Quickstart

SentnelOps gives every AI agent an identity, a policy, and a supervised path to your MCP servers. This page takes you from nothing to a governed MCP call in about five minutes.

New to SentnelOps or not a developer? Start with What is SentnelOps? and Connect your AI tools.

Three ideas carry the whole product: agents get identities (a registry with tokens, owners, and lifecycle), policies say what each agent may do (per MCP server, per tool), and a transparent proxy sits in front of your MCP servers to observe — and, when you choose, enforce — every call.

1. Create your org

POST /orgs/register

curl -s https://api.sentnelops.com/orgs/register \
  -H 'content-type: application/json' \
  -d '{"org_name":"Acme","email":"ada@acme.dev","password":"correct-horse-9"}'

# → { "org_id": "…", "api_key": "snops_key_…", "user": {…}, "token": "…" }

The api_key is shown exactly once. Store it in your secret manager — it is your org's machine credential and acts as an admin.

2. Register an agent

An agent is anything that calls tools on your behalf — a Claude Code session, a CI bot, an internal automation. Registration returns the agent's own JWT (also shown once):

POST /agents

export SNOPS_API_KEY=snops_key_…

curl -s https://api.sentnelops.com/agents \
  -H "Authorization: Bearer $SNOPS_API_KEY" \
  -H 'content-type: application/json' \
  -d '{
    "name": "ci-release-bot",
    "owner": "platform-team",
    "environment": "dev",
    "allowed_mcp": ["github-mcp"],
    "created_by": "ada@acme.dev"
  }'

# → { "agent": { "id": "…", "status": "active", … }, "token": "eyJ…" }

dev and staging agents activate immediately. production agents start as draft and need approval from someone other than their creator — see Lifecycle & audit.

3. Point the proxy at your MCP server

POST /mcp-servers

curl -s https://api.sentnelops.com/mcp-servers \
  -H "Authorization: Bearer $SNOPS_API_KEY" \
  -H 'content-type: application/json' \
  -d '{"name":"github-mcp","upstream_url":"https://api.github.com/mcp"}'

# → { …, "proxy_path": "/proxy/github-mcp/" }

4. The one-line change

In your agent's MCP configuration, swap the server URL for the proxy path and authenticate with the agent's token from step 2:

your agent's MCP config

# before
mcp_server_url: https://api.github.com/mcp

# after
mcp_server_url: https://api.sentnelops.com/proxy/github-mcp
authorization:  Bearer <agent token>

That's the integration. Every call is forwarded byte-identical (SSE streams are never buffered) and logged with the agent's identity, the tool it called, latency, and whether your policy would have blocked it. Nothing is blocked until you deliberately turn enforcement on.

5. Watch it live

GET /mcp-calls

curl -s "https://api.sentnelops.com/mcp-calls?limit=10" \
  -H "Authorization: Bearer $SNOPS_API_KEY"

Or open platform.sentnelops.com/calls for the live feed. The would_block column is the point: run in observe mode for a while, and the log tells you — with your own traffic — exactly what enforcement would do before you enable it.

Where to go next

Read Core concepts for the mental model, then Writing policies to go from server-level scopes to per-tool rules, blast radius, and the graduated path to runtime enforcement.

Next: Core concepts