FolkTech Sentinel

Local security monitor that watches your machine for unauthorized screen capture, data exfiltration, and suspicious app behavior. No cloud dependency — everything runs locally.

What It Does

• Process Monitor — Detects apps using screen capture APIs, video recording, or running with dangerous permissions
• Network Monitor — Tracks outbound connections from watched apps, resolves where data is going (IP → hostname → organization)
• TCC Monitor (macOS) — Watches for privacy permission changes (Screen Recording, Camera, Microphone, Accessibility)

Alert Levels

Setup

macOS

cd ~/Developer/sentinel
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Windows

cd C:\path\to\sentinel
python -m venv venv
venv\Scripts\activate
pip install -r requirements.txt

Linux

cd /path/to/sentinel
python3 -m venv venv
source venv/bin/activate
pip install -r requirements.txt

Commands

Run Continuously (Daemon Mode)

Scans every 5 seconds. Alerts pop up in real time. Press Ctrl+C to stop.

python sentinel.py

Saves baseline automatically on shutdown.

One-Time Scan

Run all monitors once and exit. Good for a quick check.

python sentinel.py --scan

Full Report

Shows current privacy permissions and all active network connections from watched apps.

python sentinel.py --report

Establish Baseline

Snapshots current network connections as "normal." Future scans flag anything new.

python sentinel.py --baseline

Run this once when you're confident your system is clean.

Log Files

Logs are written to sentinel/logs/ with one file per day:

logs/sentinel-2026-03-29.log

Format:

2026-03-29 14:51:30 | [RED] [process] Screen capture detected: Comet Helper (PID 896) — Pattern matched: 'video_capture.mojom'

Configuration

Edit config.py to customize:

• SCAN_INTERVAL — How often to scan (default: 5 seconds)
• WATCHED_APPS — Which apps to monitor network connections for
• SCREEN_CAPTURE_PATTERNS — Process patterns that indicate screen capture
• KNOWN_TELEMETRY — Known analytics services (flagged YELLOW instead of RED)
• KNOWN_FIRST_PARTY — Expected API endpoints (flagged GREEN)

Adding a watched app

Open config.py and add to the WATCHED_APPS list:

WATCHED_APPS = [
    "claude",
    "Comet",        # Perplexity
    "ChatGPT",
    "YourNewApp",   # ← add here
]

Marking a destination as safe

Add to KNOWN_FIRST_PARTY in config.py:

KNOWN_FIRST_PARTY = {
    "anthropic": "Anthropic API",
    "github.com": "GitHub",   # ← add here
}

Cross-Platform Notes

Windows/Linux Adaptations Needed

1. Notifications — Replace osascript in alerts.py:
   • Windows: use plyer or win10toast package
   • Linux: use notify-send command
2. TCC Monitor — Only works on macOS. On Windows/Linux, the TCC monitor will simply skip (no crash).
3. WHOIS — Install whois command or use Python ipwhois package.

Recommended First Steps

1. Run python sentinel.py --report to see what's on your machine right now
2. Review the permissions list — revoke anything you don't recognize
3. Run python sentinel.py --baseline to establish what's normal
4. Run python sentinel.py in a dedicated terminal to monitor continuously

Built by FolkTech AI