This is a submission for the MLH x DEV Writing Challenge What I Built Halfway through testing a Solana swap router on Friday night, I realized how easy it is for an autonomous agent to sign away an entire SPL token account if a malicious Cross-Program Invocation (CPI) slips a TokenProgram::SetAuthority(AccountOwner) call into the instruction bundle. Most wallets show a balance delta preview, yet an agent loop calling a raw signing key has no visual prompt unless you inspect the instruction tree before the Ed25519 signature happens. I built SolanaSentinel (https://solana-ai.prince.sh) during the MLH Solana Hackathon to act as a pre-signature CPI firewall, multi-DEX order split simulator, Solana Pay checkout generator, and on-chain security arena on Solana Devnet. When you enter a plain-English intent like swapping 1.5 SOL to USDC with a 35 bps slippage cap, SolanaSentinel compiles the exact 3-instruction tree: ComputeBudget111111111111111111111111111111 setting a 140,000 compute unit limit and 1,500 micro-lamports priority fee. JUP6LkbZbjS1jKKwapdHNy74zcZ3tLUZoi5QNyVTaV4 executing SharedAccountsRoute across Orca Whirlpools (65%) and Raydium CLMM (35%). MemoSq4gqABAXKb96qnH8TysNcWxMyWCqXgDLGmfcHr anchoring a 256-bit SHA-256 provenance digest of the prompt and vault address onto Solana Devnet. If a prompt or upstream payload tries to inject SetAuthority or exceed the 2.0 SOL daily policy cap, the firewall scores the payload at 96/100 risk and halts the ephemeral Ed25519 session signer before a signature is produced. Demo Live App: https://solana-ai.prince.sh GitHub Repository (21 commits during hacking): https://github.com/princejain756/solana-ai-guard-and-defi-agent Walkthrough Video: https://youtu.be/WqK0C9k8Vqw Partner Technologies Solana Devnet JSON-RPC & Solana Actions v2.1.3: The engine polls getVersion, getSlot, getLatestBlockhash, getRecentPerformanceSamples, and getSupply directly from https://api.devnet.solana.com with automatic RPC failover, derives deterministic Base58 agent vaults and ephemeral Ed25519 session signers via Node's native node:crypto, and computes canonical 8-byte Anchor discriminators (sha256("global:")[0..8]). It also exposes /actions.json and /api/actions/audit so Solana Blinks clients can run CPI checks directly. Solana Pay & Metaplex Bubblegum cNFTs: For machine-to-machine oracle calls, SolanaSentinel generates solana:?amount=0.05&reference= URIs that settle in a single 420 ms slot, and computes deterministic Bubblegum Merkle leaf hashes for the three interactive security quests. ElevenLabs & Groq Whisper Verification: I embedded a spoken security briefing right into the clearinghouse header using ElevenLabs (eleven_multilingual_v2) and generated custom mechanical click, telemetry scan, and firewall alert sound effects for the walkthrough video. My first TTS pass rushed through "SHA-256" so badly that it sounded like "SHA-2-6", and my first stitched full-page capture had a visible horizontal cut across the cards. Running the audio through Groq's whisper-large-v3-turbo word-timestamp API caught the mispronunciation immediately so I could rewrite the phonetic spelling and fix the exact 733 px scroll offset before rendering the final 1080p video. Hackathon Experience Shipping across both MLH Global Hack Week: Builders Week and the MLH Solana Hackathon over the same weekend pushed me to ditch generic dark-purple templates altogether. I redesigned SolanaSentinel around a warm archival paper palette (#F7F6F2), hairline rules, and a custom screenprint clearinghouse emblem so reading raw Base58 program IDs and instruction hex feels like inspecting a Swiss financial ledger. What other CPI attack patterns would you want a pre-signature firewall to catch before an autonomous agent signs?