skills.rest
soy-rafa
soy-rafaCOMMUNITY
Explore all skills by this author →
GitHub

mcp-sentinel

Block malicious tool calls and scan installed skills for vulnerabilities.

185|22|Updated Apr 12, 2026
Search Tags:#security#vulnerability scanning#credential exfiltration#malicious tool calls#reverse shells
One-click install
npx skills add https://github.com/soy-rafa/claude-mcp-sentinel --skill mcp-sentinel-soy-rafa
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: mcp-sentinel
Source: https://github.com/soy-rafa/claude-mcp-sentinel/tree/main
Command: npx skills add https://github.com/soy-rafa/claude-mcp-sentinel --skill mcp-sentinel-soy-rafa

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python3, jq, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

MCP Sentinel protects Claude Code and Cowork from malicious tool calls in real time, including credential exfiltration, known-bad domains, reverse shells, and dangerous commands.

Core Features & Use Cases

  • PreToolUse Hook: Blocks malicious tool calls before execution.
  • Runtime Protection: Stops credential exfiltration and reverse shells.
  • Whitelistable: Allows legitimate false positives to be ignored.
  • Static Scanner (v1): Scans installed skills for vulnerabilities and tampering.
  • Use Case: When installing a new skill, Sentinel scans it for security issues and alerts you if anything looks suspicious.

Quick Start

Install MCP Sentinel using the following command: bash hooks/install_hooks.sh --user.

Frequently Asked Questions about mcp-sentinel

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I block malicious tool calls and prevent credential exfiltration in Claude Code?▼

To block malicious tool calls and prevent credential exfiltration in Claude Code, you can use a real-time security hook that intercepts and stops dangerous commands before execution. MCP Sentinel provides this runtime protection.

How do I scan installed Claude Code skills for security vulnerabilities and tampering?▼

Scanning installed skills for security vulnerabilities and tampering involves running a static analyzer over your skill files. MCP Sentinel includes a static scanner that alerts you to suspicious code when installing new skills.

Do I need Python 3 and jq to run real-time security hooks for Claude Code?▼

Yes, you need Python 3 and jq installed in your environment to run these real-time security hooks. These dependencies are required to execute the protection scripts that block reverse shells and dangerous commands.

Can I whitelist legitimate tool calls that are falsely flagged as malicious by the security hook?▼

Yes, you can whitelist legitimate tool calls that are falsely flagged as malicious. MCP Sentinel is whitelistable, allowing you to ignore false positives so your workflow continues without interruption.

What is the best way to protect Cowork from reverse shells and dangerous commands?▼

The best way to protect Cowork from reverse shells and dangerous commands is to install a runtime security agent. MCP Sentinel offers a PreToolUse hook that blocks these threats in real time using a shell installation script.

Why does my static security scanner flag installed skills after I add them to Claude Code?▼

A static security scanner flags installed skills because it detects potential vulnerabilities or tampering in the new code. This alerts you to suspicious patterns before the skill can execute any malicious tool calls.

Related Skills

Explore More Software Engineering Skills→
vrcmsvrcms
1

continuous-learning

Extract reusable coding patterns and debugging techniques from AI session transcripts.

Community
Intermediate
VIethoangnguyenleVIethoangnguyenle

golang-lint

Configure golangci-lint for static analysis and code style enforcement in Go projects.

Community
Intermediate
rnaarlarnaarla

git-guardrails-claude-code

Block dangerous git commands in Claude Code via a PreToolUse hook.

Community
Intermediate
smartchainarksmartchainark
9

skill-security-audit

Scan installed Claude Code and OpenClaw skills for malicious patterns.

Community
Intermediate