Sentinel brings the Claude accounts you own into one place and switches between them for you, scans and sandboxes every request for secrets and risky tool calls, cuts the tokens your sessions waste, and catches overage spend before it runs away.
Works with Claude Code and the Claude Desktop app. macOS, Windows, and Linux. MIT licensed.
See it in action
Pick a feature to watch a short demo. The carousel advances on its own; hover to pause.
Scanning, permission rules, and an OS-level sandbox, all in flight.
Everything in one tray
Sentinel sits between Claude and Anthropic as a local proxy, covering both the Claude Code CLI and the Claude Desktop app, so it can see and act on every request without ever sending your data anywhere else.
Sentinel scans every prompt and response as it passes through the local proxy. Secrets, PII, prompt-injection payloads, and risky tool calls are flagged the instant they appear, and you choose whether to just watch or block. Add per-tool permission rules that sync into Claude Code, and sandbox risky commands so they reach only the files and network domains you allow.
Sentinel cuts token cost three ways: route routine work to curated subagents pinned to a cheaper model, compress the bloated tool output that fills your context window (reversibly, so nothing is lost), and move MCP tool definitions out of context with code execution. The Optimize page shows realized and potential savings in both tokens and dollars.
Add the accounts you own and let Sentinel switch the active one for you. Auto mode favors the account whose limit resets soonest, so you are not switching by hand, and every switch is one click that rewrites the active credential safely. Claude Desktop can route through the same pool with one click.
Watch every rate limit in real time, pooled and per account, with live reset countdowns in a single view instead of one account at a time. Claude Code never tells you when you cross into paid overage or how much overage budget is left, and on Team and Enterprise plans it hides your personal budget. Sentinel surfaces both, and a spend cap stops runaway billing before it gets away from you.
Set usage thresholds per account or across the whole pool and get a native OS notification the instant you cross one. Every alert is recorded in a history you can review, so a limit never surprises you mid-session.
Sentinel collects OpenTelemetry metrics straight from Claude Code and breaks down cost, token counts, and cache hit rate over time. Claude Code's own /cost shows only the running total for your current session and forgets it the moment you quit, so Sentinel keeps the full history across every session and account.
Why Sentinel
Because one local proxy sees every request, Sentinel can manage all the accounts you own from one place, guard what leaves your machine, and trim the tokens you would otherwise waste.
Multi-account
Keep the accounts you own in one place and let Sentinel switch the active one for you, so you are not copying credentials between machines or losing track of which account is in use. The Claude Desktop app routes through the same proxy with one click, so Chat and Code inference share the pool, usage tracking, and alerts.
Switch the active account, hands-free
Turn on Auto and Sentinel moves the active account for you, favoring the one whose 5-hour window resets soonest so you are not switching by hand. The header always shows which account is in use, and each switch rewrites the active credential safely.
Pro, Max, Team, and Enterprise side by side
Add the accounts you own and each gets a live card with utilization, plan type, and a reset countdown. One view shows them all side by side instead of a separate login per tab.
Bound overage before it runs away
Set a rolling 7-day USD cap per account or across the whole pool. A capped account pauses from rotation until its spend ages out, so paid overage stays bounded without you watching the meter.
Security
Sentinel sits in the request path, so it can inspect what leaves your machine, enforce which tools are allowed to run, and box in the ones that do.
Secrets, PII, and injection, in flight
Every prompt and response is scanned as it passes through the local proxy. Secrets, PII, prompt-injection payloads, and risky tool calls are flagged the instant they appear, and you decide whether to just watch or block by severity.
Allow, deny, or ask per tool
Write per-tool rules by name and arguments. Allow and deny rules sync straight into Claude Code so it enforces them silently, while ask rules hold the request for your approval right in the tray.
OS-level file and network limits
Run the commands Claude Code and code-mode MCP servers issue inside an OS sandbox that limits the files and domains they can reach. Off by default; macOS and Linux get full filesystem and network isolation, Windows is network-only.
Optimization
The proxy can see the tokens your sessions waste, and it gives you three levers to cut them. Each one shows the savings it actually banked, in tokens and dollars.
Route routine work to a cheaper model
A library of pre-built subagents, most pinned to a cheaper model, that Sentinel recommends based on how you actually work. Routine jobs like file reads and log parsing run cheap and hand back a digest instead of raw output.
Trim bloated tool output, reversibly
Oversized tool results are the quiet context hog. Sentinel trims them in flight at the aggressiveness you choose, and reversible mode keeps the original a tool call away so nothing is ever lost.
Move MCP definitions out of context
Bridge your MCP servers through a local loopback endpoint so their tool definitions stop riding along in every request. Claude calls a small skill instead, and the definitions leave your context for good. Loopback-only, with a per-server allowlist.
Privacy by design
The proxy listens on 127.0.0.1 and is never exposed to the network. Requests go straight to Anthropic and back.
Account credentials live in the system keychain (Keychain, Credential Manager, or libsecret), never in plaintext.
Nothing is phoned home. Only redacted fingerprints are stored locally, never the original secret text.
Get Sentinel
Grab the latest signed installer from the releases page. Sentinel auto-updates once it is installed.