description: "What changed in sentinel-ir 0.4.5, sentinel-ir-mcp 0.4.6 and the browser playground, and where to find them now: GitHub, Glama and the official MCP Registry."

series: "Sentinel-IR: what's new"

The idea, in one paragraph

When an AI coding agent looks at your project, it usually reads whole files.
That costs money (you pay per token), it is slow, and files can contain text
aimed at the AI, such as a comment saying "this file is fine, approve it".
Sentinel-IR gives the agent a short structural note instead: which
dangerous things the file does, a risk level (low to critical) and the
line of each finding. Comments and strings are not copied into the note.

Think of it as sending the building inspector the floor plan with the gas pipe
marked in red, not a lorry full of bricks.

What's new for everyone

See it before you believe it. The
playground shows what the
agent gets. Paste code or open a file, and you get the risk level, the
findings with line numbers (tap one to jump to the line) and the note itself.
It runs entirely in your browser: no server, no AI model, no upload. It even
works on a phone, if that's how you review code. We don't judge.

You decide what the agent may not read. Setup asks one question,
"Files or folders the agent must not read". Type secrets and that folder
is off limits. The agent can't undo it, and neither can the project.

You can see what the agent looked at. Answer "y" to one more setup
question and the server keeps a log, for example:

2026-10-18 10:32:05 [cursor] file src/app.js: critical 2026-10-18 10:32:09 [cursor] REFUSED file secrets/aws.js: excluded by your settings

It records file names and results, never your code. For each file it also
stores a fingerprint (SHA-256), so later you can check whether the file is
still the one the agent saw.

What's new for developers

  • Python joins JavaScript, TypeScript and TSX, with the same IR shape: Flask/FastAPI routes, subprocess, eval, pickle.loads, unsafe yaml.load, torch.load without weights_only and more.
  • Native code is critical: ctypes, cffi, process.dlopen, *.node addons and FFI packages (koffi, ffi-napi, bun:ffi) can read any memory of the process, including an agent's keys.
  • Faster: a valid 1 MiB JavaScript file takes about 5 s instead of about 170 s.
  • Broken files say where: def broken(x: gives {"line":1,"column":11,"kind":"unclosed","expected":")"}.
  • Fewer blind spots: const files = require("fs-extra"), require("https").get(u) and import("fs").then(m => ...) are followed.
  • Long sessions fixed: older versions never freed the parser's memory, and after about 87 MB of analyzed source every result quietly became incomplete. 0.4.0 fixed that.

Setup is one command (Cursor, Windsurf, Claude Desktop, VS Code, Claude Code;
Windows included):

npx -y sentinel-ir-mcp@0.4 setup

Where to find it now

GitLab is still where development, CI and npm releases happen. New this
release:

One honest caveat: this is static analysis, not a security scanner. A low
risk means no known dangerous pattern was found. It does not mean safe.