Metadata-Version: 2.5
Name: sentinelgate-core
Version: 0.1.2
Summary: An open-source security enforcement layer for agentic AI applications.
Project-URL: Homepage, https://github.com/xatrarana/sentinelgate
Project-URL: Documentation, https://github.com/xatrarana/sentinelgate/tree/main/docs
Project-URL: Repository, https://github.com/xatrarana/sentinelgate
Project-URL: Issues, https://github.com/xatrarana/sentinelgate/issues
Author: SentinelGate Contributors
License-Expression: Apache-2.0
License-File: LICENSE
Keywords: agent,ai,authorization,guardrails,llm,policy,prompt-injection,security,tool-security
Classifier: Development Status :: 3 - Alpha
Classifier: Intended Audience :: Developers
Classifier: License :: OSI Approved :: Apache Software License
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: Security
Classifier: Topic :: Software Development :: Libraries :: Python Modules
Classifier: Typing :: Typed
Requires-Python: >=3.8
Requires-Dist: pyyaml>=6.0
Provides-Extra: all
Requires-Dist: click>=8.0; extra == 'all'
Requires-Dist: mypy>=1.0; extra == 'all'
Requires-Dist: pytest-cov>=4.0; extra == 'all'
Requires-Dist: pytest>=7.0; extra == 'all'
Requires-Dist: ruff>=0.4.0; extra == 'all'
Provides-Extra: cli
Requires-Dist: click>=8.0; extra == 'cli'
Provides-Extra: dev
Requires-Dist: mypy>=1.0; extra == 'dev'
Requires-Dist: pytest-cov>=4.0; extra == 'dev'
Requires-Dist: pytest>=7.0; extra == 'dev'
Requires-Dist: ruff>=0.4.0; extra == 'dev'
Description-Content-Type: text/markdown

# SentinelGate

**Security between the agent and the real world.**

Your agent decides. SentinelGate authorizes.

---

SentinelGate is an open-source security enforcement layer that sits outside AI agents and independently evaluates prompts, context, tool calls, permissions, data flows, and agent actions before allowing them to affect real systems.

## The Problem

AI agents can browse the internet, read files, query databases, execute code, call APIs, and interact with external services. Existing model-level guardrails help identify unsafe prompts or outputs, but they are not an authorization layer.

SentinelGate operates on a simple principle:

> Prompts are instructions, not authorization.

The agent may decide what it wants to do. SentinelGate decides whether it is allowed to do it.

## Installation

```bash
pip install sentinelgate-core
```

## Quick Start

```python
from sentinelgate import SecurityGateway

# Load a policy
security = SecurityGateway(policy="sentinelgate.yaml")

# Check a tool call
decision = security.check_tool(
    agent="coding-agent",
    tool="shell.execute",
    arguments={"command": "git status"}
)

if decision.allowed:
    print("Tool execution permitted")
else:
    print("Denied:", decision.reason)
```

## What SentinelGate Does

- **Prompt Inspection** -- Detects prompt injection and jailbreak attempts using heuristic analysis
- **Tool Authorization** -- Controls which tools each agent can use, with argument validation
- **Policy Engine** -- YAML-based policies that are versioned, testable, and auditable
- **Secret Detection** -- Finds API keys, credentials, private keys, and PII in agent inputs/outputs
- **Risk Scoring** -- Assigns risk scores to actions and enforces thresholds
- **Human Approval** -- Routes high-risk actions to human reviewers before execution
- **Audit Logging** -- Records every security decision with structured JSON logs
- **Data Provenance** -- Tracks trust levels of data flowing through the agent

## Architecture

```
Application
    |
    v
  Agent
    |
    v
+---------------------------+
|       SENTINELGATE        |
|                           |
|  Input Inspection         |
|  Policy Evaluation        |
|  Tool Authorization       |
|  Argument Validation      |
|  Secret Detection         |
|  Risk Assessment          |
|  Human Approval           |
|  Audit Logging            |
+---------------------------+
    |
    v
ALLOW / DENY / REVIEW
    |
    v
  Tools / APIs / Systems
```

## Policy Example

```yaml
version: "1"

agents:
  coding-agent:
    filesystem:
      read:
        - "./src/**"
      write:
        - "./src/**"
    shell:
      allow:
        - "git"
        - "npm"
        - "python"
    network:
      allow:
        - "github.com"
    secrets:
      access: false

rules:
  - name: block_private_keys
    action: deny
    condition:
      data.type: private_key

  - name: block_system_files
    action: deny
    condition:
      filesystem.path:
        starts_with:
          - "/etc"
          - "/root"

risk:
  low:
    max: 3
    action: allow
  medium:
    max: 6
    action: log
  high:
    max: 8
    action: approval
  critical:
    max: 10
    action: deny
```

## Core API

```python
from sentinelgate import SecurityGateway

security = SecurityGateway(policy="policy.yaml")

# Inspect user input for injection/jailbreak
decision = security.inspect_input("user prompt here")

# Authorize a tool call
decision = security.check_tool(
    agent="my-agent",
    tool="filesystem.read",
    arguments={"path": "/etc/passwd"}
)

# Scan for secrets
findings = security.scan_secrets("AWS key: AKIAIOSFODNN7EXAMPLE")

# Redact sensitive data
clean = security.redact("My API key is sk-abc123xyz")

# Inspect agent output
decision = security.inspect_output("agent response text")
```

## CLI

```bash
# Validate a policy file
sentinelgate validate policy.yaml

# Scan text for secrets and injection
sentinelgate scan "some text to check"

# Simulate a tool authorization check
sentinelgate check-tool coding-agent shell.execute --args '{"command": "rm -rf /"}'

# Generate a starter policy
sentinelgate init
```

## Design Principles

1. **Framework independent** -- Works with any agent framework or custom agent loop
2. **Model independent** -- No dependency on any specific LLM provider
3. **Action-oriented** -- Evaluates what agents do, not just what they say
4. **Policy-as-code** -- Security policies are versioned, testable, and reviewable
5. **Open source** -- Inspect the enforcement logic, especially important for security

## Security Model

SentinelGate cannot guarantee that an agent will never be manipulated. No realistic prompt injection detector can make that claim.

Instead, SentinelGate limits the impact of agent manipulation through independent authorization, policy enforcement, data-flow controls, and human approval.

The architecture follows defense-in-depth: detection can fail, models can fail, policies can be misconfigured. Multiple layers reduce the impact of any single failure.

## License

Apache License 2.0 -- see [LICENSE](LICENSE) for details.
