Turn your risky integrations back on — and still feel safe.
Give your coding agent shell, repo, web, and connector access again. Point your base URL at us, and each action it proposes gets scored before it runs. With your controls on, the one poisoned page that tries to exfiltrate your keys gets halted, not honored. No popups.
You already turned off the useful tools. Turn them back on.
If you build with Claude Code, Cursor, Codex, or n8n, you know the pattern: your agent reads an attacker-chosen page, a hidden instruction tells it to exfiltrate a secret, and by the time you notice the request has already left. The usual fix is to disable connectors and babysit every action. Sentisec makes the fix safety-first — so you can hook up email, shell, and web browsing, and let the loop run.
Connectors, re-enabled
Bash + web, together
The overnight job, unsupervised
The fast loop, intact
Point your base URL. Keep your agent loop.
One base-URL change, whether your agent talks through the Anthropic, OpenAI or AWS SDK. Each action it proposes is scored before it runs; with your controls on, the ones taken from a manipulated state are halted with a clear reason.
The check runs inline, before a proposed action reaches your agent. The time it adds depends on your provider and traffic, so we measure it with you on real calls.
# point your existing SDK at the Sentisec API$ export ANTHROPIC_BASE_URL=https://api.sentisec.ch$ export OPENAI_BASE_URL=https://api.sentisec.ch/v1
CLAUDE CODE · CURSOR · CODEX · N8N
What it does. What it doesn't (yet).
We'd rather you know before you ship than find out in production.
- In enforce mode, halts actions taken from a manipulated state — shell, fetch, connector, and filesystem calls — before they execute.
- Stops outbound actions whose destination is outside your workspace allowlist.
- Gates sensitive local actions by workspace policy, without turning every step into a manual approval.
- When a session closes, seals a signed, replayable evidence bundle or shows a visible recording failure, never a silent drop.
- Vendor server-side tools that execute inside the provider's own infrastructure are invisible to any external proxy, including ours.
- Genuinely in-scope, task-aligned actions are a fundamental limit of substrate-level defenses — no external monitor can read intent at perfect fidelity.
- Fast-moving editor surfaces are re-verified each release; between releases, a new action shape may briefly be best-effort.
- Local-model coverage varies per model — we detect and flag reduced-coverage sessions in the dashboard.
- On Amazon Bedrock, coverage is measured per model and API in our catalog. Other model ids pass through to AWS unmeasured, and images, documents and Bedrock's own guardrail settings are forwarded without inspection.
- CLAUDE CODE
- CURSOR
- CODEX
- N8N
See it block a live attack against your stack.
Book a 30-minute walkthrough — we run the live block, then answer your integration questions on the call. Want to read first? The docs cover every supported agent.