MCP Sentinel
MCP Sentinel is an open-source Drupal module that governs what AI agents may do to a live site over the Model Context Protocol, JSON:API, and GraphQL. It decides what an agent may touch, hides what it must not see, records everything it does, and keeps the riskiest actions human-gated — so you can connect an agent to a real environment without it bypassing editorial or security controls.
How it works
Governance triggers on the validated OAuth agent channel — the consumer and token scopes on the request, checked server-side, never a spoofable header. Your public site and your own admin sessions are untouched. Each agent's role selects a policy profile, and every action is attributed to its account and written to an audit log.
What a profile controls
- Operation gates — independent read, write, delete, and GraphQL-mutation toggles, with publishing reserved for humans by default.
- Entity allow and deny lists — restrict an agent to specific entity types, or block sensitive ones (users are denied by default).
- Field and PII redaction — hide fields like
mailandpassfrom agent responses, and optionally mask emails, phone numbers, and other patterns in field values. - Open-redirect guard — stop an agent from pointing a redirect off-domain, with a per-profile host allowlist. Secure by default.
- Rate limits, quotas, and exfiltration caps — throttle traffic and cap how much data one call can pull, so a compromised token cannot bulk-export content.
- IP allowlisting — restrict agent connections to specific addresses or CIDR blocks.
Auditable by design
Every agent operation is recorded with user, IP, timestamp, and a redaction-aware diff of what changed. The log is a tamper-evident hash chain — drush mcp-sentinel:audit-verify detects any insertion, deletion, or edit of historical rows — with optional at-rest encryption and SIEM streaming. Content locks keep an agent from overwriting a page a person is editing.
Why it matters
Connecting an AI agent to a CMS is powerful and risky. Sentinel makes the connection bounded and provable: every write is checked against an explicit policy, denials are explained, the most consequential actions stay human-gated, and the whole trail is verifiable after the fact.
Source and license
Published on Drupal.org: drupal.org/project/mcp_sentinel. Maintained by Wilkes & Liberty — opensource@wilkesliberty.com.