Monitor a Stacks contract and get alerts

Get an email, Slack message or signed webhook when someone calls a Clarity contract's function, moves value out of it, or changes who controls it. One line per watch, with a 90-day backtest before it's on.

Each watch is one line, the same in the CLI, the MCP server and the SDK. The examples use example-vault; swap in your own contract.

See what you can watch

sentinel show SP….example-vault

show lists the contract's functions, tokens and printed events, and the @admin, @value and @control groups, all read from its code. It is free and turns nothing on. Over MCP, the show tool does the same.

Alert when a function is called

sentinel when call example-vault set-paused --to email
$ sentinel when call example-vault set-paused --caller SP… --to email
$ sentinel when call example-vault set-paused --not-caller SP… --to email
$ sentinel when call example-vault transfer-funds --arg recipient=SP… --to email

--caller, --not-caller and --arg narrow which calls alert. A call watch sees direct calls, not a call nested inside another contract's call.

Alert when value leaves

sentinel when transfer example-vault sBTC --out --over 20% --to slack:#oncall
$ sentinel when transfer example-vault sBTC --out --over 2 --within 1d --to slack:#oncall

The first alerts when one outflow of a token (or stx) is 20% or more of what the contract held before it. The second alerts when more than 2 sBTC leaves within a day. A transfer is seen at any call depth, so a move inside another contract's call still alerts. More in Alert when funds leave a Stacks contract over a limit.

Alert when control changes

sentinel when call example-vault @admin --new-caller
$ sentinel when call example-vault @admin --role-change

@admin is every function the code marks as an admin operation. --new-caller alerts when an address calls one for the first time; --role-change alerts on every call that changes who holds a role. More in Alert when a contract's admin or owner changes.

Say it in a sentence

sentinel describe "alert if more than 5 sBTC leaves example-vault"

describe shows the line it reads the sentence as, what that line would have done in the last 90 days, and its cost. It writes nothing.

Where alerts go

A webhook body is one envelope, { id, type, version, createdAt, test, data }. Check it with verifyWebhook from @secondlayer/sentinel. The API lists every alert too. See Where alerts go for each, or Send Stacks contract alerts to Slack or a signed webhook.

What to expect

Already alerting on function calls?

Each setting maps to a flag on one when call line, and your webhook handler reads Sentinel's envelope.

Next

Send yourself one real past match: sentinel test-alert example-vault --yes. Then the Quickstart, the MCP server and Watches & alerts.