VS Code Integration
AI safety guardrails for LLM prompts using the THSP protocol (Truth, Harm, Scope, Purpose).
Supported IDEs
| IDE | Installation | Status |
|---|---|---|
| VS Code | VS Code Marketplace | Available |
| Cursor | OpenVSX or Extensions panel | Available |
| Windsurf | OpenVSX or Extensions panel | Available |
| VSCodium | OpenVSX | Available |
Note: Cursor and Windsurf are VS Code forks that use the OpenVSX registry. The same extension works across all supported IDEs.
Installation
VS Code
1. Open VS Code
2. Go to Extensions (Ctrl+Shift+X)
3. Search for "Sentinel AI Safety"
4. Click Install
Or install via command line:
code --install-extension sentinelseed.sentinel-ai-safetyCursor
1. Open Cursor
2. Go to Extensions (Ctrl+Shift+X)
3. Search for "Sentinel AI Safety"
4. Click Install
If the extension doesn't appear, you can install manually:
1. Download .vsix from OpenVSX
2. In Cursor: Ctrl+Shift+P, then "Extensions: Install from VSIX..."
Windsurf
1. Open Windsurf
2. Go to Extensions panel
3. Search for "Sentinel AI Safety"
4. Click Install
Analysis Modes
| Mode | Method | Accuracy | Requires |
|---|---|---|---|
| Semantic (recommended) | LLM-based analysis | High | LLM provider (OpenAI, Anthropic, Ollama, Groq) |
| Heuristic (fallback) | Pattern matching | Limited | Nothing |
For accurate results, configure an LLM provider. Heuristic mode uses pattern matching which has significant false positives/negatives.
Features
Real-time Safety Linting
The extension automatically detects potentially unsafe patterns in your prompts:
| Category | Examples |
|---|---|
| Jailbreak attempts | "ignore previous instructions", persona switches |
| Harmful content | weapons, hacking, malware references |
| Deception patterns | fake documents, impersonation |
| Purposeless actions | requests lacking legitimate benefit |
Commands
| Command | Description |
|---|---|
Sentinel: Analyze | Analyze selected text using THSP protocol |
Sentinel: Analyze File | Analyze entire file |
Sentinel: Insert Seed | Insert standard seed (~1,000 tokens) |
Sentinel: Insert Seed (Minimal) | Insert minimal seed (~360 tokens) |
Sentinel: Set OpenAI Key | Store OpenAI API key securely |
Sentinel: Set Anthropic Key | Store Anthropic API key securely |
Sentinel: Set Custom API Key | Store key for OpenAI-compatible endpoints |
Sentinel: Status | Show current analysis mode and provider |
Sentinel: Compliance | Run all compliance checks (EU AI Act, OWASP, CSA) |
Sentinel: EU AI Act | EU AI Act (2024/1689) assessment |
Sentinel: OWASP | OWASP LLM Top 10 vulnerability scan |
Sentinel: CSA | CSA AI Controls Matrix assessment |
Sentinel: Scan Secrets | Scan for API keys and credentials |
Sentinel: Sanitize | Check for prompt injection patterns |
Sentinel: Validate | Validate LLM output for security issues |
Sentinel: SQL Injection Scan | Detect SQL injection patterns in prompts |
Sentinel: Metrics Dashboard | View analysis statistics and history |
Sentinel: Clear Metrics | Clear all stored metrics |
Configuration
Supported Providers
| Provider | API Key Required | Description |
|---|---|---|
| OpenAI | Yes | GPT-4o, GPT-4o-mini, etc. |
| Anthropic | Yes | Claude 3 Haiku, Sonnet, Opus |
| Ollama | No | Local models (llama3.2, mistral, qwen2.5) |
| OpenAI-compatible | Yes | Groq, Together AI, or any OpenAI-compatible API |
Setting Up API Keys
For accurate analysis, configure an LLM API key:
1. Open Command Palette (Ctrl+Shift+P or Cmd+Shift+P)
2. Run Sentinel: Set OpenAI Key or Sentinel: Set Anthropic Key
3. Enter your API key (stored encrypted in VS Code's SecretStorage)
Ollama (Local, Free)
Run models locally with no API key:
2. Pull a model: ollama pull llama3.2
3. Start the server: ollama serve
4. In VS Code Settings (Ctrl+,), search for "sentinel" and set:
- sentinel.llmProvider: ollama
- sentinel.ollamaModel: llama3.2
OpenAI-Compatible Endpoints
Use any OpenAI-compatible API (Groq, Together AI):
1. Get API key from your provider
2. Run Sentinel: Set Custom API Key command
3. Configure in settings:
- sentinel.llmProvider: openai-compatible
- sentinel.openaiCompatibleEndpoint: Your API URL
- sentinel.openaiCompatibleModel: Model name
| Provider | Endpoint | Example Model |
|---|---|---|
| Groq | https://api.groq.com | llama-3.3-70b-versatile |
| Together AI | https://api.together.xyz | meta-llama/Llama-3.3-70B-Instruct-Turbo |
All Settings
| Setting | Default | Description |
|---|---|---|
sentinel.enableRealTimeLinting | true | Enable real-time safety linting |
sentinel.seedVariant | standard | Default seed variant (minimal/standard) |
sentinel.highlightUnsafePatterns | true | Highlight unsafe patterns |
sentinel.llmProvider | openai | LLM provider |
sentinel.openaiApiKey | "" | OpenAI API key |
sentinel.openaiModel | gpt-4o-mini | OpenAI model |
sentinel.anthropicApiKey | "" | Anthropic API key |
sentinel.anthropicModel | claude-3-haiku-20240307 | Anthropic model |
sentinel.ollamaEndpoint | http://localhost:11434 | Ollama server endpoint |
sentinel.ollamaModel | llama3.2 | Ollama model |
sentinel.openaiCompatibleEndpoint | "" | Custom API endpoint |
sentinel.openaiCompatibleApiKey | "" | Custom API key |
sentinel.openaiCompatibleModel | llama-3.3-70b-versatile | Custom API model |
The THSP Protocol
Every request is evaluated through four gates:
| Gate | Question |
|---|---|
| Truth | Does this involve deception? |
| Harm | Could this cause harm? |
| Scope | Is this within boundaries? |
| Purpose | Does this serve legitimate benefit? |
All four gates must pass for content to be considered safe.
Understanding Analysis Results
The extension shows:
| Element | Description |
|---|---|
| Method | Semantic (LLM) or Heuristic (pattern matching) |
| Confidence | How reliable the analysis is |
| Gate results | Pass/fail for each THSP gate |
| Issues | Specific concerns detected |
| Reasoning | Explanation (semantic mode only) |
Severity Levels
| Level | Description |
|---|---|
| Error | High-risk patterns (weapons, safety bypass) |
| Warning | Potential issues (jailbreak attempts) |
| Information | Consider reviewing |
| Hint | Suggestions (missing Sentinel seed) |
Compliance Checking
The extension includes regulatory compliance checking:
| Framework | Coverage | Description |
|---|---|---|
| EU AI Act | Article 5 prohibited practices, Annex III high-risk contexts | Risk classification |
| OWASP LLM Top 10 | 5/10 vulnerabilities with strong THSP coverage | Input and output validation |
| CSA AI Controls Matrix | 10/18 domains with THSP support | Security domains assessment |
Supported Languages
| Language | Status |
|---|---|
| Markdown | Supported |
| Plain text | Supported |
| Python | Supported |
| JavaScript/TypeScript | Supported |
| JSON | Supported |
| YAML | Supported |