Sentarion MCP server

by sammyboi81·io.github.sammyboi81/sentarion·v0.4.0

No reviews yet

Governed MCP orchestration, tamper-evident memory, and Claude Code Seatbelt hooks.

C65/100grade C

Write a review Install

What users say

No reviews yet

Be the first

Safety scan

C65/100

full report

Adoption

Growing

0 stars76 downloads/wk

Reviews

Write one

Nobody has reviewed Sentarion yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Sentarion tools (13, 2 write)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

cost_estimate
Predict token cost of an Algernon fan-out BEFORE dispatching.
dispatch_with_dependencieswrite action
Run tasks in dependency-ordered waves via Algernon (fan-out/fan-in).
govern
Ask the two-chamber gate (Humane + ArkHive) 'may I?' before acting. Rule-based, zero-LLM, fail-closed.
orchestrate_and_record
Two-chamber-govern-gated plan+dispatch via Algernon, auto-logged to both chains.
recall
Read prior context from BOTH chains and merge it, newest first, so the AI need not re-derive it.
recall_and_replan
Recall prior state from both chains, feed it into a new Algernon plan.
rememberwrite action
Write a tamper-evident record to BOTH chains at once (local Humane + hosted ArkHive). actor = the `actor` sentarion_birth returned (your birth name); each chain refuses an actor it has not born.
sentarion_birth
Earn an identity (Humane Law 5: born, not configured) before acting - on BOTH chains, the local chamber and hosted ArkHive. Returns `actor` (your birth name; it resolves to this identity on each chain) plus each chain's soul_id. Never crashes: a chamber that cannot answer is reported with a fix.
sentarion_doctor
Check that everything Sentarion needs is present and reachable (git, Algernon, local chamber, hosted ArkHive, fleet provider, Ollama, API key) and say exactly what to fix. Read-only; never prints secrets.
sentarion_pro
Sentarion v2 — the paid upgrade: in-process (no per-call subprocesses), concurrent two-chamber gate with inferred risk flags + stored policies, {{id}} data-flow dispatch, signed audit manifests, adversarial multi-agent code review, worktree sandbox with diffs, real cost estimates, progress + background jobs. Free 0.x stays whole. Details + trial key: https://inboxaxe.com/mcp
sentarion_quickstart
Canonical, runnable examples for every Sentarion capability: plan a feature, fan out research, dispatch with dependencies, use a worktree, remember a result, replan from memory.
verify
Prove BOTH audit chains (local Humane + hosted ArkHive) are unbroken.
worktree
Git-worktree sandbox skill: run dispatched work in an isolated worktree so it never touches the live checkout. action=create|list|remove. create/remove are two-chamber-governed; list is read-only.

Public scan report

scanner v0.1.10 · 2026-10-15 · same rubric, same numbers if you re-run it

no findings

Code scan14 source files scanned25/25
–Live reliabilityno gateway calls yet and no remote to proben/a
–Tool poisoningtools not inspected (local package is not executed); not countedn/a
Auth qualitylocal package, no credentials required12/15
Maintenancerepository not readable: repo not found3/15
Maintainer identityno repository or website to verify2/10

Overall 65/100. Components that don't apply are left out of the denominator. Any critical finding is an F.Rubric Appeal a finding JSON

How Sentarion compares

Against every graded MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score: 65/100; higher than 20% of 48,243 servers
Tools: 13; the typical server has 7
Tools that change things: 15%; typical: 0%. Fewer write tools means less an agent can break
Downloads a week: 76; more than 55% of 12,306 servers with a package

What its tools let an agent do: 11 read · 2 change

Release history: 2 versions in the registry since 2026-09-11, latest 2026-10-02, typically one every 21 days.

Install Sentarion in Claude Code, Cursor or VS Code

claude mcp add sentarion -- uvx sentarion-mcp

Add to Cursor

What the publisher says

From the Sentarion repository's README, as published. We do not edit it. Read it on GitHub

sentarion-mcp — Give your AI agents rules, memory, and receipts.

