Runtime governance & threat defence

Sentinel

part of SYNTHERA

Sentinel, part of SYNTHERA, is a security control plane for an agent estate: it watches tool calls and trajectories, classifies threats by deterministic pattern, shields data at the boundary, and streams governance events to a SIEM. It is deployed nowhere today, so read all of that as what the code does when you run it.

What it isMCP-native agent security control plane
WatchesTool calls, trajectories, data at the boundary
Streams toYour SIEM (CEF over TCP/TLS)
StageWorking prototype · containment built, not deployed
01

The outcome

Before

A compromised or misbehaving agent keeps acting until a human notices – usually from a log review, long after the damage is done.

After

Tool calls and trajectories are watched and threat-classified as they happen and streamed to a SIEM, so misbehaviour is caught rather than reconstructed. That is what the code does; it is not yet what anything does for you. Sentinel runs in no environment, and containment is further out still — built and audited, and unreachable without a provisioned identity that has never been issued.

Sentinel is the enterprise wedge beside the stack: it consumes the same identities and the same audit-of-record every other layer does, and is where they turn into defence. Written and driven from its own entrypoints against a stubbed substrate; running in no environment today.

02

How it works

Sentinel is organised as six bounded responsibilities over an agent estate. Together they observe, classify, protect, report and contain. All six are written and driven from their own entrypoints; none of them is running in any environment, so read every card below as what the code does when you run it, not as something watching an estate today.

RECON

See the estate

Discover and map the agents, tools and trajectories actually running, so there's a live picture to defend.

DETECT

Classify threats

Score tool calls and trajectories for threat patterns – prompt-injection, exfiltration attempts, protocol abuse – in real time.

SHIELD

Protect data

Shield sensitive data at the boundary, so a misbehaving agent can't quietly carry it out.

INTERCEPT

Catch protocol abuse

Intercept malformed or abusive protocol traffic before it reaches the tools an agent is calling.

SIGNAL

Stream to SIEM

Emit governance events to a SIEM as CEF over TCP/TLS – real egress in the demo, not a dashboard you have to watch. Not connected to anyone's SIEM today, because nothing is deployed.

CONTAIN

Contain – built, not shipped

Isolate an incident, revoke an identity, cut access. This is written, gated on a provisioned actor identity, and it writes an audit record carrying the substrate's own event id. It has never run outside a test: the mode that enforces it fails closed at boot on an identity that has not been issued, and it is deployed nowhere. Not roadmap, and not shipped.

Stated honestly Detection today is deterministic, pattern-based classification – fast and predictable, and not a learned classifier; that one is genuinely roadmap and nothing of it is written. Containment is the opposite case and the two should not be read as the same status: revocation and runtime isolation are coded, gated and audited, and unreachable, because the configuration that enforces them refuses to start without a provisioned identity that has never been issued. We would rather say "built and deployed nowhere" than "roadmap", which understates the code, or "shipped", which would be false. Threat monitoring, data shielding and SIEM streaming are exercised by the one-command demo and work when you run it. That is a claim about running the demo, not about a deployment: Sentinel is deployed nowhere in the estate and the four MCP servers have no launcher, so nothing here is watching anything today. Containment is worse off than the other five only in that it cannot be reached even locally without a provisioned identity — but "the rest works" would be read as "the rest is running", and it is not.
03

Proof

Sentinel ships a one-command demo that boots the control plane keyless, and the SIEM egress it performs is real – CEF over syslog/TLS, the format your security team already ingests. What follows is that demo. It is the only place any of this has run: there is no deployment of Sentinel to point at.

Example · detect → signal
sentinel demo
agent:researcher → tool:http.fetch(internal-creds-store)
  DETECT ....... exfiltration pattern   HIGH
  SHIELD ....... payload withheld at boundary
  SIGNAL ....... CEF event → SIEM  sent

# CONTAIN (revoke + isolate) – built and audited; not deployed anywhere

Threats are classified and streamed to your SIEM as they happen; containment is the next step, marked as such.

SYNTHERA is the trust layer for multi-agent systems: every agent gets a verifiable identity, scoped authority and a tamper-evident record, so software from different teams, vendors and frameworks can act on each other’s behalf without custom glue between every pair.

Talk to us about Sentinel.

Talk to us about Sentinel