Operate your Linux and macOS hosts from Claude.ai or ChatGPT.

Install a small agent on your servers. Connect SentinelX as an MCP connector in your LLM. Then ask the LLM to check disk usage, restart a service, edit a config, or anything else you've allowed.

curl -fsSL https://get.sentinelx.app | bash

Linux and macOS — one command auto-detects your OS. On Linux, the agent runs as an unprivileged user after install.

Open the dashboard Sign in with Google or GitHub to enroll hosts and manage your fleet.

Available on GitHub MCP Registry ChatGPT

Works with Claude VS Code Cursor Cline Any MCP client

How it works

1

Install the agent. Run the command above on any Linux or macOS host. It installs the open-source agent in a virtualenv and registers it as a service — a systemd unit on Linux, a launchd daemon on macOS.
2

Sign in with Google. The installer prints a URL. Open it, sign in with Google, copy the displayed token, and paste it back into the installer.
3

Connect SentinelX in Claude.ai or ChatGPT.
ChatGPT: install SentinelX from the app directory — one click Connect, authorize with the same Google account.
Claude.ai: Settings → Connectors → Add custom MCP → https://mcp.sentinelx.app/mcp/mcp → authorize with the same Google account. Done.

Multiple servers? Run the install command on each one. Your hosts get human-friendly aliases automatically (their hostname). Ask the LLM "list my servers" and it'll show all of them — pick which one to target by host_id, hostname, or a custom label.

Used to run this site. SentinelX edits /var/www/get.sentinelx.app/index.html directly from a Claude chat, with git tracking every change. Including this paragraph.

Connect from your editor

Claude and ChatGPT connect through their own UI. Editor and CLI clients read a small JSON config instead — same hub URL, one paste. The only thing that changes per client is the top-level key and how the transport field is spelled; get it wrong and the client silently falls back to the legacy SSE transport.

VS Code ~/.config/Code/User/mcp.json

{
  "servers": {
    "sentinelx": {
      "type": "http",
      "url": "https://mcp.sentinelx.app/mcp/mcp"
    }
  }
}

Top-level key servers, transport "http".

Cline cline_mcp_settings.json

{
  "mcpServers": {
    "sentinelx": {
      "type": "streamableHttp",
      "url": "https://mcp.sentinelx.app/mcp/mcp"
    }
  }
}

Transport must be "streamableHttp" — camelCase, no hyphen. Omitting it or using "http" falls back to SSE (405).

Cursor ~/.cursor/mcp.json

{
  "mcpServers": {
    "sentinelx": {
      "url": "https://mcp.sentinelx.app/mcp/mcp"
    }
  }
}

url only — Cursor auto-detects transport and handles OAuth. Note: Cursor caps ~40 active tools and SentinelX exposes 38, so disable ones you don't use or trim other servers.

Android Studio — known issue. Its built-in MCP client has a PKCE bug (the code_verifier doesn't match its own code_challenge), so the OAuth handshake fails on the client side. Nothing to fix server-side — use VS Code or another client until JetBrains ships a fix.

Windsurf — known issue. Windsurf's MCP client validates the OAuth issuer in the wrong place (it expects it in the token response body instead of the RFC 9207 callback parameter it already receives), so the token exchange fails on the client side. The config is correct — it'll connect once Windsurf ships the upstream fix (rust-sdk#896). Use Cursor or VS Code in the meantime.

One URL for every client: https://mcp.sentinelx.app/mcp/mcp — sign in with Google on first connect.

What you can ask

Once it's connected, you can talk to your servers in plain English (or whatever language). The LLM picks the right tool automatically:

# Health checks
"Show me uptime and disk usage on my-vps"
"Compare free memory across all my servers"

# Operations
"Restart nginx on prod-web and tell me when it's back"
"Tail the last 50 lines of /var/log/syslog on db1"

# Config edits
"Update the worker_processes setting in my nginx config to 4"
"Show me the diff before applying"

Integrations

Beyond your hosts, the hub exposes a few third-party integrations as MCP tools — so the LLM can also send mail, post Telegram notifications, or edit DNS on your behalf. Each one needs credentials configured once on mcp.sentinelx.app; the agent on your hosts is not involved.

Tool	What it does
`cloudflare_dns_list_zones`	List Cloudflare zones the saved token can access
`cloudflare_dns_list_records`	List DNS records in a zone, optionally filtered
`cloudflare_dns_create_record`	Create a new DNS record
`cloudflare_dns_update_record`	Partially update an existing DNS record
`cloudflare_dns_delete_record`	Delete a DNS record
`resend_send_email`	Send a transactional or operational email via Resend
`telegram_send_message`	Send a text message to a Telegram chat using a saved bot
`list_integrations`	List the integrations the calling user has configured

Hub-side, not agent-side. These tools run inside the SentinelX hub, not on your hosts. They're convenient bundled extras, not part of the open-source agent — credentials live in your hub account and never touch the agent's allowlist.

What's installed where

On your server

The agent goes to /opt/sentinelx-cloud-core and runs as systemd unit sentinelx-cloud-core.service under user sentinelx.

Allowed commands live in /etc/sentinelx/config.yaml — you fully control what the LLM can do.

In the cloud

A hosted hub at mcp.sentinelx.app relays MCP tool calls between your LLM and your agents. Authentication is OAuth 2 + PKCE via Google.

Your agent connects out to the hub. No port forwarding, no inbound traffic to your server.

Security model

The agent only opens outbound connections. Nothing inbound, no port to expose.
Commands are gated by an allowlist you maintain in /etc/sentinelx/config.yaml. The LLM cannot ask for what's not allowed.
Each host has its own identity JWT. Compromising one host doesn't grant access to others.
The agent code, the protocol, and the installer are open source. Read the code before you install.

Open source

The agent and its protocol are under Apache 2.0:

sentinelx-cloud-core — the agent that runs on your server
sentinelx-cloud-protocol — wire format between agent and hub
sentinelx-cloud-installer — what get.sentinelx.app serves

Manual install

If you'd rather not curl | bash, fetch and inspect first:

curl -fsSL https://get.sentinelx.app/install.sh -o install.sh
less install.sh
bash install.sh

Status

SentinelX is in beta. Hub status: healthz · readyz