> Every Sentinel doc, as Markdown: https://runsentinel.app/llms.txt

# Alert when a Clarity contract's admin or owner changes

Get an email, Slack message or signed webhook when a new address calls an admin function, a role moves, or a token gets a new minter. One line per watch, with a 90-day backtest before it's on.

The examples use `example-vault` and `example-token`; swap in your own contracts.

## Find the admin functions

```sh
$ sentinel show SP….example-vault
```

`show` lists the `@admin` and `@control` groups, read from the contract's code. `@admin` is every function the code marks as an admin operation; `@control` is the functions that change who controls the contract. It is free and turns nothing on. Over MCP, the `show` tool does the same.

## Alert when a new address uses an admin function

```sh
$ sentinel when call example-vault @admin --new-caller --to email
$ sentinel when call example-vault @control --role-change --to slack:#oncall
```

`--new-caller` alerts when an address calls an admin function for the first time, so the usual callers stay quiet. `--role-change` alerts on every call that changes who holds a role. Over MCP, send the same text to the `when` tool: `when { line: "call example-vault @admin --new-caller --to email" }`.

## Alert when a token gets a new minter

```sh
$ sentinel when mint example-token example-token --new-minter --to email
```

The arguments are the token's contract and the token's name. A mint has no sender in the event, so the minter is the contract the transaction called, else its sender. `--new-minter` alerts when one that has never minted this token mints.

## Alert on a multisig contract

```sh
$ sentinel when call example-multisig add-signer --to slack:#oncall
```

This watches calls to the multisig contract's own functions, such as the one that changes its signer set. Name the function the contract's code defines; `sentinel show` lists them. It says nothing about signers who approve off-chain.

## What arrives

An alert has a plain headline, such as "A first-time caller" or "A function that changes a role was called". Under it are the function, the caller and the transaction, then what to check first and the commands that dig in (`sentinel show alr_…`). A webhook carries the same facts as typed fields.

## What to know

| | |
|---|---|
| Direct calls only | A call watch sees calls a person signs, not a call nested inside another contract's call (a DAO proposal, an authorized market). |
| State changes | Control changes also reads the state its functions write every 10 minutes. A change no watched direct call explains alerts as "changed outside a watched direct call". |
| Maps | A map is read only at keys already seen in calls, so a new entry under a key never seen isn't caught yet. |
| After the block | An alert arrives after the block that holds the event, not from the mempool. It is a correlation, not a confirmed attack. |
| Cost | Free shows what would have fired and sends one real past match as a test. Live mainnet alerts start at Builder, $19 per contract a month ([Pricing](/pricing)). Events are never billed. |

## Related

- [Watches & alerts: what a watch can see](/docs/watches-and-alerts#what-a-watch-can-see)
- [Monitor a Stacks contract and get alerts](/docs/monitor-a-stacks-contract)
- [Alert when funds leave a Stacks contract over a limit](/docs/alert-on-large-outflows)