# Reported issues for SentinelX MCP Pod holds 16 of 17 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user. Back to [SentinelX MCP](/mcp/sentinelx-mcp). ## Most discussed ### Hub: expose bounded model-visible artifact export for local files ## Summary SentinelX can safely read/list/search local files, and the Agent already has a binary-safe `file_export_*` path for Hub-coordinated host-to-host transfer. What is still missing is the opposite-facing last mile: a connected model cannot ask SentinelX to materialize an allowed local file as a **model-visible native file/artifact** that the chat can consume multimodally. This becomes a hard capability gap for scanned PDFs, images, audio, and other binary evidence. The Agent can access [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/36) · 2026-08-26 · closed · external user · 1 comment ### Agent enrollment succeeds but WebSocket handshake is rejected with HTTP 400 Hi, I'm trying to enroll a Debian 12 VPS with SentinelX Cloud. The installation and enrollment complete successfully, but the host never appears in the SentinelX dashboard and the agent continuously receives HTTP 400 during the WebSocket handshake. Environment: - OS: Debian 12 Bookworm - Python: 3.11.2 - Installation method: official get.sentinelx.app installer - Agent service: sentinelx-cloud-core - Hub: https://mcp.sentinelx.app - ChatGPT SentinelX plugin installed and authenticated - Passw [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/34) · 2026-08-24 · closed · external user · 14 comments ### Windows script_run does not reliably round-trip Unicode for Python or PowerShell 5.1 ## Summary Current Agent 0.11.0 (`e7284d579fc6e7de152716d7bd24c871dd499ce7`) has two interpreter-specific Windows encoding failures under the same user-facing `script_run` contract: - `interpreter="python3"` can inherit a legacy stdio encoding and raise `UnicodeEncodeError` or corrupt text; - `interpreter="powershell"` on Windows PowerShell 5.1 can misdecode UTF-8 script source and/or emit legacy-encoded redirected output while SentinelX decodes captured bytes as UTF-8. Both make ordinary Unic [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/28) · 2026-08-21 · closed · external user · 2 comments ### P1: successful host operations can lose responses, retry execution, or exceed websocket frame limits # Proposed GitHub issue ## Title P1: successful host operations can lose responses, retry execution, or exceed websocket frame limits ## Body A live Windows SentinelX/ChatGPT investigation found multiple end-to-end failure modes where the host operation **completes successfully**, but the result is not reliably delivered to the LLM. This is dangerous for both usability and mutation safety because a caller may interpret the missing/failure-shaped result as "SentinelX is broken" or retry an op [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/24) · 2026-08-18 · closed · external user · 3 comments ### Compact profile: expose block/chunk transfer inside the three-tool surface ## Summary The live compact profile is useful, but ordinary file ingress/staging still falls out of the 3-tool surface even though the backend operations already exist. ## Request Please expose direct upload, chunked/block upload, and staged-edit transfer semantics inside the existing compact surface rather than adding a fourth top-level tool. The goal is capability parity for ordinary host work while preserving the context/tool-selection benefit of `sentinel_execute` / `sentinel_files` / `s [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/22) · 2026-08-17 · closed · outside contributor · 2 comments ### Add a generic opaque per-call context tag across host-operation surfaces ## Summary A small opaque caller-supplied context field would be useful across SentinelX surfaces, not only compact mode or SU24. ## Request Please consider one optional bounded string such as `tag` / `opaque_tag` that host-operation surfaces can carry end-to-end unchanged. The Hub should attach no semantics to it. Stock agents may ignore it; integrations, compatible agents, automation layers, or future SentinelX features may interpret it for their own correlation/routing/context needs. For [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/21) · 2026-08-17 · open · outside contributor · 3 comments ### Compact profile: make help/playbooks profile-aware and lazily scoped ## Summary The new 3-tool compact profile is a real context win, but `help` / `capabilities` / playbook guidance can give much of that context back and sometimes points to full-profile tools that are not exposed while compact mode is active. ## Suggested direction Keep introspection progressive and profile-aware: - small top-level help/index by default; - topic/path lookup for exact operation or workflow guidance; - recovery/playbook text that matches the active profile (or uses profile-neut [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/20) · 2026-08-17 · closed · outside contributor · 2 comments ### Proposal: deterministic project_snapshot for compact project context ## Proposal: deterministic `project_snapshot` for fast project orientation The new compact MCP profile is a great step for reducing model-facing tool/schema overhead. A remaining source of context/tool-call cost on coding tasks is project discovery: before doing useful work, the model often has to list directories, inspect Git state, find manifests/tests, check recent commits, and repeat several reads/searches just to understand