Agent Behaviour Drift Sentinel

The problem

Has this agent's behaviour materially changed?

A compromised, prompt-injected or silently regressed agent rarely announces itself. It keeps answering and keeps calling tools while its tool mix shifts, its escalation rate climbs or its refusal rate collapses. Nothing in the logs is individually alarming, so nobody looks.

What it does

It ingests caller-supplied execution traces, establishes a signed durable baseline of normal behaviour, and reports divergence with a severity, per-dimension attribution and a replayable exemplar episode an investigator can read. Declared maintenance windows and known change markers are reported as suppressed, never silently dropped.

How it works

Baselines are immutable and versioned: setting one always mints a new version, and a baseline that fails signature verification is refused rather than downgraded to unsigned. Below the configured minimum sample a severity is still emitted but capped at informational with an insufficient-sample confidence. Calibration proposes thresholds; they only take effect through an explicit apply step that mints a new signed version.

Tool surface

MCP over stdio. Compatible with Claude Code, Claude Desktop and Cursor, or usable directly as a TypeScript library. No API key, account or Tenable product is required.

• ingest_traces

  Ingest caller-supplied execution traces, reducing non-allowlisted free text to digests.

• set_baseline

  Mint a new signed, immutable baseline version of normal behaviour.

• check_drift

  Compare recent behaviour against a signed baseline and emit a severity.

• explain_drift

  Attribute a finding to behavioural dimensions and replay its exemplar episode.

• calibrate

  Propose a threshold profile from labelled findings without changing anything.

• apply_calibration

  Apply a proposed profile by minting a new signed baseline version.

• configure_suppression

  Declare maintenance windows and known change markers.

What it deliberately does not do

• ·It detects change against a baseline; it does not judge intent or stop the agent.
• ·Suppressed findings are reported as suppressed rather than discarded.
• ·Raw payloads never enter profiles, findings or explanations.