Frequently asked questions

Sentinel is an AI Firewall (AIF) built for LLMs and agentic systems. It sits between your application and your LLM, scrubbing prompts for injection attacks, jailbreaks, and data-exfiltration attempts before they reach the model — and scanning tool outputs before they return to your agent.

Sign up for free (no credit card required), then grab an API key from Dashboard → Keys — the key-creation screen includes a ready-to-copy setup command for your OS (Mac, Linux, or Windows) with your real key already filled in. See the Integration Guide at /docs for a full walkthrough.

Not as a self-serve download — sentinelaifirewall.com is the fastest way to get started for everyone. Enterprise customers get dedicated infrastructure that we deploy and operate on their behalf, with a true on-prem deployment option available by custom arrangement. Contact us to talk about Enterprise.

Every request resolves to one of four outcomes: clean (no threat, passes through unmodified), flagged (borderline — passes through, but you get a signal to act on), neutralized (Sentinel rewrites the content to strip the adversarial part while preserving intent), or blocked (rejected outright, no original content passed through).

Strict mode is more sensitive, catching more borderline cases as flagged or neutralized at the cost of a few more false positives. Set per-request via the tier parameter — defaults to standard if omitted.

Yes — on Teams and Enterprise, a dedicated secret detector scans content independently of the main threat pipeline, redacting things like API keys, tokens, and credentials even in an otherwise-clean request.

SlopScan checks package names an LLM recommends against live PyPI/npm registry data, so you don't get hit by "slopsquatting" — attackers registering the name of a package an LLM hallucinated. Available on Pro and above.

Starter: 10 requests/min · Pro: 120 requests/min · Teams: 300 requests/min · Enterprise: 600 requests/min.

100 requests/month, 1 API key, 10 requests/min — free forever, no credit card required.

Yes — configuring your own Anthropic key to use the agentic proxy is available on every tier, including Starter. It's not a paid-tier feature.

Yes, two ways. For Claude Code directly, point it at Sentinel with two environment variables (ANTHROPIC_API_KEY and ANTHROPIC_BASE_URL) — see the Integration Guide at /docs (Section 7) for copy-paste commands for Mac, Linux, and Windows. If you're using Open Claw agents specifically, Sentinel also ships an official Clawhub skill (sentinel-proxy, https://clawhub.ai/c0ri/skills/sentinel-proxy) that wires the same protection in automatically.

Only for the agentic proxy endpoint, which makes a real upstream call to Anthropic on your behalf. The direct scrub endpoint needs no Anthropic key at all.

Yes — see the Integration Guide at /docs for the n8n setup steps.

Not by default. If you enable Community Training in Settings, flagged prompts — the borderline, uncertain cases — are added to a review queue an admin can use to build new detection signatures. Clean, neutralized, and blocked content is never stored, opted in or not.

Only when a result is neutralized: the dangerous part is redacted (PII too, if enabled in Settings) and what's left is wrapped in [SENTINEL-WARNING] markers before it reaches your agent. Clean and flagged content passes through untouched. See "What does neutralized mean for my response?" below.

No — Sentinel doesn't inspect HTTP headers or general network traffic. It's purpose-built for LLM prompt and response content.

Blocked means Sentinel's confidence a request was adversarial exceeded the block threshold, so no content passed through. Check safe_payload in the response for a description of what was detected. If you believe it's a false positive, email us or drop a note in Slack below — a benign case that reads as an attack is exactly the kind of thing we want to hear about.

You've hit your plan's requests-per-minute limit. See Billing & Plans above for your tier's limit, or reach out if you need a higher limit.

Sentinel rewrote the offending part of the content while keeping the rest intact. For the direct scrub endpoint, check safe_payload — it's prefixed with [SECURE_SUMMARY]. For the agentic proxy, the safe content is wrapped in [SENTINEL-WARNING] markers instead of being removed.

You copied a command written for a different terminal than the one you're using. export is Mac/Linux syntax — on Windows PowerShell the equivalent is $env:VARNAME="value", and on Windows Command Prompt it's set VARNAME=value. The Integration Guide at /docs (Sections 7 and 8) now has a tab picker so you can grab the exact command for your OS instead of guessing.

Almost certainly not expired — this is usually the environment variables resetting. export (Mac/Linux) and $env: (Windows PowerShell) only last for the terminal window you ran them in; close that window and they're gone. Re-run the setup command, or use the "Make it permanent" option in the Integration Guide at /docs, which saves the variables so every new terminal picks them up automatically.