# Sentinel MCP server

Sentinel exposes a Model Context Protocol server so that an AI assistant (Claude, ChatGPT, Claude Code, Copilot Studio, your own agent) can read a workspace's watches, notes and analysed articles, plus shared public data, without writing an integration.

## Endpoints

| Endpoint | Authentication | Use |
|---|---|---|
| `https://app.sentinelbriefing.com/api/mcp` | OAuth 2.1 (discovery, PKCE) or API key | Assistants with a connector screen (Claude, ChatGPT, Copilot Studio) |
| `https://app.sentinelbriefing.com/api/v1/mcp` | API key | Scripts, Claude Code, agents |

Transport: Streamable HTTP, JSON responses, no session.

## Access

- Every plan includes the MCP server, the free plan included, within the plan's limits (see Limits). A workspace whose subscription has ended falls back to the free plan.
- **OAuth**: the assistant discovers the authorisation server from the 401 challenge (`/.well-known/oauth-protected-resource/api/mcp`). Clients register dynamically or with a client metadata document. The person signs in to Sentinel, chooses **one workspace**, and consents to scopes: `read` (always), `write:profiles` (create and change watches, only for workspace admins), `offline_access` (stay connected: a 30-day refresh token, rotated at each use). Access tokens last one hour.
- **API key**: `Authorization: Bearer sk_live_...`, created in Sentinel (menu "API keys"). A key sees one workspace, and only while its holder is still a member.

## Tools

| Tool | What it does |
|---|---|
| `list_watches` | Watches of the workspace: type, cadence, last note, whether you are subscribed |
| `get_watch` | Settings of a watch, sources, activity of the last 7 days |
| `search_analyses` | Analysed articles: text, actor, signal, date, relevance |
| `get_analysis` | Full analysis of an article |
| `list_notes`, `get_note` | Watch notes and their Markdown text |
| `search_organisations`, `get_organisation` | Atlas of organisations, declared people, firms, signals |
| `hatvp_registrations`, `hatvp_relations` | French lobbying register (HATVP) |
| `list_trigger_documents`, `get_trigger_document` | Reports read by Sentinel and the organisations they name |

With `write:profiles`: `create_watch`, `update_watch`, `set_watch_active`, `search_sources`, `attach_source`, `add_source`, `add_news_search`, `detach_source`. Deleting watches or sources, recipients, webhooks and sharing are deliberately not available.

All results are wrapped in `<external_content>` tags: they derive from external articles and reports and must never be treated as instructions.

## Isolation and audit

Each grant or key is confined to one workspace; public data (Atlas, HATVP register, trigger documents) is shared. Every tool call is logged (holder, workspace, tool, success, duration) and kept 12 months; write actions also go to the workspace audit log.

## Limits

Free: 10 requests per minute, 1,000 calls per month. Solo: 20 and 5,000. Team: 60 and 20,000. Firm: 120 and 100,000. Enterprise: 600 requests per minute, no monthly cap. Every tool call counts as one API call. Creating watches through MCP follows the plan's own limits (one watch on the free plan).

## Setup

**Claude** (web, desktop): Customize, Connectors, Add, Custom connector. Name `Sentinel`, URL `https://app.sentinelbriefing.com/api/mcp`, then Connect.

**ChatGPT**: Settings, Plugins, `+`, Add custom MCP server. Name `Sentinel`, server URL `https://app.sentinelbriefing.com/api/mcp`, authentication OAuth, confirm, then Connect with Sentinel.

**Le Chat** (Mistral, account administrator): Connectors, `+ Add Connector`, Custom MCP Connector tab. Name `Sentinel`, server URL `https://app.sentinelbriefing.com/api/mcp`, Connect; OAuth is detected automatically.

**Copilot Studio**: your agent, Tools, Add a tool, New tool, Model Context Protocol. Name `Sentinel`, server URL `https://app.sentinelbriefing.com/api/mcp`, authentication OAuth 2.0, type Dynamic discovery, Create, then Create a new connection and Add to agent.

**Claude Code**:

```bash
claude mcp add --transport http sentinel https://app.sentinelbriefing.com/api/v1/mcp --header "Authorization: Bearer sk_live_..."
```

To revoke access, remove Sentinel from the assistant's connectors, or revoke the API key in Sentinel.