Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/patsypppe/sentinel/claude-mdgit clone --depth 1 https://github.com/patsypppe/sentinelWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00925 | $0.00925 |
| Opus 5 | $0.00463 | $0.00463 |
| Sonnet 5 | $0.00185 | $0.00185 |
| Haiku 4.5 | $0.00093 | $0.00093 |
Grade A, and why
sentinel CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sentinel — working instructions
Two products in one repository:
broker/— a Go MCP server built natively on the stateless MCP2026-07-28specification.harness/—sentinel, a Python conformance harness that grades any MCP server.
The spec is docs/HANDOFF.md (SN-HND-001). Where this repository and the
MCP specification disagree, the spec wins.
The four rules
- Stateless. Handles are data, never credentials. No session, nothing keyed by connection. Cross-call state is a server-minted handle passed as an ordinary tool argument. Possession of a handle is not authentication — every resolution re-verifies principal and tenant.
- No server-initiated requests. MRTR only, and it must be idempotent.
resultType: "input_required"+inputRequests; the client retries withinputResponses. Correlation is the sealedrequestState, never the JSON-RPC id. A duplicate retry returns the recorded result and performs zero additional side effects. - Deterministic where the spec asks for determinism. 100
tools/listcalls → one SHA-256. Every list/read result carriesttlMsandcacheScope.Mcp-Methodrequired on every POST;Mcp-Nameontools/call,resources/read,prompts/getonly. - Every invocation is audited; no token is trusted that was not issued for this server. Validate the audience exactly. Never forward an inbound token downstream. If the audit write fails, the invocation fails.
Never cut
resultType + serverInfo on every result · handle binding · MRTR idempotency · the audit row ·
the non-conformant fixture server.
Single-source files (audit the security posture by reading three files)
| File | Sole authority for |
|---|---|
broker/internal/envelope/errors.go |
every error code |
broker/internal/handles/resolve.go |
making a handle usable |
broker/internal/authz/audience.go |
accepting a token |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 70 lines · 925 tokens per session scan A 39cc4702a610
sentinel CLAUDE.md is an instructions file published in the GitHub repository patsypppe/sentinel (0 stars, last pushed 6d ago), licensed MIT. It adds 925 tokens to every session, about $0.0046 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
wardline CLAUDE.md
Instructions for kabirnarang39/wardline, covering wardline — engineering conventions, architecture: clean architecture, dependency rule inward, solid, applied concretely, feature-sliced structure, not layer-sliced and feature flags.
mcp-audit AGENTS.md
Instructions for P4ST4S/mcp-audit, covering agents.md, build, test, lint, project layout, code style and testing conventions.
mcp-audit CLAUDE.md
Instructions for P4ST4S/mcp-audit, covering claude code specific, working directory, verification reflexes the maintainer values, plan mode for surface changes and when asked to draft text the maintainer will post publicly.
ollama CLAUDE.md
Instructions for ollama/ollama: See AGENTS.md for the shared agent instructions for this repository.
azure-sdk-for-go go-code.instructions.md
Instructions for Azure/azure-sdk-for-go: All code should follow the guidelines from the Azure Go SDK Guidelines. This document is a summary of the most important guidelines to follow when contributing to the Azure Go SDK.
gorest AGENTS.md
Instructions for pilinux/gorest, covering agents.md, project overview, build and run commands, build and tidy dependencies.