SentinelX

List what you haven't seen yet: completed background jobs and announcements. Each completed job comes with a short summary, plus a count of jobs still running. The completed jobs it returns are marked as read, so a second call returns only what arrived since.

notifications_check

Remove the user's default host preference. After this, tool calls without an explicit host_id will fall back to the standard behavior: auto-route if only one host is connected, or ambiguous_host error if multiple are connected. Returns: {"ok": True, "removed": true|false}. removed=false means no default was set in the first place (no-op, not an error — the tool is idempotent).

sentinel_clear_default_host

Clear an item from the notifications inbox once you have handled it. Clear only items you have read: clearing an unfamiliar job_id, or "all", could remove a result another conversation is still waiting for.

notifications_ack

Clone a Git repository into a new directory on the host. Refuses a destination that exists and is not empty, so it never writes into another tree. The destination must be under a file_ops entry with access: rw.

sentinel_git_clone

Simple health check (does not call SentinelX core internals).

sentinel_ping

Copy a file or directory on the target host. BOTH `src` and `dst` must resolve under an `rw` file_ops entry. The destination is gated exactly like the source — otherwise copy would be an exfiltration primitive (read from an rw path, write the bytes anywhere). Directories are copied recursively.

sentinel_copy

Create a new DNS record in a Cloudflare zone. Common types: A (IPv4), AAAA (IPv6), CNAME (alias), TXT (text), MX (mail). The `proxied` flag only applies to A/AAAA/CNAME and routes traffic through Cloudflare's edge. NOTE on TTL and proxied: if proxied=True, Cloudflare overrides the ttl to 1 ("auto") regardless of what you pass. This is documented Cloudflare behavior, not a bug. For non-proxied records, ttl can be 1 (auto) or 60..86400 seconds.

cloudflare_dns_create_record

Connect a new host to this account: returns the install command with a one-time token. Use it whenever the user wants to add a server, including their first one when the account has no hosts yet, and for unattended provisioning. The returned install_hint has one command per OS (linux, macos, windows): give the user the one for their server's OS to run on that machine; the host appears once the agent connects. It creates nothing by itself and never touches an existing host. Do not use it to re-enroll an existing host that lost its credential. The token works once and expires; minting is rate-limited.

sentinel_mint_enrollment

Delete a DNS record from a Cloudflare zone. Destructive: the record is gone immediately and the deletion propagates through Cloudflare's network in seconds. Use cloudflare_dns_list_records first to confirm you have the right record_id.

cloudflare_dns_delete_record

Permanently delete a context and all its revisions. This cannot be undone. Prefer sentinel_context_archive for normal cleanup.

sentinel_context_delete

Delete a file or (with recursive=true) a directory. The path must resolve under an `rw` file_ops entry. The agent ALWAYS takes a backup before destroying anything: a file is copied to a sibling `.bak.<timestamp>`, a directory is archived to a sibling `.bak.<timestamp>.tar.gz`. If the backup cannot be made the delete is refused (`backup_failed`) — nothing is destroyed without a recovery path. Deleting a directory requires `recursive=true` explicitly. Without it, a directory is rejected with `is_directory`. This makes accidental `rm -rf`-shaped mistakes impossible to trigger by a single confused call.

sentinel_delete

Destroy a VM and its disk. This cannot be undone. Without confirm=True it changes nothing and returns a summary: show it to the user, get their agreement, then call again with confirm=True.

compute_destroy

Check SentinelX's own records for the cause of a problem. Run it before filing a report. For a stall, a disconnect loop, a blocked call or an operation that keeps failing. It names the cause when the evidence is conclusive, with the actions to take, and often ends the matter without a report. A result of conclusion "inconclusive" with should_report true is a real answer: file the report rather than picking the nearest-looking cause. The evidence block is always returned.

sentinel_diagnose

Edit a file on the connected host using safe, structured operations. Modes: - replace literal old -> new_text - regex pattern -> new_text - replace-block start_marker..end_marker -> new_text - append append new_text to file - prepend prepend new_text to file - write overwrite file with new_text For large content use the chunked variant: sentinel_edit_upload_init, sentinel_edit_upload_file, sentinel_edit_upload_complete. Security: `path` must resolve under a file_ops entry whose access is `rw` in the agent's config (the unified r/rw path model). A path that is only readable (access: r), or outside the allowlist, or that escapes it via `..`/symlink, is rejected with path_not_allowed — edit is a mutation and is gated exactly like move/copy/delete. This is enforced agent-side, after canonicalizing symlinks.

sentinel_edit

Return a saved context as Markdown. It never writes files.

sentinel_context_export_md

Fetch from a Git remote: updates remote-tracking refs, never the working tree.

sentinel_git_fetch

Read one notification in full: a background job's result or an announcement.

notifications_get

Return the user's currently-configured default host (if any). The response carries both the stored host_id AND a flag indicating whether that host is currently connected, so the caller knows whether tool calls without explicit host_id will succeed. Returns: {"ok": True, "default_host_id": "<id> or null", "is_connected": true|false|null} is_connected is null when no default is set.

sentinel_get_default_host

List the Cloudflare Access applications on an account. Read-only.

cloudflare_access_apps_list

List the policies on one Cloudflare Access application. Read-only.

cloudflare_access_policies_list

List DNS records in a Cloudflare zone, optionally filtered. Use this to inspect existing records and to get the record `id` values needed by update_record and delete_record. Returns up to 100 records per call; if a zone has more, narrow down with the `type` or `name` filters.

cloudflare_dns_list_records

List the rulesets on a Cloudflare zone: WAF, rate limiting, redirects. Read-only. Names the rulesets; the rules inside one come from cloudflare_ruleset_get.

