLINE BEATS LOG-AFTER-THE-FACT ]
Most AI-agent observability tools tell you what happened. An MCP firewall decides what is allowed to happen. The difference matters because agent mistakes are irreversible at machine speed: by the time a log line shows an agent calling delete_repository with production parameters, the repository is gone. SentnelOps sits in the request path as a proxy between your agents and your MCP servers, so the dangerous call is evaluated — and blocked or paused — before it lands. Observability is the record. The firewall is the control.
[ HOW INTERCEPTION WORKS ]
< 15ms p99 proxy overhead · Deployed in your VPC · Zero data egress
The proxy runs inside your own VPC. Tool-call parameters, responses, and logs never transit SentnelOps servers — logs are written to your own database. Every agent starts with zero permissions; anything not explicitly granted is denied. Grants are scoped per agent identity, per MCP server, per condition.
[ WHAT A POLICY DECISION LOOKS LIKE ]
Policies are plain YAML — version-controlled, GitOps-friendly, and testable in CI. A rule names an agent, a server, a tool pattern, optional parameter conditions, and an action:
- agent: deploy-bot
server: github
tool: merge_pull_request
when: { branch: main }
action: require_approval # Slack DM with full context
- agent: deploy-bot
server: postgres
tool: "*"
action: block # zero trust: not granted, so deniedEvery intercepted call resolves to one of three outcomes. Learn how teams structure these rules on the runtime policy page.
Permit
The call matches an explicit grant. It passes through to the MCP server with under 15ms p99 of added latency, and the full call is written to your log.
Block
The call violates policy — wrong agent, wrong server, wrong parameters. It never reaches the MCP server. The agent gets a structured denial, and you get a Slack or email alert.
Pause for approval
Sensitive calls stop mid-flight. A Slack DM lands with full context — agent, tool, parameters — and the call proceeds only after a human explicitly approves it.
[ WHAT GETS LOGGED ]
Every call, permitted or blocked, in your own database
Each record captures six fields:
- agent identity— which agent made the call
- tool name— which MCP tool was invoked
- parameters— the exact arguments sent
- timestamp— when it happened
- decision— permit or block
- policy rule matched— why the decision was made
The full log exports as CSV, structured for SOC 2 Type II evidence. See audit evidence for how teams hand this to auditors.
Put a firewall in front of your agents today
Follow the quickstart and see your first MCP call logged in under 10 minutes. Scout is free; Sentnel Starter is $299/mo and Command Team is $799/mo — paid tiers start when you’re ready. Or see what your agents can actually do first — we run a 10-day governance assessment in your own VPC.
Related: agent identity · runtime policy · audit evidence