MCP Server

Give your agent
a fraud analyst.

Sentinel speaks the Model Context Protocol. Point Claude, Cursor, or any MCP client at one URL and your agent can check any IP address for VPN, proxy, Tor and datacenter signals mid-conversation — no API key required for lookups.

Connect it

One HTTP endpoint, no install, no package to pull. Add this to your MCP client configuration:

// Claude Desktop / Claude Code — claude_desktop_config.json
{
  "mcpServers": {
    "sentinel": {
      "type": "http",
      "url": "https://sntlhq.com/mcp"
    }
  }
}

Or from the Claude Code CLI:

claude mcp add --transport http sentinel https://sntlhq.com/mcp
Transport: JSON-RPC 2.0 over HTTP POST. Send Accept: application/json, text/event-stream. The server identifies as sentinel v0.1.0 and advertises tools.listChanged.

The tools

Two, deliberately. Both are read-only and neither can mutate anything in your account.

lookup_ipKeyless
Check an IP address for fraud signals: VPN, proxy, Tor exit node, datacenter hosting, and anonymity. Returns an allow / review / block verdict, a 0–100 risk score, the individual signals, and network info (ASN, organization, country).
service_statusKeyless
Current operational status of the Sentinel API: uptime, per-service health, and measured processing latency. Useful for an agent that wants to check the source is healthy before trusting a verdict.

What an agent does with it

The interesting part is not the lookup, it's what the agent does around it. A support agent triaging a chargeback can check the order's IP without leaving the thread. A coding agent wiring up your signup flow can verify its own integration against a known Tor exit. An on-call agent investigating a traffic spike can classify the source in one step instead of pasting IPs into a web tool.

Try it in one line once connected:

You:  Is 185.220.101.34 a Tor exit node?
Agent: [calls sentinel.lookup_ip]
       Yes — Tor exit, datacenter-hosted, risk score 100, verdict: block.

Beyond lookups

The MCP tools cover IP reputation. The full verdict pipeline — device fingerprinting, antidetect-browser detection, multi-account linking and the combined risk decision — runs over the REST API with a key, which stays free for 1,000 calls an hour.

Read the API docs →

Wire the full pipeline into your app.
Free key, 1,000 calls/hour, no card.
Get a free API key → API reference