Search Results

SSO lets your wider developer team sign in with the identity provider you already run — Google Workspace, Microsoft Entra, or any generic OIDC or SAML provider. Your own admin login is unaffected: admins keep signing in with passkeys. The wizard Organization S...

This is the rule the Gateway applies to an MCP server that has no explicit rule of its own. Set it under Policy → MCP default action. Action What developers experience When to use it Allow Nothing changes You want visibility first, controls later Warn A warnin...

Turn on Require approval for new MCP servers when you want unknown servers held back until someone has looked at them. How it behaves A server nobody has reviewed — meaning it has no explicit per-server rule on MCP Inventory — is enforced at the pending action...

The risk classifier inspects outbound prompts for things that shouldn't leave — secrets, personal data, prompt-injection attempts, and exfiltration-shaped tool sequences. Policy → AI risk classifier sensitivity controls how aggressively it acts: Low — suppress...

Off by default, and the setting that deserves the most thought before you turn it on. What it does Stores the actual content of conversations — what developers typed and what the model replied — so you can read them later on the Conversations screen. Without i...

Policy → Egress blocklist controls which network destinations the Endpoint Suite allows AI tools to reach directly, outside the Gateway. Use Download blocklist to get the current list, and Copy to take it into your own tooling. Send test verifies the alerting ...

MCP Inventory lists every MCP server Sentilai has seen — discovered on developer machines by the Endpoint Suite, and independently observed in Gateway traffic. Nothing here is typed in by hand; the list is what your team actually runs. Each row shows: Server —...

A per-server rule is sometimes too blunt: you want github available, but not delete_repository. Per-tool rules let you allow a server while blocking individual tools inside it. Open a server's row on MCP Inventory to set rules for the individual tools that se...

Most MCP servers run locally on the developer's machine, and the Endpoint Suite wraps them automatically. Routed endpoints covers the other case: a remote MCP server your team points tools at over the network. Register one under MCP Inventory → Routed endpoint...

Activity is the audit trail: every AI request your developers send through the Gateway, with the policy decision attached. The small dot beside the title means the view is updating live. The four tiles Requests and Blocked for the selected window, plus Top mod...

When prompt capture is on, Conversations holds the transcripts. The list Every captured conversation with the developer, the tool, an excerpt of the first message, how many messages it has, and when it was last active. Filter by developer. The transcript Messa...

Diagnostics lists every machine enrolled in your organization: who it belongs to, when it registered, and when the Gateway last saw it. Revoking a device Revoke access on a row kills that machine's gateway tokens. The AI tools on it lose access within seconds ...

When a developer reports that a tool isn't behaving, you can ask their machine for its event logs without touching the laptop. Diagnostics → Request logs on their device row. The Endpoint Suite picks the request up and uploads a log bundle. It appears under Lo...

Compliance produces a point-in-time record of how AI is governed in your organization: the active policy, who had access, and what the Gateway actually enforced. Pick a From and To date. Print / Save as PDF for a document to hand over, or Download JSON for a m...

SIEM Export pushes Sentilai events to your security monitoring stack as they happen. Enter the destination host and port, and pick the protocol ( tcp or tls). Save destination. Send test event and confirm it lands in your SIEM. Destinations must be publicly r...

Provider keys are your organization's own API keys — OpenAI, Anthropic, Azure OpenAI, Gemini. They let tools that can't use a personal subscription (Cursor's managed mode, the Copilot CLI) run on your account instead. Providers → Add Provider, choose the type,...

Billing & Plan shows your plan, your seat limit, and how many seats are in use. A seat is a person — one row in Admins or Developers — not a device. A developer with a laptop and a desktop uses one seat. Offboarded people don't hold a seat. When you reach the ...

API Credentials issues OAuth client-credential pairs for machine-to-machine access — your own automation reading the audit trail, or exporting policy. Create credential, name it for the thing that will use it. Choose scopes — read-only ones like audit:read wh...