Sentinely Docs

Install the package

pip install sentinely

Wrap your agent

from sentinely import protect

# Wrap any AI agent in one line
agent = protect(
    your_agent,
    task="Summarize quarterly reports"
)

Add your API key

# .env
SENTINELY_API_KEY=sntnl_live_...

THAT'S IT

Your agent is now protected. Sentinely monitors every action, blocks attacks automatically, and streams events to your dashboard in real time. No additional code required.

pip install sentinely

from sentinely import protect

protected = protect(
    agent,                  # Any agent object
    task,                   # str  — the agent's mission / system prompt
    policy="strict",        # "strict" | "monitor" | "permissive"
    agent_id=None,          # Optional str — stable ID across restarts
    org_id=None,            # Optional str — your organisation slug
    tracker=None,           # Optional MultiAgentTracker
)

import asyncio
from sentinely import protect

agent = protect(
    my_agent,
    task="Analyse customer churn data. Read-only. No external API calls.",
    policy="strict",
    agent_id="churn-analyst-v2",
)

# Synchronous
result = agent.run("Analyse churn for Q3")

# Async
result = await agent.ainvoke("Analyse churn for Q3")

# As callable
result = agent("Analyse churn for Q3")

COMING SOON

Native Python adapters for CrewAI, AutoGen and LlamaIndex. Sentinely will plug directly into your existing agent framework with zero code changes.

Blocks any action that scores above the risk threshold. Raises SentinelyBlockedError so you can handle it gracefully. Recommended for production.

Logs and scores every action but never blocks execution. Use during development or when rolling out Sentinely to an existing agent without changing its behaviour.

Allows all actions but attaches risk scores and reasons to each event. Useful for research, red-teaming, or building a baseline before switching to strict.

from sentinely.exceptions import SentinelyBlockedError

try:
    result = agent.run(user_input)
except SentinelyBlockedError as e:
    print(f"Blocked: {e.reason}")
    print(f"Risk score: {e.risk_score}")
    print(f"Attack type: {e.attack_type}")
    # Return a safe fallback response to the user

from openai import OpenAI
from sentinely import protect

client = OpenAI()

class MyAgent:
    def run(self, prompt):
        response = client.chat.completions.create(
            model="gpt-4",
            messages=[{"role": "user", "content": prompt}]
        )
        return response.choices[0].message.content

agent = MyAgent()
agent = protect(
    agent,
    task="Answer customer support questions about billing",
    policy="strict",
    agent_id="openai-support-agent"
)

result = agent.run("How do I update my payment method?")

pip install sentinely[langchain]

Wrap individual tools. Blocked calls return a safe string instead of throwing. Great for graceful degradation.

Attach to any LangChain agent executor. Throws SentinelyBlockedError on block, halting the agent.

One-liner convenience wrapper. Mirrors the Python protect_langchain() API. Installs the callback and returns the agent.

from sentinely import protect
from sentinely.adapters.langchain import (
    SentinelyTool, SentinelyCallbackHandler, protect_langchain,
)

# Option 1 — Tool wrapper (per-tool protection)
agent = protect(my_agent, task="Summarise quarterly reports", policy="strict")
safe_tool = SentinelyTool(your_tool, agent)

# Option 2 — Agent-wide callback
agent = protect(my_agent, task="Summarise quarterly reports", policy="strict", agent_id="my-agent")
handler = SentinelyCallbackHandler(agent)
executor = AgentExecutor(agent=..., tools=tools, callbacks=[handler])

# Option 3 — Convenience wrapper (recommended)
executor = protect_langchain(
    AgentExecutor(agent=..., tools=tools),
    task="Summarise quarterly reports",
    policy="strict",
    agent_id="my-agent",
)

LangChain is an optional dependency. Python: pip install sentinely[langchain] installs the extras. Node.js: install langchain and @langchain/core separately. They are peer dependencies.

Messages that slowly expand an agent's permissions or role beyond what was originally authorised.

Instructions that attempt to redefine the agent's identity, persona, or core behavioral constraints.

Many individually low-risk messages that together shift the agent's behavior significantly over time.

Requests for capabilities, access, or actions that fall outside the agent's original task scope.

import asyncio
from sentinely import protect, MultiAgentTracker
from sentinely.multi_agent import AgentMessage

tracker = MultiAgentTracker()

# Register each agent (async)
await tracker.register_agent(
    agent_id='agent-1',
    session_id='session-abc',
    system_prompt='Summarise financial reports',
)
await tracker.register_agent(
    agent_id='agent-2',
    session_id='session-abc',
    system_prompt='Send email summaries',
)

# Pass tracker into protect()
agent1 = protect(
    my_agent1,
    task='Summarise financial reports',
    agent_id='agent-1',
    tracker=tracker,
)

# Check drift scores (synchronous)
scores = tracker.get_all_drift_scores()
# {'agent-1': {'drift_score': 0, 'risk_level': 'stable'}}

Agent is behaving within its original constraints. No action required.

Suspicious patterns detected. Review recent inter-agent messages in the dashboard.

Significant drift detected. Monitor closely and consider pausing the agent for review.

Agent is compromised. All further messages to this agent are blocked. Reset the fingerprint to resume.

Manipulation events appear in the dashboard with attack_type: 'manipulation'. Python field names use snake_case (drift_score, risk_level). Node.js uses camelCase (driftScore, riskLevel).

Action is within normal operating bounds. Agent is behaving as expected.

Action looks suspicious. Logged and surfaced in your dashboard. Agent continues but you should review.

Action is blocked. Agent receives an error. Slack/email alerts fire. Item appears in Quarantine if memory-related.

Malicious instructions embedded in external content trying to hijack the agent's behavior. Most common attack vector.

Attempts to write malicious instructions into the agent's long-term memory to influence future sessions.

Agent's actions gradually deviate from its original task. Often a sign of a slow multi-step manipulation.

One agent attempts to manipulate another in a multi-agent pipeline. Detected by behavioral fingerprinting.

# After calling an external tool:
result = await external_api.call(params)
agent.report_tool_response(
    tool_name="lookup_user",
    response_data=result,
    latency_ms=elapsed_ms,
    is_error=False,
)