MCP 服务器

Sentinel MCP Server

Enables autonomous infrastructure health management by exposing tools for retrieving system logs, querying a knowledge base, executing SQL analytics, and simulating system commands, all integrated into an AI-driven incident response workflow.

README

Sentinel - Autonomous System Health Guardian

An autonomous AI-powered infrastructure monitoring system that leverages multi-agent collaboration, Retrieval-Augmented Generation (RAG), Natural Language to SQL (NL2SQL), LangGraph orchestration, and the Model Context Protocol (MCP) to detect, diagnose, remediate, and analyze system incidents.

Overview

Modern IT environments generate massive volumes of logs, alerts, and operational data. During incidents, engineers often need to correlate logs, consult runbooks, query monitoring databases, and determine appropriate recovery actions under time pressure.

Sentinel demonstrates how autonomous AI agents can collaborate to streamline this workflow.

Instead of relying on a single large language model, Sentinel distributes responsibilities across specialized agents. Each agent focuses on a specific task—monitoring, diagnosis, remediation, or infrastructure analytics—while CrewAI coordinates collaboration and LangGraph manages the overall incident response workflow.

The project combines modern AI engineering techniques including Retrieval-Augmented Generation (RAG), Natural Language to SQL (NL2SQL), Model Context Protocol (MCP), and LangSmith observability into a unified autonomous operations platform.

Features

Multi-agent architecture built with CrewAI
Autonomous infrastructure monitoring
Retrieval-Augmented Generation (RAG) using ChromaDB
Natural Language to SQL (NL2SQL) analytics
SQLite-backed infrastructure database
LangGraph orchestration with verification and retry logic
MCP Server exposing infrastructure tools
LangSmith tracing and observability
Safety guardrails for simulated remediation
Structured outputs using Pydantic models

System Architecture

Sentinel consists of four specialized AI agents working together to automate the incident response lifecycle.

AI Agents

Monitor Agent

The Monitor Agent continuously analyzes infrastructure logs to identify abnormal system behaviour.

Responsibilities

Retrieve recent system logs
Detect critical incidents
Produce structured incident summaries

Diagnostician Agent

The Diagnostician Agent determines the most probable root cause of an incident using Retrieval-Augmented Generation.

Rather than relying solely on model knowledge, the agent retrieves relevant operational procedures from the Sentinel Operations Runbook before generating a diagnosis. This grounding process improves factual consistency and reduces hallucinations.

Remediation Agent

The Remediation Agent proposes recovery actions based on the diagnosis.

Generated recommendations are passed to the verification stage before the workflow is considered complete.

Data Intelligence Agent

The Data Intelligence Agent enables engineers to query operational data using natural language.

Example:

Which server has the most ERROR logs?

The agent converts the request into SQL, executes it against the infrastructure database, and returns a grounded response.

Workflow

CrewAI coordinates collaboration between specialized agents, while LangGraph manages workflow execution and recovery.

Monitor
   │
   ▼
Diagnose
   │
   ▼
Remediate
   │
   ▼
Verify
   │
   ▼  
 ┌─┴─────────────┐
 │               │
 ▼               ▼
END        Retry Diagnosis

If verification fails, LangGraph automatically routes execution back to the Diagnostician Agent for another remediation cycle.

Retrieval-Augmented Generation (RAG)

The Diagnostician Agent uses ChromaDB as an enterprise knowledge base.

Workflow:

Incident
    │
    ▼
Vector Search
    │
    ▼
Relevant Runbook Sections
    │
    ▼
Grounded Diagnosis

This approach enables responses to be based on retrieved operational documentation rather than solely on the language model's internal knowledge.

Natural Language to SQL (NL2SQL)

The Data Intelligence Agent converts natural language into executable SQL queries.

Example:

Question

Which server has the most ERROR logs?

Generated SQL

SELECT l.server_id,
       s.hostname,
       COUNT(*) AS error_log_count
FROM logs AS l
LEFT JOIN servers AS s
ON l.server_id = s.server_id
WHERE l.log_level = 'ERROR'
GROUP BY l.server_id, s.hostname
ORDER BY error_log_count DESC
LIMIT 1;

This enables infrastructure analytics without requiring engineers to write SQL manually.

Model Context Protocol (MCP)

Sentinel implements an MCP server as the unified interface between AI agents and infrastructure resources.

Available tools include:

get_system_logs()
query_knowledge_base()
query_database()
execute_system_command()

This separation improves modularity and provides a standardized interface for agent-tool interactions.

Safety Guardrails

To demonstrate safe autonomous remediation, Sentinel simulates command execution.

High-risk commands are automatically blocked whenever the infrastructure is under critical database load.

Examples include:

reboot
shutdown
rm -rf

No real infrastructure modifications are performed.

Observability

LangSmith provides end-to-end tracing of:

Agent execution
Tool invocation
Retrieval events
SQL generation
LLM interactions
Workflow execution

This makes the complete decision-making process transparent and simplifies debugging.

Technology Stack

Category	Technologies
Language	Python 3.12
Multi-Agent Framework	CrewAI
Workflow	LangGraph
LLM	OpenAI GPT-5.5
RAG	LangChain + ChromaDB
Database	SQLite
Observability	LangSmith
Protocol	FastMCP
Validation	Pydantic

Project Structure

src/sentinel
├── config
├── flows
├── models
├── services
├── tools
├── crew.py
├── mcp_server.py
└── main.py

Current Limitations

Uses simulated infrastructure instead of live production systems.
Verification logic is rule-based rather than driven by real monitoring telemetry.
SQLite is used for demonstration purposes instead of enterprise monitoring platforms.
Remediation actions are intentionally non-destructive.