Sentinel Scan is a one-time, authorized adversarial audit: 15+ real prompt-injection and data-exfiltration attacks run against your own system, with a plain-English report your engineers can act on the same day.
Free wedge: same 15-attack corpus we use below, no signup, no API key required to try it in demo mode. npx sentinel-scan-cli --demo or pipx install sentinel-scan-cli && sentinel-scan --demo · see the unedited report first →
Ran it and something got through? Tell us what the scan found →, we reply within one business day.
Run the CLI first. If it turns up something you want a written, framework-mapped report on, we'll scope a fixed-price managed audit. See pricing ↓, or tell us what the CLI found, we reply within one business day.
Don't want to leave the browser to run it? Have us run the scan for you →, done-for-you, email + your URL.
Want it running on a schedule instead of once? Join the continuous monitoring waitlist.
Already running the CLI in CI? Join the hosted dashboard waitlist →, a trend view across every PR and branch instead of per-run logs.
New: prompt injection basics + what EU AI Act Annex IV actually requires.
Just need the Annex IV evidence document, not the full audit? Register interest: Annex IV Evidence Lite →
Read the writeup: "We ran 15 prompt-injection attacks against a stock local LLM. It failed 3. Here's the free tool we built."
Mid a SOC2 AI addendum or a SIG/AI-CAIQ procurement questionnaire instead? See the auditor-ready evidence path →. Answering a buyer's security questionnaire specifically? Jump to the procurement path ↓. Already had an incident? Skip to the incident-response fast path ↓.
Not sure what pricing coming soon actually buys? See a full redacted sample of the Compliance Evidence Pack →
We ran a 15-attack pilot against a first-party test target to validate cost and methodology before offering this publicly. Results, unedited:
Our first-party pilot target defended against all 15 attacks in the corpus (direct override, roleplay/jailbreak, fake system tags, encoding tricks, indirect/RAG injection, and more), each scored by an independent LLM judge, not a keyword filter. A clean result doesn't mean the corpus is weak; it means this specific target's guardrails were tested and confirmed to hold under those attacks. We built this the honest way: a genuinely hardened target with no vulnerabilities to report on the first run, rather than a manufactured failure to make a flashier landing page.
The real value is the same either way: an independently-judged, transcript-backed answer to "does my LLM app leak under adversarial pressure," mapped to the OWASP LLM Top 10 and NIST AI 600-1 categories your security team already reports against. Run it yourself for free with the CLI, or have us run the fixed-scope managed audit and write the report for you.
This isn't abstract risk. 2026 has had a steady drumbeat of real MCP breaches: the Asana MCP server flaw exposed roughly 1,000 organizations to cross-tenant data access, and the GitHub MCP server had a prompt-injection path that let a malicious issue exfiltrate private repository data. Researchers have tracked 30+ MCP-related CVEs in a single 60-day window, with command injection behind roughly 43% of them. That's the same category of failure this audit tests for.
One-time scan not enough? Join the continuous monitoring waitlist ↓, re-tested on a schedule instead of once.
If you're evaluating tools to scan MCP servers for tool poisoning and prompt-injection risk, this is the one question worth asking first: does the scanner execute your MCP server, and does it send anything off your machine?
| Tool | Layer | Network call | Executes your MCP server | OWASP mapping |
|---|---|---|---|---|
| sentinel-scan mcp | Static manifest analysis | None, ever | Never | OWASP LLM Top 10 + OWASP MCP Top 10, on every finding |
| Snyk Agent Scan (mcp-scan) | Static + dynamic (API-backed) | Requires a Snyk API token; sends scan data to Snyk's cloud | Yes, via --dangerously-run-mcp-servers for dynamic tool inspection |
Not natively OWASP-mapped |
| Cisco mcp-scanner (YARA-only / static mode) | Static: YARA pattern rules over tool manifests | One outbound HTTPS call fires even in this mode (see note below); the API and LLM analyzers are separately opt-in and gated behind their own keys | No, in static mode (reads pre-dumped tools/list JSON, zero subprocess executions, we verified this). Its stdio/remote/config subcommands do launch or connect to the live server first to fetch that manifest, same as most dynamic scanners, even with YARA as the only analyzer |
Not natively OWASP-mapped (no built-in OWASP LLM/MCP Top 10 tags in output) |
Snyk Agent Scan (the Invariant mcp-scan project, rebranded after Snyk's mid-2025 acquisition) now requires a Snyk API token to run, sends scan data to Snyk's cloud, and ships a --dangerously-run-mcp-servers flag that executes your configured MCP server commands for dynamic tool inspection. That's a real, documented capability, not a knock on the project, but it means the tool needs your credentials, your network, and your server actually running.
