OpenAI Build Week

OpenAI Build Week · Developer Tools · 2nd place

Sentinel

Built by Malik Bashaar Javaid

An MCP security scanner whose submission code combines seven static rules, a constrained model review, and four Docker probes, with findings mapped to the OWASP Agentic Top 10.

I also participated in this hackathon with Trajectory. This coverage was prepared independently after results were announced.

The idea worth stealing

Build the cage before the model.

Sentinel’s GPT layer is defined by what it cannot do: add a finding, cite a line it was not shown, or write a probe. A review that steps outside those lines is thrown away and retried, and when the model is unavailable the scanner parks candidates as “needs review” instead of guessing. For a security tool the model’s restraint is the feature; the prompt is the least important part.

What we checked

Date checked: .

Devpost submission and July 21 repository revision; later releases are outside this check.

Labels apply to each finding and the evidence described, not to the project as a whole.

Not independently verified means the available evidence was insufficient to confirm a claim. It does not mean the claim is false.

  1. The cage is enforced in code, not in the prompt

    Verified

    The Responses API call uses a strict JSON schema and store: false. The host then rejects any review whose IDs don’t match the batch, that cites evidence outside the supplied context, or whose probe plan doesn’t fit the tool’s declared schema. Source

  2. All eleven findings, with real Docker probes, in CI

    Verified

    The submission commit’s own CI job installs the wheel and runs the replay demo: “Findings: 11 · confirmed 10, needs review 1,” every rule evaluated. We could not run Docker locally; we read the logs. Source

  3. The wheel is what the README says it is

    Verified

    The v0.1.0 wheel’s SHA-256 matches the digest in the README, CI is green across three operating systems and three Python versions, and all 125 tests pass on our machine. Source

Under the hood

Replay cassettes are hashed requests
Each cassette is keyed by the SHA-256 of the exact review batch sent to the model and stores the returned model, token usage, latency, and cost in micro-dollars. Replay pushes those responses through the production parser and validators, so the demo exercises real code.
Redaction is checked, not assumed
Before source context leaves for the model it is redacted and then re-verified: line structure unchanged, no secret-like content, no absolute paths. A violation aborts the scan rather than sending the context anyway.

Nuance

The repository kept moving after Build Week: 77 commits and four releases, now branded PortunusMCP Sentinel v1.3.0. We verified the July 21 submission commit, not today’s head. The model string is gpt-5.6-sol. And the claim of a live code-scanning alert against the repo itself is not publicly readable, so that one rests on the builder’s word.

Sources

Last updated: . Editorial updates do not imply a new technical check.

Builder credits reviewed: , using the official announcement, submission, and any linked credit sources.

Builder? Add context, request a correction, or ask for a re-check →