cloudflare_rulesets_list

List recent Cloudflare firewall events on a zone, newest first. Read-only. Answers questions like "what was blocked for visitors from BE yesterday" without turning any protection off.

cloudflare_security_events

List every Cloudflare zone the saved token has access to. Use this first to discover zone IDs before listing or modifying records. The result includes each zone's id, name, status, and whether it's paused.

cloudflare_dns_list_zones

List the operating system images a VM can be created from (slug).

compute_images

List the VM sizes available, with monthly and hourly prices.

compute_sizes

Read the refs a Git remote has right now, without a working tree. Read-only. Use it to learn the commit a branch is on before a forced push.

sentinel_git_ls_remote

List entries in a directory on the target host. Output is structured (each entry has name/type/size/mtime), unlike sentinel_exec("ls -la") which returns opaque text. Always skips common noise directories (.git, __pycache__, node_modules, .venv, .pytest_cache, dist, build, etc.) regardless of show_hidden.

sentinel_list

List the VMs (droplets) in a saved compute integration's cloud account.

compute_list

List the regions a VM can be created in (slug and name).

compute_regions

List saved contexts with compact metadata.

sentinel_context_list

List the saved integrations for the calling user. Use this when you need to know which integrations are available before calling a provider tool (telegram_send_message, resend_send_email, cloudflare_dns_*). All those tools take an `integration_name`; this is how to discover the valid names. Returns: { "ok": true, "items": [ { "name": "<user-chosen alias>", "provider": "cloudflare" | "telegram" | "resend", "created_at": "<ISO8601>" }, ... ], "count": <int> } The returned data deliberately does NOT include each integration's metadata (e.g. Telegram default_chat_id, Resend default_from) nor the encrypted credentials. Those are managed exclusively from the dashboard UI by the authenticated user, and the LLM cannot read or modify them via tools. If the user has no integrations, returns an empty list with count zero — not an error.

list_integrations

List the authenticated user's hosts: connected, offline and disabled. Each host entry includes: - host_id: stable unique id, generated at install time - hostname: system hostname reported by the agent at handshake - label: user-defined alias (null if none set; see sentinel_set_host_label) - session_id: internal session identifier (null for a host currently served by another hub worker) - connected_at: ISO timestamp of when the agent connected - agent_version: version reported by the agent - capabilities: ops the agent supports - operational: whether this host may currently RUN operations. A host that is connected but beyond the plan's active-host limit is listed with operational=false plus a "status" and "note" explaining why; tool calls routed to it return upgrade_required until a slot frees (disconnect/disable another host) or the plan is upgraded. The top-level "slots" block summarises the plan: limit, how many hosts hold an active slot, how many are parked, and how many slots are available. Other tools' `host_id` parameter accepts any of host_id, label, or hostname. Resolution priority is exact host_id -> label -> hostname. Enrolled hosts that are NOT connected are not part of hosts/count; they are listed apart, so a missing host is never mistaken for a deleted one: - offline: enrolled, currently disconnected, with last_connected_at. It moves back into hosts on its own when its agent reconnects. - disabled: refused at connect, with disabled_at and disabled_by ("user": disabled from the dashboard, re-enable it there; "admin": disabled by SentinelX support). There is no tool to re-enable a host. Operations cannot target offline or disabled hosts. Each group holds at most 20 entries, most recent first; offline_total / disabled_total appear when there are more. Returns {"ok": true, "hosts": [...], "count": N, "slots": {...}, "offline": [...], "disabled": [...]}; offline and disabled only when non-empty.

sentinel_list_hosts

Manage the lifecycle of cloud VMs through a saved compute integration. A single tool with an `operation` selector. Which cloud is driven comes from the integration's saved metadata.driver (currently 'digitalocean').

compute

Mint a short-lived REST API key and return it with a ready-to-use contract. Use this when a task is better done as a batch/aggregation loop than as many separate MCP calls -- e.g. grep a huge log and return only a count, check a metric across N hosts and report only the outliers, or a fetch->filter-> summarize pipeline. Mint a key, then curl ``POST {base_url}/op`` from your sandbox; only the final summary needs to re-enter your context. The key carries YOUR access, scoped down and short-lived. It is never more than you already have over MCP: every op still passes the target agent's allowlist, and every call is audited exactly like an MCP call. Treat it as a secret -- anyone holding it has that access until it expires.

sentinel_request_api_key

Move or rename a file or directory on the target host. BOTH `src` and `dst` must resolve under a file_ops entry whose access is `rw` in the agent's config. Resolving happens after canonicalizing symlinks, so `..` traversal and symlink-escape are rejected. You cannot move data out of a writable subtree into a location the operator didn't declare.

sentinel_move

Power off a VM. Everything running on it stops until it is powered on again.

compute_power_off

Power on a VM.

compute_power_on

One-call deterministic project/repository orientation. Aggregates git + filesystem facts into a single bounded response so you don't need several read/list/search/exec(git ...) round-trips to orient in a repository: git state (branch, head, detached, dirty, ahead/behind), change stats (staged/unstaged/untracked, insertions/deletions), tracked-file count, top-level directories, and file-extension counts. Read-only. For a non-git but readable directory it returns a plain filesystem summary (kind="directory") instead of failing. The extension counts let you infer the project type yourself (e.g. many .kt + build.gradle -> Android/Kotlin) without a curated manifest list.

sentinel_project_snapshot

Push a branch to a Git remote. A forced push must pass expected_remote_sha, the commit you believe the remote branch is on: if someone pushed since you looked, the push is refused and nothing is lost. An unconditional force is not available on purpose.

sentinel_git_push