EVIDIQ Sentinel

EVIDIQ Sentinel

Security preflight for MCP servers and Agent Skills.

Inspect · Score · Sign — verify agent infrastructure before trust, credentials, or funds are exposed.

evidiq.dev · Sentinel Docs · Sentinel Repository

An agent can discover an MCP server or Skill in seconds. Determining whether thatservice contains hidden instructions, dangerous capabilities, credential exposure,or conflicting behavior should happen before the agent connects to it.

EVIDIQ Sentinel is the security and compliance preflight layer for the agenteconomy. It scans remote MCP endpoints, supplied MCP manifests, Agent Skills,and multi-target bundles. Each scan produces a deterministic PASS, REVIEW, orBLOCK verdict, a score from 0–100, actionable findings, and a signed report.

Sentinel can also request a semantic review from GLM 5.2 through 0G ComputeTEE. That review is advisory: deterministic static rules alone determine thescore and verdict. Signed reports can be anchored to 0G Storage on a best-effortbasis.

What it does

• MCP endpoint inspection — safely introspects a public remote MCP service and evaluates its exposed metadata.
• Manifest analysis — scans supplied tools, prompts, resources, and capability declarations without executing them.
• Agent Skill review — examines Skill markdown or an HTTPS source for unsafe instructions and capability mismatches.
• Bundle analysis — evaluates several targets together for shadowing, conflicts, and cross-service risk.
• Deterministic decisions — static rules, not model output, produce every score and verdict.
• Verifiable reports — EIP-191 signatures protect report integrity and support offline verification.
• Optional evidence anchoring — signed report evidence can be recorded on 0G Storage when configured.
• Pay per scan — four scan tools cost 0.02 USDT0 each; four discovery and verification tools are free.

Use it from any agent

# Read the public Skill document
curl -s https://mcp.evidiq.dev/sentinel/skill.md

# Inspect current x402 requirements
curl -s https://mcp.evidiq.dev/sentinel/x402

# Connect the remote MCP server (Claude Code)
claude mcp add --transport http evidiq-sentinel https://mcp.evidiq.dev/sentinel/mcp

Public endpoints:

MCP tools

Paid scans

Free preflight and verification

How a scan works

1. Sentinel validates target type, URL scheme, payload size, and structural limits.
2. A paid tool must pass the configured x402 gate before scan execution.
3. The target is normalized, sanitized, and analyzed by deterministic security rules.
4. If enabled, GLM 5.2 reviews the sanitized material through 0G Compute TEE.
5. Advisory model observations are kept separate from deterministic scoring.
6. Static findings produce the final 0–100 score and PASS, REVIEW, or BLOCK verdict.
7. Sentinel signs the canonical report with EIP-191.
8. Sentinel attempts a best-effort 0G Storage anchor and returns the report.

Deterministic rules, advisory intelligence

Sentinel deliberately separates decision authority from model-assisted analysis.This prevents nondeterministic output from silently changing a security verdict.

The static rules cover risks including:

• prompt injection and instruction override;
• hidden instructions and tool poisoning;
• tool shadowing and cross-service behavior modification;
• credential, secret, and sensitive-data exposure;
• exfiltration paths and unexpected network behavior;
• dangerous file-system, process, or network capabilities;
• obfuscation and encoded payloads;
• declared-versus-observed capability mismatches;
• insecure transport and unsafe remote references;
• x402 metadata and payment-flow inconsistencies.

When semantic review is enabled, GLM 5.2 can add context and surface ambiguouspatterns that deserve human attention. It cannot raise or lower the deterministicscore and cannot replace the static verdict.

Report contract

Every completed scan returns a Sentinel report containing:

• the normalized scan target and report metadata;
• a deterministic score on the 0–100 scale;
• one verdict: PASS, REVIEW, or BLOCK;
• categorized findings with severity, evidence, and remediation;
• an EIP-191 signature over the canonical report;
• optional 0G Storage anchor metadata when upload succeeds;
• an advisory semantic-analysis trace when enabled and available.

Use the free verify_scan_report tool to verify signature integrity. A validsignature proves that the signed report has not been altered and identifies thesigning address. It does not guarantee that a target remains unchanged after thescan or that every future interaction is safe.

The 0G Storage anchor is best effort. A missing anchor does not change the staticverdict or invalidate an otherwise valid report signature.

Pricing and x402

Sentinel publishes an x402 v2 challenge using the exact scheme. Compatibleclients read the PAYMENT-REQUIRED response, authorize the requested USDT0amount, and retry with PAYMENT-SIGNATURE.

The live discovery response at/sentinel/x402 is authoritative for theactive asset, recipient, amount, and network. Payment availability depends on thedeployed settlement configuration and client compatibility; the publishedchallenge should not be treated as proof that every client or local fallback hascompleted a public settlement.

Architecture

flowchart TB
    agent["<b>AI agent</b><br/>MCP client"]
    request{"Scan request<br/>free or paid?"}
    agent -->|POST /sentinel/mcp| request

    free["Free preflight<br/>validate · estimate · verify"]
    gate["x402 v2 gate<br/>paid scan authorization"]
    xlayer[("X Layer<br/>USDT0 · eip155:196")]
    request -->|free helper| free
    request -->|paid scan| gate
    gate -. payment rail .-> xlayer

    subgraph sentinel["EVIDIQ Sentinel trust boundary"]
        direction TB
        normalize["1. Normalize & sanitize<br/>protocol · size · depth limits"]
        rules["2. Deterministic rules engine<br/><b>only score + verdict authority</b>"]
        report["3. Canonical SentinelReport<br/>findings · remediation · PASS / REVIEW / BLOCK"]
        sign["4. EIP-191 signature<br/>integrity + signer identity"]
        normalize --> rules --> report --> sign
    end

