---
sidebar_position: 6
title: md-sentry
---

# md-sentry

> A tripwire for the files that tell your agent who it is. Watch every create, modify, delete, and rename of an agent's markdown brain in real time, tagged by whether the agent itself made the change.

`md-sentry` is an eBPF integrity monitor that catches every modification to an LLM agent's instruction, memory, and skill files, tagged `AGENT` or `EXTERNAL` by process subtree. No polling, no inotify — it intercepts `openat`, `write`, `close`, `dup2`, `vfs_unlink`, and `vfs_rename` in the kernel.

## Running

```sh
yeet run github:yeet-src/md-sentry
```

Target a specific agent or collect a snapshot:

```sh
yeet run github:yeet-src/md-sentry -- --agent claude --channel C0123ABCD   # Slack alerts
yeet run github:yeet-src/md-sentry -- --once --secs 5 | less -R             # 5-second snapshot
```

Stream raw JSON for `jq` or a log pipeline:

```sh
yeet run github:yeet-src/md-sentry/dump.js -- --agent claude | jq -c 'select(.protected and .agent)'
```

## Source

[`yeet-src/md-sentry`](https://github.com/yeet-src/md-sentry) on GitHub.