Mikoshi Sentinel
Prompt injection is unsolved
- Prompt injection is the #1 unsolved vulnerability in AI agents
- LLMs process instructions and data in the same channel — no hardware separation
- Current defences (input filtering, dual-LLM, system prompt hardening) are all probabilistic and bypassable
- Every defence operates at the prompt layer — exactly where the attacker has control
Don't fix the prompt — verify the action
- Separate the brain (LLM) from the security (deterministic code)
- Let the LLM do its job — then verify what it wants to do
- Deterministic policy checks can't be confused, manipulated, or hallucinated
Propose → Verify → Execute
LLM Proposes
LLM processes user input and proposes an action — a tool call, shell command, or API request.
Sentinel Checks
Sentinel runs 8 deterministic policy checks plus intent alignment analysis. Pure code, no AI.
Pass or Block
Only verified actions pass through. Blocked actions are logged with full explanations.
8 deterministic checks
No Privilege Escalation
Blocks attempts to spawn agents, access admin routes, modify configs.
No Data Exfiltration
Blocks sending user data to external URLs, detects encoded payloads.
No Internal Access (SSRF)
Blocks localhost, private IPs, internal network access.
No File Traversal
Blocks ../, ~/, symlink attacks, null bytes in paths.
No Dangerous Commands
Blocks rm -rf, shutdown, chmod 777, curl | bash.
Intent Alignment
Verifies action matches user's actual conversation intent.
Rate Limiting
Prevents rapid-fire automated attacks.
Scope Enforcement
Actions must stay within granted permissions.
Battle-tested
| Approach | Deterministic | Prompt-Proof | Action-Layer | Zero Overhead | No False Positives |
|---|---|---|---|---|---|
| 🛡️ Sentinel | Yes | Yes | Yes | Yes | Yes |
| Input Filtering | Partial | No | No | Yes | No |
| Dual-LLM | No | No | Partial | No | No |
| Instruction Hierarchy | No | No | No | Yes | No |
Three lines of code
npm install mikoshi-sentinelimport { Sentinel } from 'mikoshi-sentinel';
const sentinel = new Sentinel({ policies: 'all' });
// Verify any action before executing
const verdict = await sentinel.verify({
tool: 'exec',
args: { command: 'rm -rf /' }
}, context);
// verdict.allowed = false
// verdict.violations = ['system-commands: destructive command blocked']Express middleware:
app.use('/api/tools', sentinel.middleware());
// All tool calls now verified automaticallySelf-host for free, or let Nexus manage everything — auto-updated threat rules, audit dashboard, and every Synapse action verified automatically.
✅ Express middleware
✅ npm install
✅ Full source code
❌ Audit dashboard
❌ Custom policies
❌ Auto-updated rules
❌ Real-time alerts
Open source core. Managed via Nexus.
Self-host for free or get managed protection with Nexus Premium.