Cisco mcp-scanner (Apache-2.0, cisco-ai-mcp-scanner on PyPI) is a serious static-analysis competitor and we corrected this section after hands-on testing rather than just reading the source. We installed it in an isolated venv, monkey-patched Python's socket and subprocess layers to log every connection and every process spawn, and ran mcp-scanner static --tools sample.json --analyzer-filter yara_analyzer, the narrowest, most "offline" invocation the tool offers. Result: zero subprocess executions (confirmed, it never touches your MCP server in static mode), but one real DNS lookup and HTTPS connection to raw.githubusercontent.com on every run, regardless of which analyzer you select. The cause is a bundled dependency, not the YARA logic itself: mcp-scanner imports litellm unconditionally at startup (it's needed for the separate, opt-in LLM analyzer), and litellm fetches its model-pricing JSON from GitHub on import unless you set the undocumented LITELLM_LOCAL_MODEL_COST_MAP=True environment variable, which we confirmed suppresses it. So "YARA-only" is not "zero network call" out of the box, it's "zero network call if you also know to set an env var the CLI docs don't mention." We're correcting our earlier claim here: it doesn't ship "zero network calls in the code itself," it ships a network call from a dependency's import-time side effect that most users won't notice or disable. The static-mode zero-execution guarantee (never runs your MCP server) held up in our test and is real. It also doesn't ship OWASP Top 10 tagging on its findings the way ours and promptfoo/Giskard do, and getting to that YARA-only static mode requires a Python virtualenv plus a manifest dump step, versus one npx/pipx command for ours.
sentinel-scan mcp takes the opposite approach: it's a static manifest analyzer. It reads your MCP server's tool definitions and config and runs 10 heuristics against them (things like hidden-unicode instruction smuggling, tool-name shadowing, missing human-in-the-loop confirmation on sensitive tools, indirect injection surfaces) without ever starting, calling, or executing the server, and without any API token or outbound network call. Everything happens on your machine, on the manifest as written.
The tradeoff is honest, not a free lunch: static analysis can't catch what only shows up at runtime, and we say so in the docs. But if you want a first pass you can run in CI on every PR with zero credentials, zero server execution, and zero data leaving your infrastructure, that's what this is for. Read the full heuristic list and its limits →
pipx install sentinel-scan-cli && sentinel-scan mcp --demo
Enterprise procurement now routinely runs vendors through Shared Assessments SIG (Lite, ~128 questions, or Core, ~627 questions) with an AI module bolted on, or CSA's AI-CAIQ, both asking about MCP governance and agentic AI controls mapped to OWASP, NIST, ISO 42001, and the EU AI Act. If a deal is stuck because the buyer's security team wants proof you've adversarially tested the LLM feature they'd be relying on, that's exactly what this audit produces, addressed to a procurement reviewer instead of an auditor.
We turn the report around fast enough to attach directly to the questionnaire response, with findings tagged to the frameworks their checklist already cites.
If you've already had a prompt-injection or MCP-related incident (or found signs of one, like the Asana or GitHub MCP exposures above) and need remediation evidence fast, for an incident report, a customer, or a regulator, this skips the standard scoping queue. Tell us what happened and we'll get back same business day, not the usual one-business-day window.
Post-incident engagements get priority scheduling ahead of standard managed audits.
Start with the free CLI. It's the whole product for most teams. If it surfaces something you need a written, defensible report on for security or compliance, we scope a fixed-price managed audit from there, we don't sell the managed audit cold.
pipx install sentinel-scan-cliNot a lead-in to a sales call: this is a complete, standalone tool most teams never need to go past.
Get the free CLI on GitHub →Same free scan, we just run it for you instead of you running it locally.
Scope (and price within the range) depends on endpoint count and attack-surface complexity, set after you tell us what the CLI found. No subscription, no hidden fees, invoiced via Stripe.
Tell us what the CLI found