DocSentinel MCP
An MCP server for security document review: an agent submits files and the findings stay drafts until a person decides
- 90 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Reads project documents and sends their text to the selected model, so with a cloud provider data goes to that provider
- Runs a web service with MCP and A2A: outside loopback it requires a token
- Keeps model keys in local settings
Install
- Works in
Manual install
git clone https://github.com/arthurpanhku/DocSentinel.git && cd DocSentinel && ./deploy.shOne-command deployment brings up the console at `localhost:8000/console`. For an external agent over the Docker port, set `AGENT_GATEWAY_TOKEN` in `.env` before starting.
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads project documents and sends their text to the selected model, so with a cloud provider data goes to that provider
- Runs a web service with MCP and A2A: outside loopback it requires a token
- Keeps model keys in local settings
This is third-party code. Review the repository files before installing.
What it does
DocSentinel reviews documents for secure development (SSDLC) and combines findings into a structured report with risks, compliance gaps and remediation advice. The platform covers six stages: requirements, design (STRIDE and DREAD threat models), development, testing (SAST and DAST report triage), deployment and operations. It is a React console plus a FastAPI service orchestrated with LangGraph, and it accepts PDF, Word, Excel and PowerPoint input. A RAG knowledge base holds your policies and standards, which the assessment relies on. Agents connect over MCP and A2A. The local server starts with `python app/mcp_server.py` over stdio, and FastAPI serves Streamable HTTP at `/mcp/`. There are five tools: `submit_document_assessment`, `get_assessment_status`, `assess_document`, `query_knowledge_base` and `get_agent_gateway_status`. Files can be read only inside the folders from `MCP_DOCUMENT_ROOTS`, by default `./examples`. An agent does not make decisions: assessments it creates stay drafts until a reviewer approves them in the console. The model is chosen in settings: OpenAI, Claude, Qwen, DeepSeek or local Ollama.
Who it is for. Security teams and engineers who do a first-pass review of project documentation and want Claude Desktop or Cursor to handle it with mandatory human sign-off.
Good fit when
- Requirements or architecture sit in a PDF and you want a list of gaps in security controls
- A STRIDE threat model is built from a system diagram and then reviewed by a person
- A SonarQube or other SAST report is flooded with findings and needs risk-based prioritization
- Company policies are loaded into the knowledge base and the agent's answers must rest on them
- A third-party agent should submit documents for assessment but must not approve the result
Not a fit when
- You need a code or vulnerability scanner: DocSentinel assesses documents and reports from other tools
- An agent must make the final release decision: the platform leaves approval to a person
- There is no cloud model key and no local Ollama: assessment does not run without a model
- Documents must not go to an external model and there is no local one
Example request
Analyze requirements.pdf with DocSentinel and find the missing security requirementsMCP
- Transport
- stdio, http
- Authentication
- key is optional
Environment variables
MCP_DOCUMENT_ROOTS- Folders the server reads documents from, `./examples` by default
AGENT_GATEWAY_TOKENsecret- Bearer token for network access, without it MCP and A2A are open only from loopback
CHROMA_PERSIST_DIR- Folder for the Chroma knowledge base
OPENAI_API_KEYsecret- Cloud model key when OpenAI is selected
Limitations
- Python 3.11 and Node.js 20 are needed to build the console, along with a cloud model key or local Ollama.
- Without a token, MCP and A2A are reachable only from loopback. For network, Docker and reverse-proxy access set `AGENT_GATEWAY_TOKEN` and narrow host and origin lists.
- `assess_document` reads files only inside `MCP_DOCUMENT_ROOTS`, and with an empty value only `./examples` is allowed.
- AI assessments are for first-pass triage: a person approves them and an external agent cannot.
How to disable. Remove the `docsentinel` entry from `claude_desktop_config.json` or from Cursor's MCP settings. The service stops along with `uvicorn` or the containers from `deploy.sh`. Chroma data lives in `CHROMA_PERSIST_DIR` and is deleted by hand.
FAQ
How do I connect DocSentinel to Cursor?
Open Settings, Features, MCP and add a `docsentinel` server of type stdio. The command is the Python from `.venv` and the argument is the path to `app/mcp_server.py`.
Can an agent approve an assessment itself?
No. Assessments created through MCP, A2A or REST stay drafts until a reviewer approves them in the console. External agents cannot approve, reject or bypass human review.
Which files can the MCP server read?
Only inside the folders from `MCP_DOCUMENT_ROOTS`, with multiple paths separated by a colon on macOS and Linux or a semicolon on Windows. Escapes through symlinks are rejected before reading.
How do I run DocSentinel?
Clone the repository and run `./deploy.sh`; the console opens at `http://localhost:8000/console`. The manual route is a virtual environment, `pip install -r requirements.txt`, a frontend build and `uvicorn app.main:app`.
Which models are supported?
OpenAI, Claude, Qwen, DeepSeek and local Ollama. The provider is chosen in `.env` or on the console settings page.
Discussion
No questions or reviews yet.
Related
MCP serversSecurity scanner for coding agents: checks code, MCP servers, prompts and model-invented packages, and gives an A to F grade.
Security Detections MCP: a detection rule database
Security Detections MCP
An MCP server that merges Sigma, Splunk, Elastic and KQL rules into one database for finding detections and ATT&CK gaps
cvENGINE finds a domain's exposed assets and the vulnerabilities being exploited, and its MCP server drives scans from Claude Code
A static scanner for vulnerabilities in AI agent code and MCP configs with 66 rules mapped to OWASP Agentic Top 10
Security scanner for MCP servers that looks for hardcoded keys, tool poisoning and injection flaws in repository code.
An MCP server that gives the agent vulnerability triage: NVD data, EPSS, the CISA KEV catalog, MITRE ATT&CK mapping and one-call CVE risk scoring
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| DocSentinel (this card) | no | key is optional | 90 | |
| STRIDE GPT | no | 1,154 | a STRIDE threat model generator from an application description, while DocSentinel covers six SSDLC stages and runs review with human approval | |
| Threat Modeling MCP Server | yes | not required | 127 | an MCP server for threat modeling, while DocSentinel adds a policy knowledge base and a review queue |
README in short
The README presents DocSentinel as a secure development platform built on LangGraph agents. It describes six SSDLC stages, a console tour, an architecture of REST, MCP and A2A, capabilities (threat modeling, knowledge base, governance), MCP setup for Claude Desktop and Cursor, a quick start, project layout, configuration and security. Translations into seven languages, including Russian, are provided.