Sentinel - AI-Powered Security Hardening

Sentinel Logo

PyPI version GitHub Actions Docker Image License: GPL v3

Sentinel is a developer-first CLI tool that finds security vulnerabilities in projects (supporting Python, JavaScript/TypeScript, HTML, CSS, and dependencies) and provides AI-powered fixes - all in an interactive terminal dashboard.

Features

  • SAST - detects SQLi, XSS, command injection, hardcoded secrets, insecure crypto, and frontend/HTML vulnerabilities.
  • SCA - checks dependencies against OSV.dev and NVD.
  • DAST - optionally tests running web apps.
  • AI enrichment (Mistral) - re-evaluates severity, explains attack scenarios, suggests fixes.
  • Interactive TUI - no more grepping JSON logs.
  • Auto-fix - applies safe remediations.
  • CI/CD ready - GitHub Action, Docker, PyPI.

Quick Start

# Install
pip install sentinel-scanner

# Scan
sentinel scan .

# With AI (get a free key from Mistral AI)
export MISTRAL_API_KEY=your-key
sentinel scan . --ai

For full documentation, visit Sentinel Docs.

Vulnerability Detection & Offline Remediations

Sentinel works fully out-of-the-box in offline mode. If no AI API key (Mistral) or local Ollama instance is configured, Sentinel still maps findings directly to established security remediation protocols based on industry standards:

Vulnerability Type CWE Description Standard Remediation Protocol
SQL Injection (SQLi) CWE-89 Concatenating untrusted user inputs directly into SQL query strings. Use parameterized queries (prepared statements) e.g., execute("SELECT * FROM users WHERE id = ?", (user_id,)) or ORMs. Never format/interpolate SQL strings.
Cross-Site Scripting (XSS) CWE-79 Rendering untrusted user inputs in HTML templates or outputs without escaping. Remove dangerous raw render calls (`
Command Injection CWE-78 Executing OS commands via subprocess calls with dynamic strings and shell=True. Disable shell execution (shell=False). Pass command strings as sequences of args e.g., subprocess.run(["ls", "-la"]) to prevent shell parser manipulation.
Hardcoded Secrets CWE-798 Storing passwords, API tokens, keys, and private credentials directly inside source code. Move all configuration and credentials to environment variables loaded via .env (e.g., os.getenv("DB_PASS")). Always add .env to .gitignore.
Insecure Cryptography CWE-326 Utilizing weak or deprecated hashing algorithms (like MD5 or SHA-1) and weak ciphers. Upgrade cryptosystems to strong alternatives (e.g., hashlib.sha256 or hashlib.sha3_256 for hashes, and AES-GCM for symmetric encryption).
Frontend/HTML Vulnerabilities CWE-79 Frontend-specific security risk such as unsafe HTML rendering, reverse tabnabbing, un-sandboxed iframe, or inline scripts/events. Avoid dangerouslySetInnerHTML/v-html/innerHTML without DOMPurify sanitization. Use rel="noopener noreferrer" for target="_blank". Add sandbox to iframe tags. Avoid javascript: URIs, inline scripts, and inline event handlers.
Outdated Dependencies CWE-1395 Importing packages containing known CVEs published in OSV.dev and NVD databases. Pin safe dependencies in lockfiles (poetry.lock, uv.lock, package-lock.json) and run package upgrade managers (e.g. pip install --upgrade).

Distribution & Running

  • PyPI: pip install sentinel-scanner
  • Docker: Run Sentinel in a containerized environment (details in Docker README): 
    docker run --rm -v $(pwd):/app ghcr.io/ronaldgosso/sentinel:latest scan .
  • GitHub Action: Integrate into your workflows using uses: ronaldgosso/sentinel-action@v1.

GitHub Actions / CI/CD Workflows

The repository uses automated GitHub Actions workflows to maintain code quality, build Docker images, publish PyPI releases, and host the documentation website:

Workflow File Trigger Description
Continuous Integration (CI) ci.yml Push/PR to main Runs tests, Ruff (linting), and Mypy (type checking) to ensure code meets quality standards before merg[...]
Publish to PyPI pypi-publish.yml Push tag v*.*.* Runs quality checks first. If successful, builds wheels and publishes the distribution packages[...]
Build & Publish Docker docker-build.yml Push to main, tags v*, or PyPI success Automates building the optimized multi-stage Python wheel Docke[...]
Deploy Docs docs.yml Push to main Deploys static files from the website/ folder directly to GitHub Pages at [https://ronaldgosso.github.io/sentinel](h[...]

Project Documentation & Useful Guides

Check out these documents to learn more about developing, building, and contributing to Sentinel:

  • Docker Guide - Details on running Sentinel via Docker, passing environment variables (like API keys), and exporting reports.
  • Contributing Guidelines - Guide on repository setup, adding custom SAST/AST detectors, running tests, and the Pull Request/release process.
  • Product Roadmap - Overview of features planned for future releases (v1.1, v1.2, and v2.0).
  • Security Policy - Instructions on how to report security vulnerabilities privately.
  • Code of Conduct - Standards of behavior to ensure a welcoming community.

License

This project is licensed under the GPLv3 license. See the LICENSE file for details.

Show your support

Give a star if this project helped you!

Community & Socials

Spread the word and share your journey with Sentinel using these engaging hashtags across GitHub, Twitter/X, and LinkedIn:

Project links

Data verified by PyPI on Aug 10, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Familiar2170 from gravatar.com Familiar2170

Credits

PyPI data
Data sourced directly from PyPI's database.

Author: Ronald Gosso

GitHub Statistics

Data verified by PyPI on Aug 10, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License

GNU General Public License v3 (GPLv3) (GPL-3.0)

Requires

Python >=3.10

Provides Extra

dev

Tags

security vulnerability scanner sast sca dast ai

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sentinel_scanner-1.0.11.tar.gz (50.2 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

sentinel_scanner-1.0.11-py3-none-any.whl (54.0 kB view details)

Uploaded Python 3

File details

Details for the file sentinel_scanner-1.0.11.tar.gz.

File metadata

  • Download URL: sentinel_scanner-1.0.11.tar.gz
  • Upload date:
  • Size: 50.2 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for sentinel_scanner-1.0.11.tar.gz
Algorithm Hash digest
SHA256 b1290d9245d4acdab7c0fa1f8c96535123796617c20824010a65e32d7d818f7c
MD5 0236f6c0306c96bc6ef9888a4475fe6a
BLAKE2b-256 2098d1dd727f90cbfad980f5385a8d9d0572f53ee336d5ba0b9291dcc69e7ebb

See more details on using hashes here.

Provenance

The following attestation bundles were made for sentinel_scanner-1.0.11.tar.gz:

Publisher: pypi-publish.yml on ronaldgosso/sentinel

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file sentinel_scanner-1.0.11-py3-none-any.whl.

File metadata

File hashes

Hashes for sentinel_scanner-1.0.11-py3-none-any.whl
Algorithm Hash digest
SHA256 289f3d9deee14da2a851a88530a7d24be368a5487c0213e7b4d7c1a3e9f6bf11
MD5 f1c9e9b4ec51ebccb9e63ace0c7255d0
BLAKE2b-256 000aaa30851e012616cdb5c12c5ac7edafd8ce9d1a6a3313a5626e46625d57b1

See more details on using hashes here.

Provenance

The following attestation bundles were made for sentinel_scanner-1.0.11-py3-none-any.whl:

Publisher: pypi-publish.yml on ronaldgosso/sentinel

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page