Sentient checks its tools. Who checks its API calls?

We added Swytchcode to Sentient, and Sentient said no.

Sentient is a personal assistant that runs on your own computer: background jobs, a memory it tidies every night, voice, and a Telegram bot. It also has something most agents don't. Before it uses a new MCP tool, it reads the tool's description, rates the risk, and offers nothing until you allow it.

Our MCP server offers 11 tools. Sentient rated 5 of them "high risk, decline".

Five red flags

None of the five was about what the tools do. Every flag was about how we'd described them:

Read cold, by a model that has never heard of us, every one of those is a fair reading. A tool description is text the model reads and acts on. "Do this first" in a description really is a way to steer the model, and a scanner should treat it as one.

So we rewrote all five, plainly. While we were in there, we also marked our four lookup tools (list, search, info, discover) as read-only. Before that, Sentient asked before every single search.

The rewording helps every MCP client that reads our tools, not just Sentient. On the next scan, all 11 passed.

Where a tool review stops

Here's the thing about a review: it happens once, when you add the tool. After you click allow, exec is trusted, and exec is how the agent makes every API call. A balance lookup and a $2,000 refund both go through the same tool.

That matters more in Sentient than in most agents, because Sentient is built to work while you're away. You describe a job, it asks you once, and then it runs on a schedule, when an email arrives, or when a watched price drops. At 3am, nobody is reading the prompts.

That's the gap Swytchcode fills. Sentient vets the tool. Swytchcode vets each call the tool makes, against rules the agent can't change:

• The 3am job can check failed payments. Reads run.
• If the same job decides to retry a charge, the call is held until you approve it on Telegram or Slack, through a separate Swytchcode bot. Sentient can't approve it for you.
• The Stripe key stays with Swytchcode. Sentient never holds it, and a key pasted into chat is refused.

We tested this with Sentient 3.0.0b1 from source on Linux, against a mocked Stripe. Reads ran, writes were held, and the agent's attempts to add an "allow" rule or replace the approval rule were refused. We drove Sentient's engine directly, so we haven't yet tried the desktop window, macOS or its Telegram bot.

Two settings to change

Choose "Always allow" for the Swytchcode tools. Sentient asks before each tool that can change something: exec, add, get, connect and policy_add. Swytchcode also holds every write for approval. Leave both on and you approve each refund twice, once in Sentient with no details, once in Swytchcode with the amount and the customer. Let Sentient trust the tool, and approve once, where you can see what you're approving.

Turn off Code execution. Sentient's file tools stay in its own folder, and its terminal is off by default. Its code tool is on by default, though, and after you approve a run, it executes Python on your computer. That Python could edit Swytchcode's rules file or read your saved credentials. Turn it off in Settings → Code execution, and keep Settings → Terminal off.

Set it up

Sentient is a desktop app, so it starts Swytchcode itself as a local command. No server to run and no token. On the same computer, with the latest swy and a Swytchcode account (approvals need the Business or Enterprise plan):

npm install -g swytchcode
swy init --operator --editor=none --project ~/agent-swy
swy login
cp -R ~/agent-swy/agent-skill/swytchcode-operator ~/.sentient/skills/

Then in Sentient, open Integrations → Add server, choose Local command, and set the command to swytchcode with the arguments mcp serve --profile operator --project /home/you/agent-swy. Set What Sentient may do to Read and write, allow the 11 tools when Sentient lists them, and restart it so it loads the skill.

The Sentient setup guide has Windows paths and connecting your first app.

Reviewed by the agent we came to guard

We build guardrails for agents. It was humbling to have an agent check ours and find problems in them.

The lesson cuts both ways. Agents should vet their tools, because a tool description is a prompt with no one watching it. And tools should vet each call, because the review only happens once and the agent keeps running long after you click allow.

Sentient now does the first. Swytchcode does the second. Between them, a background job at 3am can look up whatever it likes, and still can't spend a cent without you.