Sentrail

Agent integration

MCP and coding agents

Generate a project-scoped Sentrail MCP token, configure Codex, Claude Code, Cursor, or Windsurf, and use 29 audited read and scan tools over Streamable HTTP.

Updated August 17, 2026

Connection details

  • Endpoint: https://sentrail.dev/api/mcp
  • Transport: Streamable HTTP
  • Authentication: project-scoped bearer token in the Authorization header.
  • Tool contract: 29 tools across readiness, repository security, database and deployment, and remediation.
  • Every tool call is written to the project's MCP audit log.

Generate a token

  1. 01

    Open the project

    Open the project's Agents or MCP access view.
  2. 02

    Name the token

    Use a name that identifies the client and device, such as “Cursor on MacBook”.
  3. 03

    Generate and copy

    Copy the token immediately. Sentrail stores its hash and cannot display the plaintext token again.
  4. 04

    Configure the client

    Add the endpoint and Authorization header to your coding agent, then restart the agent.
  5. 05

    Test access

    List tools and call get_project_status to verify the token and project scope.

Client configuration

Codex — ~/.codex/config.toml
[mcp_servers.sentrail]
url = "https://sentrail.dev/api/mcp"
bearer_token_env_var = "SENTRAIL_MCP_TOKEN"
Environment variable
SENTRAIL_MCP_TOKEN=your_project_token
Claude Code or Windsurf — mcp.json
{
  "mcpServers": {
    "sentrail": {
      "type": "http",
      "url": "https://sentrail.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer your_project_token"
      }
    }
  }
}
Cursor — ~/.cursor/mcp.json
{
  "mcpServers": {
    "sentrail": {
      "url": "https://sentrail.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer your_project_token"
      }
    }
  }
}

Tool groups and authorization

  • Readiness and context: verdicts, project overview, findings, scan history, database status, and deployment status.
  • Repository security: file listing and reading, code search, secret analysis, high-risk review, dependency audit, and deep scanning.
  • Database and deployment: RLS, advisors, read-only SQL, fix previews, posture audits, and DAST-lite.
  • Remediation: fix verification, fix planning, and bounded proposal creation.
  • Read tools inspect existing state; scan tools trigger metered checks or prepare state-changing work.

Rotate or revoke access

Create a separate token for each client or device so access can be revoked independently. Revoke a token immediately if it appears in source control, logs, chat, screenshots, or an untrusted system, then generate and configure a replacement.

Next

Documentation overviewReturn to all connection and workflow guides.