the workspace. I would like to propose a small, deterministic, re [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/11) · 2026-08-14 · closed · external user · 7 comments ## Most recent ### AgentChakra OAuth write canary - auto-close Authorization canary requested by the AgentChakra operator. This issue is created only to prove the existing user OAuth path can write to a public external repository, then immediately closed. No project action is requested. [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/40) · 2026-08-31 · closed · external user · 0 comments ### Add end-to-end MCP result delivery receipts for skipped or missing client payloads ## Problem SentinelX can successfully execute and return an MCP tool call while a ChatGPT conversation receives only an opaque placeholder such as `Skipped … messages`. In affected turns, even minimal one-line commands and bounded file reads become uninspectable, so response size alone does not explain the loss. Host-side audit records currently establish execution but not end-to-end delivery. They preserve operation, payload metadata, success/error, duration, and timestamp, but do not provide [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/38) · 2026-08-31 · open · external user · 0 comments ### Cloudflare integration: add read-only security tooling (rulesets, security events, zone settings, access) + guarded mutations ### Summary Requested by an external user operating `frequencies.fr` (reached us by email; they couldn't file directly — their GitHub only has read access to this repo, so issue creation returned 403). Filing on their behalf. The hosted Cloudflare integration exposes only DNS operations (`cloudflare_dns_list_zones`, `cloudflare_dns_list_records`, create/update/delete). Those work well. The gap is the **security surface**: with only DNS tools, the model can't inspect the rules that may be block [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/35) · 2026-08-25 · open · outside contributor · 0 comments ### Hub/ChatGPT: sentinel_git is not exposed although the agent advertises the git op ## Summary SentinelX 0.8.0/0.9.0 advertises the new backend `git` operation, but the hosted ChatGPT MCP tool catalog on a live full-profile connection does not expose the corresponding `sentinel_git` tool. The maintainer update on issue #11 says the dedicated `sentinel_git` tool (`diff` and `apply_patch`) shipped in 0.8.0, and the upgraded 0.9.0 agent reports: ```text ops_supported: [..., "git"] ``` However, querying the live SentinelX tool catalog from ChatGPT after upgrading the connected [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/18) · 2026-08-17 · closed · external user · 1 comment ### CHANGELOG is missing the 0.8.0 sentinel_git release entry ## Summary `CHANGELOG.md` currently jumps from **0.7.0** to **0.9.0** and does not contain a **0.8.0** entry, even though 0.8.0 introduced a substantial new public capability: the structured Git operation / `sentinel_git` tool with `diff` and `apply_patch`. The repository history includes the 0.8.0 work and issue #11 explicitly records that these features shipped in 0.8.0, but operators reading the changelog cannot discover what changed in that release. ## Why this matters 0.8.0 is not a tri [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/16) · 2026-08-17 · closed · external user · 1 comment ### Hub: capability-aware dispatch should fail fast for unsupported ops on mixed-version hosts ## Summary The Hub should capability-check a selected target host before dispatching an operation that the agent does not advertise, especially on mixed-version/mixed-implementation connections. This becomes increasingly important as the shared MCP catalog grows (`project_snapshot`, `git`, future ops) while one LLM connection can front several agents with different versions/capabilities. ## Observed behavior A previous live test documented on issue #10 showed: - one compatible third-party a [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/15) · 2026-08-17 · closed · external user · 1 comment ### Document agent.preferred_profile in all stock config examples ## Summary SentinelX 0.9.0 introduces `agent.preferred_profile` (`compact` | `full`), but the option is only shown in `config.orion.example.yaml` and is absent from the stock example configs operators are most likely to copy. Current repository check: ```text config.example.yaml -> no preferred_profile config.example.windows.yaml -> no preferred_profile config.example.macos.yaml -> no preferred_profile config.orion.example.yaml -> preferred_profile [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/14) · 2026-08-17 · closed · external user · 1 comment ### script_run: unvalidated cwd surfaces as internal_error instead of invalid_payload ## Summary `script_run` passes the caller-provided `cwd` straight to `create_subprocess_exec` without validating it. When `cwd` is inaccessible (e.g. `/home/sentinelx` when the agent user can't enter that directory), the spawn raises `PermissionError` ([Errno 13]) which is not caught in the handler, bubbles up to the executor's generic `except Exception`, and surfaces to the user as a confusing `internal_error: [Errno 13] Permission denied: ''`. It reads like something broke on our side, [Read the thread](https://github.com/pensados/sentinelx-cloud-core/issues/3) · 2026-08-01 · open · outside contributor · 0 comments The remaining reports are on [the project's issue tracker](https://github.com/pensados/sentinelx-cloud-core/issues).