Install: pip install sentarion-mcp · Command: sentarion · Apache-2.0 · Hosted endpoint

Sentarion is the open-source MCP control layer for governed multi-agent work. It governs, records, and coordinates agent work across Claude Code, Codex, Cursor, local models, and any MCP-compatible client.

It composes three open-source MCP servers into one governed substrate — it connects to them as an MCP client, it does not reimplement them:

Algernon — fan-out planning/dispatch to cheap parallel workers on your key (or a free local Ollama, auto-detected since 0.2.2)
ArkHive — hosted, tamper-evident audit/memory chain
a local covenant chamber (Humane Intelligence, or the bundled arkhive-mcp package when Humane is not installed)

The first minute

Everything below was run, not written, against a clean pip install sentarion-mcp (2026-09-10).

you      > sentarion_birth(name="ember", covenant=["truth over comfort"])
sentarion> born_on: ["humane", "arkhive"]        # your local chain AND the hosted one; act as actor="ember"
you      > remember(actor="ember", action="decided: ship the 27-tool surface", data={"why": "87 was the tax"})
sentarion> humane:  immutably recorded · arkhive: immutably recorded
you      > verify()
sentarion> humane:  INTACT — context provably unbroken
           arkhive: INTACT — context provably unbroken

Now play the villain. Open ~/.sentarion/local_chamber.db and change one word of that record by hand (update blocks set action = replace(action, 'ship', 'cancel') where idx = 0). Then:

you      > verify()
sentarion> humane:  TAMPERED — 1 broken links

And the gate, with nothing configured:

you      > govern(action="delete the production database")
sentarion> block — Veto: irreversible -> refuse          (inferred_flags: ["irreversible"])
you      > govern(action="email all 4,000 customers a discount code")
sentarion> block — Veto: external_send -> refuse
you      > govern(action="write a summary file")
sentarion> approve

That is the whole idea. Your AI writes down what it did, reads it back next session, and a silent rewrite fails verification. Every record is hash-chained to the one before it; the hosted copy is a second witness. govern reads the obvious risks off the action text (delete / drop / force-push, send to everyone, pay, deploy to production), blocks them by default and fails closed when no chamber answers; orchestrateandrecord asks it first, fans work out to cheap workers and puts the receipt on the same chain.

Install

pip install sentarion-mcp

Then, from any MCP client, run sentarion_doctor. It checks git, Algernon, the local chamber, hosted ArkHive, the fleet provider, Ollama and your API key, reports ready: true when a run will work, and lists one fix per missing piece. It never prints a secret.

The seatbelt — hooks, not hope

An MCP tool only helps when the model decides to call it. sentarion seatbelt wires Claude Code (and Cursor, beta) hooks that run on every tool call whether the model remembers or not, using the same gate vocabulary and the same local chain as the server:

sentarion seatbelt install --client claude        # hooks + the sentarion MCP server + baseline policy
sentarion seatbelt check --command "rm -rf build"  # → ask (baseline) — what would the gate say?
sentarion seatbelt doctor                          # what is wired, the policies, and a live self-test
sentarion seatbelt recall                          # the project brief the next session will open with

Shortened. The full README is on GitHub.

Nothing above is checked by us. What we check is on the safety report.

Grade history

2026-10-15downgradeA → Cscore 65
2026-09-19restoreB → Ascore 92

Sentarion: common questions

Is Sentarion MCP server safe?: With care: it is graded C, so read the findings first (65/100). Read the Sentarion safety report
How do I install Sentarion?: It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Sentarion need an API key?: Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Sentarion maintained?: The last commit was 48 days ago (2026-09-19). The latest release is v0.4.0.
How does Sentarion compare with other MCP servers?: safety score 65/100 (higher than 20% of 48,243 servers); tools 13 (the typical server has 7); tools that change things 15% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.