Skip to main content

Introduction

AI.Sentinel is security monitoring middleware for IChatClient (Microsoft.Extensions.AI). It wraps any LLM client transparently, scans every prompt and response through 56 detectors, plus 4 opt-in EU AI Act Art. 5 compliance detectors, and blocks, alerts, or logs threats — with an embedded real-time dashboard.

The problem​

When you connect an LLM to your application you inherit a new attack surface. Users can craft messages that override the model's instructions (prompt injection), the model can leak credentials or PII it saw in context (credential exposure), or return fabricated citations and wildly inconsistent numbers (hallucination). None of these are bugs in your code — they happen at the model boundary, which your existing middleware stack doesn't see.

AI.Sentinel sits at that boundary:

User prompt → [AI.Sentinel: scan] → LLM → [AI.Sentinel: scan] → Your app

It scans both directions on every call. If something looks wrong it can quarantine the message before it reaches the model, or quarantine the response before it reaches the user. If it only looks suspicious it alerts your logging/event system. Everything is stored in an in-process audit ring buffer and surfaced on a live dashboard.

Packages​

AI.Sentinel ships as 15 focused NuGet packages so you only take dependencies you need:

PackagePurpose
AI.SentinelCore — pipeline, 60 detectors, intervention engine, audit store
AI.Sentinel.Detectors.SdkSDK for writing and testing custom detectors — SentinelContextBuilder, FakeEmbeddingGenerator, DetectorTestBuilder
AI.Sentinel.AspNetCoreEmbedded dashboard (no JS framework, HTMX + SSE)
AI.Sentinel.Clidotnet tool install AI.Sentinel.Cli — offline replay CLI for forensics + CI, sentinel dashboard to browse the audit file the hooks and the MCP proxy write, and sentinel report for a compliance report from it
AI.Sentinel.SqlitePersistent SqliteAuditStore with hash-chain integrity
AI.Sentinel.AzureSentinelAzureSentinelAuditForwarder to Azure Monitor Logs Ingestion API
AI.Sentinel.OpenTelemetryOpenTelemetryAuditForwarder — vendor-neutral via OTel collector
AI.Sentinel.Approvals.SqliteSQLite-backed IApprovalStore — persistent approval state across CLI invocations and process restarts
AI.Sentinel.Approvals.EntraPimEntra PIM-backed IApprovalStore — delegates approval requests to Entra Privileged Identity Management via Microsoft Graph
AI.Sentinel.Mcp / .Mcp.CliStdio MCP proxy that scans tools/call + prompts/get for any MCP-speaking host
AI.Sentinel.ClaudeCode / .ClaudeCode.CliNative hook adapter for Claude Code's settings.json hooks
AI.Sentinel.Copilot / .Copilot.CliNative hook adapter for GitHub Copilot's hooks.json

What's next​

  • Installation — dotnet add package AI.Sentinel
  • Quick start — services.AddAISentinel(opts => ...) + .UseAISentinel()
  • Architecture — how prompt and response scans flow through the pipeline
  • Detector reference — what the 60 built-in detectors look for
  • Custom detectors — write and unit-test your own
  • EU AI Act — what AI.Sentinel provides per article, what is on by default, and the limits
  • Redaction — keep personal data and secrets away from the model
  • Transparency — mark replies as AI-generated and add a notice (Art. 50)
  • Compliance report — sentinel report turns the audit file into evidence per article