Demo workspaceSample data for Kestrel Pay, a fictional bank. Nothing here is a live customer feed.

Signal workspace

API and MCP

Cases, evidence, and surface health are readable from your own systems. The schema below is the one this workspace returns.

GET /api/v1/cases/kp-4821

200

{
  "id": "KP-4821",
  "threatType": "impersonation-account",
  "severityScore": 94,
  "relevanceScore": 0.98,
  "status": "escalated",
  "surface": "tiktok",
  "canonicalUrl": "https://www.tiktok.com/@kestrelpay.rewards/video/7481102934",
  "classifierReason": "Profile reproduces the official avatar and bio, claims to act for th...",
  "harmSignals": ["credential-request","money-solicitation","official-insignia","high-reach"],
  "classifierVersion": "sentinel-threat-v1",
  "evidence": [
    { "kind": "screenshot", "payloadHash": "sha256:41b98070...f48a21" }
  ]
}

MCP connection

Search cases, inspect a classification, and read surface health from any MCP client.

{
  "mcpServers": {
    "sentinely": {
      "command": "npx",
      "args": ["-y", "@sentinely/mcp"],
      "env": { "SENTINELY_API_KEY": "sk_live_..." }
    }
  }
}

Scopes

Keys are read-only by default. Escalation and status transitions stay in the workspace, where the role model applies.

cases:read

Case records, classifications, and status

evidence:read

Capture metadata and payload digests

health:read

Per-surface collection state and freshness