    free --> normalize
    gate --> normalize

    compute[("0G Compute TEE<br/>GLM 5.2 semantic review")]
    storage[("0G Storage<br/>best-effort evidence anchor")]
    normalize -. sanitized context .-> compute
    compute -. advisory context only .-> report
    sign -. best effort .-> storage

    response["<b>MCP response</b><br/>signed report + optional anchor metadata"]
    sign --> response

    classDef client fill:#312e81,stroke:#a78bfa,color:#ffffff,stroke-width:2px;
    classDef payment fill:#052e16,stroke:#4ade80,color:#ffffff,stroke-width:2px;
    classDef sentinel fill:#241b35,stroke:#8b5cf6,color:#ffffff,stroke-width:2px;
    classDef optional fill:#083344,stroke:#2dd4bf,color:#ecfeff,stroke-width:2px;
    classDef output fill:#4c1d95,stroke:#c4b5fd,color:#ffffff,stroke-width:2px;
    class agent,request client;
    class free,gate,xlayer payment;
    class normalize,rules,report,sign sentinel;
    class compute,storage optional;
    class response output;

Reading the diagram: solid arrows are required scan-path steps. Dashed arrowsare optional or advisory integrations. Only the deterministic rules engine setsthe score and PASS / REVIEW / BLOCK verdict; GLM 5.2 adds context to thereport but cannot change that decision. An unavailable 0G Storage anchor alsodoes not block a signed report.

Security boundaries

• Sentinel analyzes metadata and supplied content; it does not grant a scanned service trust or execute its advertised tools.
• Remote targets and retrieved content remain untrusted input and are subject to protocol, size, and depth limits.
• Secret-like values are detected and redacted from report evidence where applicable.
• Semantic review receives sanitized scan material and remains advisory.
• Deterministic output is canonicalized before signing for consistent integrity checks.
• EIP-191 signatures protect report authenticity; they do not certify the target's future behavior.
• 0G Storage anchoring is optional and best effort, not a prerequisite for a verdict.
• Re-scan a target after manifest, Skill, endpoint, ownership, or deployment changes.
• Apply human review before granting credentials, funds, write access, or irreversible authority.

Verification status

Sentinel's GLM 5.2 production inference path through 0G Compute has returnedteeVerified: true, and real 0G Storage report anchoring has been exercised.These checks verify the respective Compute and Storage paths. They do not turnadvisory model output into scoring authority and do not imply universal x402client compatibility.

EVIDIQ Sentinel is registered as OKX.AI Agent #7584. Its public listing iscurrently under review: view the agent page.

Self-host

Requirements: Node.js 22+ and npm.

# From source
npm install
npm run build
npm start

Or run the container:

docker build -t evidiq-sentinel .
docker run -d --name evidiq-sentinel -p 3000:3000 --env-file .env evidiq-sentinel

Local routes: POST /mcp · GET /skill.md · GET /x402 · GET /health

Configuration

Copy .env.example to .env and set only the integrations you use:

# Server
PORT=3000
HOSTNAME=0.0.0.0

# x402 v2 — X Layer mainnet / USDT0
X402_PRICE=20000
X402_ASSET=0x779ded0c9e1022225f8e0630b35a9b54be713736
X402_CHAIN=eip155:196
X402_PAY_TO=0x...
X402_DOMAIN_NAME=USD₮0
X402_DOMAIN_VERSION=1
X402_RPC_URL=https://rpc.xlayer.tech
X402_SETTLE_KEY=0x...

# Report signing
SENTINEL_PRIVATE_KEY=0x...

# Optional GLM 5.2 semantic review through 0G Compute
AI_ENABLED=false
OG_COMPUTE_API_KEY=...
OG_COMPUTE_BASE_URL=https://router-api.0g.ai/v1
OG_COMPUTE_MODEL=glm-5.2
AI_MAX_TOKENS=900
AI_TEMPERATURE=0.1
AI_TIMEOUT_MS=22000

# Optional best-effort 0G Storage anchoring
OG_PRIVATE_KEY=0x...
OG_STORAGE_RPC=https://evmrpc.0g.ai
OG_STORAGE_INDEXER=https://indexer-storage-turbo.0g.ai

With AI_ENABLED=false, Sentinel runs deterministic static analysis only. Ifx402 is not configured in a self-hosted deployment, the local discovery endpointreports that no payment gate is active.

Never commit .env files, signing keys, settlement keys, API keys, or scannedprivate material.

Development

npm install      # install dependencies
npm run build    # compile TypeScript to dist/
npm test         # run the test suite once
npm run dev      # start the local watch server

Links

• Website — https://evidiq.dev
• Sentinel documentation — https://evidiq.dev/docs/sentinel
• Live MCP endpoint — https://mcp.evidiq.dev/sentinel/mcp
• Agent Skill — https://mcp.evidiq.dev/sentinel/skill.md
• x402 discovery — https://mcp.evidiq.dev/sentinel/x402
• Service health — https://mcp.evidiq.dev/sentinel/health
• OKX.AI Agent #7584 — https://www.okx.ai/agents/7584
• EVIDIQ main repository — https://github.com/evidiq/evidiq
• EVIDIQ Notary — https://github.com/evidiq/evidiq-notary-mcp
• EVIDIQ Operator — https://github.com/evidiq/evidiq-operator
• 0G Labs — https://0g.ai
• x402 Protocol — https://x402.org

License

MIT © 2026 EVIDIQ — see LICENSE. Part of theEVIDIQ trust and execution layer for the AI agent economy.