Sentinel - AI-Powered Security Hardening

Sentinel is a developer-first CLI tool that finds security vulnerabilities in projects (supporting Python, JavaScript/TypeScript, HTML, CSS, and dependencies) and provides AI-powered fixes - all in an interactive terminal dashboard.

Features

• SAST - detects SQLi, XSS, command injection, hardcoded secrets, insecure crypto, and frontend/HTML vulnerabilities.
• SCA - checks dependencies against OSV.dev and NVD.
• DAST - optionally tests running web apps.
• Multi-Vendor AI enrichment (Mistral, OpenAI, Anthropic, Gemini, Groq, Ollama) - re-evaluates severity, explains attack scenarios, suggests fixes.
• Interactive TUI - no more grepping JSON logs.
• Auto-fix - applies safe remediations.
• CI/CD ready - GitHub Action, Docker, PyPI.

Quick Start

# Install
pip install sentinel-scanner

# Standard offline scan (SAST & SCA)
sentinel scan .

# Interactive AI assistance (prompts for vendor & credentials if needed)
sentinel scan . --ai

# Choose vendor and provide API key directly via CLI
sentinel scan . --ai-vendor openai --ai-api-key sk-proj-...
sentinel scan . --ai-vendor anthropic --ai-api-key sk-ant-...
sentinel scan . --ai-vendor mistral --ai-api-key your-key
sentinel scan . --ai-vendor gemini --ai-api-key your-key
sentinel scan . --ai-vendor groq --ai-api-key gsk_...

# 100% Offline AI via local Ollama
sentinel scan . --ai-vendor ollama --ai-model mistral:7b-instruct

# Or configure via environment variables
export OPENAI_API_KEY=sk-...    # Automatically uses OpenAI
export MISTRAL_API_KEY=your-key # Automatically uses Mistral
sentinel scan .

# Optional custom rate limits or model overrides
sentinel scan . --ai-vendor openai --ai-model gpt-4o --ai-rate-limit 2.0

For full documentation, visit Sentinel Docs.

Vulnerability Detection & Offline Remediations

Sentinel works fully out-of-the-box in offline mode. If no AI API key (Mistral) or local Ollama instance is configured, Sentinel still maps findings directly to established security remediation protocols based on industry standards:

Distribution & Running

• PyPI: pip install sentinel-scanner
• Docker: Run Sentinel in a containerized environment (details in Docker README):

  docker run --rm -v $(pwd):/app ghcr.io/ronaldgosso/sentinel:latest scan .
  

• GitHub Action: Integrate into your workflows using uses: ronaldgosso/sentinel-action@v1.

GitHub Actions / CI/CD Workflows

Sentinel can be added to any repository to run as an automated GitHub Security Bot. On every Pull Request or push, Sentinel scans the code, posts a rich Markdown report directly to the PR comments, adds a Job Summary in GitHub Actions, and uploads SARIF findings to GitHub Code Scanning.

Quick Setup:

Generate the ready-to-use GitHub Action workflow in your project:

sentinel init --github-action

Project Documentation & Useful Guides

Check out these documents to learn more about developing, building, and contributing to Sentinel:

• Docker Guide - Details on running Sentinel via Docker, passing environment variables (like API keys), and exporting reports.
• Contributing Guidelines - Guide on repository setup, adding custom SAST/AST detectors, running tests, and the Pull Request/release process.
• Product Roadmap - Overview of features planned for future releases (v1.1, v1.2, and v2.0).
• Security Policy - Instructions on how to report security vulnerabilities privately.
• Code of Conduct - Standards of behavior to ensure a welcoming community.

License

This project is licensed under the GPLv3 license. See the LICENSE file for details.

Show your support

Give a star if this project helped you!

Community & Socials

Spread the word and share your journey with Sentinel using these engaging hashtags across GitHub, Twitter/X, and LinkedIn: