> Every Sentinel doc, as Markdown: https://runsentinel.app/llms.txt

# Alert when funds leave a Stacks contract over a limit

Get an email, Slack message or signed webhook when STX or a token leaves a contract above an amount, a share of its balance or a total for the day. One line per watch, with a 90-day backtest before it's on.

The examples use `example-vault`; swap in your own contract. Amounts are in token units (`2` is 2 sBTC).

## Alert above an amount

```sh
$ sentinel when transfer example-vault stx --out --over 10000 --to email
$ sentinel when transfer example-vault sBTC --out --over 1 --to slack:#oncall
```

Each alerts when one outflow of the token (or `stx`) is over the amount. Over MCP, send the same text to the `when` tool: `when { line: "transfer example-vault sBTC --out --over 1 --to slack:#oncall" }`.

## Alert above a share of the balance

```sh
$ sentinel when transfer example-vault sBTC --out --over 20%
```

This alerts when one outflow is 20% or more of what the contract held before it, at any vault size. It works for one named token or `stx`, and not with `--within`, `--new-recipient`, an inflow or `*` (any token). Outflows in one block add up.

## Alert on a running total

```sh
$ sentinel when transfer example-vault sBTC --out --over 2 --within 1d
```

This alerts when more than 2 sBTC leaves within a day, however many transfers it takes.

## Alert on a new recipient

```sh
$ sentinel when transfer example-vault sBTC --out --over 1 --new-recipient
```

This alerts when 1 sBTC or more goes to a recipient the contract has not sent to before. `--new-recipient` needs `--over` and does not go with `--within`.

## Say it in a sentence

```sh
$ sentinel describe "alert if more than 5 sBTC leaves example-vault"
```

`describe` shows the line it reads the sentence as, what that line would have done in the last 90 days, and its cost. It writes nothing.

## What arrives

A plain headline, then one fact per line, then what to check first.

```txt
1.55 EXT left the contract
Amount: 1.55 EXT
To: «SP….recipient»
Your limit: none set, so every outflow alerts
Check first: the recipient, and whether this payout was planned.
```

The webhook carries the same facts as typed fields, with `kind: "money_out"` and the transaction link. A move between a protocol's own contracts is not an outflow and never alerts.

## What to know

| | |
|---|---|
| Any call depth | A transfer is seen however deep the call: a move inside another contract's call still alerts. |
| No limit | An outflow watch with no `--over` alerts on every outflow. |
| After the block | An alert arrives after the block that holds the event, not from the mempool. It is detection: the transaction is already onchain, and an alert is a correlation, not a confirmed attack. |
| Cost | Free shows what would have fired and sends one real past match as a test. Live mainnet alerts start at Builder, $19 per contract a month ([Pricing](/pricing)). Events are never billed. |

## Related

- [Watches & alerts: subjects and rules](/docs/watches-and-alerts#subjects-and-rules)
- [Monitor a Stacks contract and get alerts](/docs/monitor-a-stacks-contract)
- [Alert when a contract's admin or owner changes](/docs/alert-on-admin-changes)