API documentation

Every request carries your key in the X-API-Key header. Get one from your account → API keys — it's shown only once when you create it, copy it then.

curl "https://centinela.llimalabs.com/api/v1/status?url=https://example.com/mcp" \
  -H "X-API-Key: cnt_your_key_here"

Without the header, or with an invalid/revoked key, the request returns 401.

Returns the trust status of a specific MCP server — one you actually watch (you have an active subscription), from the public catalog or your own private one. Being in the public catalog isn't enough on its own: you need to subscribe first from your dashboard, same as your plan's server limit requires.

{
  "url": "https://example.com/mcp",
  "in_catalog": true,
  "status": "sano",
  "findings_count": 0,
  "worst_severity": ""
}

If you use an MCP server that only runs on your own machine — configured with command + args in your AI client, no URL at all — Centinela can't reach it on its own: there's no network address to connect to. The local CLI (centinela-agent) solves exactly that: it installs on your machine, finds those servers, launches them the same way your AI client already does, and sends the result to your account — same dashboard, same alerts, same analysis as any other server.

curl -Lo centinela-agent https://centinela.llimalabs.com/downloads/centinela-agent-linux-amd64
chmod +x centinela-agent

./centinela-agent login cnt_your_key_here
./centinela-agent scan

Encontrados 2 servidor(es) MCP local(es).

→ claude-desktop · filesystem (npx)... 6 herramienta(s), sin hallazgos
→ cursor · git (uvx)... 4 herramienta(s), 1 hallazgo(s)

Listo. Revisa el detalle en https://centinela.llimalabs.com/dashboard

Each local server shows up on your dashboard just like one with its own URL, labeled 🖥️ Local server · [client] instead of an address, so it stands out at a glance. Running scan again re-scans the same servers without duplicating rows — handy to run by hand after touching your AI client's config, or to drop into your own cron.

API requests per month, summed across all your keys — not per individual key.

You can see your own usage this month and each key's history from your account.

Centinela is also, itself, an MCP server: if you're working with an agent that speaks that protocol, you can give it direct access to check_server_trust instead of it calling the API over HTTP by hand. Useful when the agent itself will decide, on the fly, whether to use another MCP server you've just pointed it at.

Available on paid plans (Starter, Pro, and Business) — on the Free plan, the tool responds with an error explaining that you need to upgrade. The REST API (GET /api/v1/status) stays available on Free, with its own monthly limit.

The endpoint is https://centinela.llimalabs.com/mcp (streamable-HTTP transport), and requires the same X-API-Key header as the rest of the API — the same key you already created, nothing new to generate.

{
  "mcpServers": {
    "centinela": {
      "url": "https://centinela.llimalabs.com/mcp",
      "headers": { "X-API-Key": "cnt_your_key_here" }
    }
  }
}

Without a subscription to the queried server, the tool returns an error visible to the agent (not a silent failure) explaining that you need to subscribe first. Counts toward your plan's same monthly limit as the REST API.

A POST to your own URL the moment a new finding (medium or high severity) shows up on a server you watch — to feed into Slack, PagerDuty, or your own system, without relying on email. It fires under the same criteria email already uses, so you'll never get a double alert for the exact same finding across both channels and then nothing else.

Available on paid plans (Starter, Pro, and Business). Managed from your account → Webhooks — the signing secret is shown only once, when you create it.

{
  "event": "findings.new",
  "server_id": 42,
  "server_name": "example-mcp",
  "generated_at": "2026-08-25T18:00:00Z",
  "findings": [
    { "category": "hidden_unicode", "severity": "high", "tool_name": "search", "description": "..." }
  ]
}

No automatic retries if your URL fails or times out — every attempt (success, error code, or no response) is logged in your account's delivery history so you can diagnose your own receiver. Email keeps working as a backup, so a down webhook never leaves you without alerts.