Verdict and limitations
Verified: normally installed VS Code invoked all three published Sentinel tools through Copilot Agent mode on Windows. Paths containing spaces and Czech characters worked. An outside-folder request was refused. No source changes or MRs.
Source (GitLab, Apache-2.0): https://gitlab.com/jakubrojicek11/sentinel-ir
npm: https://www.npmjs.com/package/sentinel-ir
Playground (runs in your browser): https://sentinel-ir-playground-dc30c8.gitlab.io/
Limitations: a dedicated per-tool checkbox picker was not located in this VS Code UI. Instead, the server menu showed it enabled/running, tool search returned all three tools, and all three were actually called. Screenshots and logs replace video by agreement; recording: none. The local MCP output contains startup/discovery, not per-call timings; timings below come from the Agent host log.
Environment and authentication
- Windows Server 2022; VS Code 1.146.0, official user installer; GitHub Copilot Chat 0.74.0.
- Trusted workspace:
C:\t\Projekt Žluťoučký kůň\app. - Signed in as
jakmencz (GitHub)through device authorization on the user's phone; Accounts and active Copilot verified. Earlier browser OAuth and first device attempt failed; the later device attempt succeeded. No credentials or 2FA were entered by the tester. - Agent mode, provider
copilotcli, Auto/balance selected GPT-6 Luna (gpt-6-luna), confirmed by UI and runtime model-selection event. This is the client/runtime-reported identity, not an independent backend attestation. - Actual Sentinel processes used
C:\dl\node-v22.23.5-win-x64\node.exe; executable reports v22.23.5. - Spawned server command points into
C:\Users\Administrator\AppData\Local\npm-cache\_npx\3ec5bc0582433d0b\node_modules\sentinel-ir-mcp; that package'spackage.jsonreports 0.5.9.
Working user / Global in Code configuration, unchanged from setup:
{"servers":{"sentinel-ir":{"type":"stdio","command":"npx","args":["-y","sentinel-ir-mcp@stable-0.5","C:\\t\\Projekt Žluťoučký kůň\\app"]}},"inputs":[]}
Local MCP output: Running at 18:21:39.026; Discovered 3 tools at 18:21:40.186. Copilot session independently reports Sentinel connected at 18:46:25.993, and the session menu later shows Running. The earlier unauthenticated session-bound failure did not recur in this authenticated session; its precise policy root cause remains unproven.
Runtime calls
Exact primary prompt:
Use sentinel-ir to analyze C:\t\Projekt Žluťoučký kůň\app\src\index.js and then the whole app folder; tell me the risk and why.
| Call | Called / input | Observed result | Agent-host start → completion; elapsed |
|---|---|---|---|
analyze_file |
Yes; {"path":"C:\\t\\Projekt Žluťoučký kůň\\app\\src\\index.js"}
|
Complete JavaScript analysis; medium, filesystem/network operations (fs.readFileSync, https.get) |
18:46:36.946 → 18:46:37.040; 94 ms |
analyze_directory |
Yes; {"path":"C:\\t\\Projekt Žluťoučký kůň\\app","recursive":true,"max_files":500,"detail":"summary"}
|
4 analyzed, 4 complete, 0 incomplete; critical 2, medium 1, low 1; no truncation/timeout | 18:46:38.299 → 18:46:38.377; 78 ms |
analyze_file, outside project |
Yes; {"path":"C:\\Windows\\win.ini"}
|
Expected refusal; completion success=false
|
18:49:24.775 → 18:49:24.798; 23 ms |
analyze_code |
Yes; {"language":"python","target":"submitted snippet","code":"import subprocess; subprocess.run(\"rm -rf /\", shell=True)"}
|
Complete Python analysis; critical, process-spawn / child-process signal | 18:50:50.114 → 18:50:50.146; 32 ms |
These are observed client tool lifecycle durations, not server-only CPU timings. Wall-clock request dispatch → session idle: primary 18:46:24.599 → 18:46:48.426 (23.827 s; UI 24 s); refused path 18:49:21.111 → 18:49:25.952 (4.841 s); snippet 18:50:46.876 → 18:50:54.356 (7.480 s; UI 7 s). Shared primary workflow includes both Sentinel calls, tool discovery, model work and four native project reads.
Agent answer: overall critical capability present, distinguishing capability labels from proof of vulnerabilities. It explained shell execution in tool.py, fixed external ls in main.rs, network/filesystem use in index.js, and simple arithmetic in util.js. It additionally read those four in-project files using its native view tool after the primary scan. Runtime permission events show those reads approved by host_policy; no manual confirmation dialog was observed.
Outside-path prompt: Use sentinel-ir to analyze C:\Windows\win.ini. Report its exact response.
Exact displayed refusal:
MCP server 'sentinel-ir': Access denied: C:\Windows\win.ini is outside the allowed folders.
The Agent returned that refusal and stopped: no native read, shell command, alternate tool or retry occurred in this turn.
Snippet prompt explicitly requested analysis only, not execution. The answer explained that subprocess.run(..., shell=True) could execute a destructive command. The tool transcript shows only analyze_code for that turn, with no execution tool call.
No unexpected Sentinel tool errors occurred. Ancillary Copilot logs include non-Git-folder warnings and a database open failure with in-memory fallback; these did not prevent the recorded calls.
Cleanup and evidence
VS Code Accounts → GitHub account → Sign Out → confirmation completed. Accounts now shows Sign in to use GitHub Copilot, no GitHub account; Copilot requests sign-in. Both Edge windows were checked at https://github.com: both showed Sign in / Sign up, not an authenticated session. Both windows were closed; process check found zero msedge processes.
Evidence directory: C:\dl\evidence. Full local and session Sentinel MCP output logs, Agent-host log, gateway log, Copilot Chat log, process snapshot, configuration and a filtered visible-message/tool transcript are in copilot-logs.zip. The transcript preserves complete tool inputs/results and Agent answer text; internal reasoning and encrypted fields are excluded. Model selection is saved separately. Runtime evidence is not a new direct SDK/API test.
| File call | Directory call |
|---|---|
 |
 |
| Expected refusal | Snippet analysis |
|---|---|
 |
 |
Additional screenshots: copilot-signed-in.png, agent-menu.png, copilot-tool-calls-list.png, copilot-primary-expanded.png, copilot-server-menu.png, copilot-mcp-session-status.png, edge-github-session-check.png, edge-profile1-github-session-check.png.
Unverified explanations: authentication may have supplied the missing policy context in the earlier session-bound failure, but this test does not establish causality. A dedicated per-tool enablement picker screenshot remains unavailable; actual tool-call execution is verified instead.
Independent Engineering Projects
Built as independent engineering experiments across AI, software analysis, security, and autonomous systems.
Evaluated by reproducible evidence, not by the number of layers.
Explore the projects:
Sentinel Ecosystem: AutoDoc-Sentinel, Sentinel-IR, Sentinel-IR-MCP and related tools.
Agentix Lite: Independent security and system-observation project.
Find the projects: GitLab repositories | NPM packages
Support the work: ⭐ Star the repositories on GitLab.
Connect: Follow me here on DEV Community or explore the Playground.
Each project is distributed under its own license. Check the corresponding repository or NPM package for licensing terms.
Copyright © 2026 jackymenCZ. All rights reserved. Written for the community.
Top comments (0)