sentinel scan --path ./my-project --all

┌────────────────────────────────── Summary ──────────────────────────────────┐
│  Risk level        LOW  (0.25)                                              │
│  Files reviewed    2                                                        │
│  Findings          7                                                        │
│  Bugs found        3                                                        │
│  Auto-fixes        2    ← applied automatically                             │
│  Pending fixes     1    ← needs human review                                │
└─────────────────────────────────────────────────────────────────────────────┘

Quick start

pip install zendev-sentinel
sentinel init          # saves API keys to ~/.sentinel/.env
sentinel github-setup  # wires up your GitHub webhook
sentinel serve         # start listening for PRs

Two free API keys required — takes ~2 minutes, no credit card:

• Groq → console.groq.com
• HuggingFace → huggingface.co/settings/tokens

What it does

Failing test
    │
    ▼
Reproduce  →  strip to minimal repro script
    │
    ▼
Root cause  →  identify source file + line, form hypothesis
    │
    ▼
Fix proposer  →  draft 1–3 candidate patches (unified diff)
    │
    ▼
Verifier  →  apply each patch in sandbox, pick the first green one
    │
    ▼
AUTO_MERGE or HUMAN_REQUIRED

Pipeline

PR opened / pushed
        │
        ▼
   Risk scorer  ──→  score 0.0–1.0
        │
    ┌───┴───────────────────────────────────────┐
    │ low risk          │ medium / high risk     │
    │ lightweight pass  │ full swarm             │
    └───────────────────┴───────────────────────┘
        │
        ▼
  ┌─────────────────────────────────────────────┐
  │  PARALLEL                                   │
  │  Review swarm      Test swarm               │
  │  ├── Security      ├── Module tests         │
  │  ├── Performance   ├── Coverage analysis    │
  │  ├── Style         └── Integration tests    │
  │  ├── Architecture                           │
  │  └── Lead reviewer                          │
  └─────────────────────────────────────────────┘
        │
        ▼  (on test failures)
  Bug squad  →  Reproduce → Root cause → Fix → Verify
        │
        ▼
  Trust layer  →  Explain → Gate → Post PR comment

Commands

sentinel scan --path . --staged      # staged git changes only
sentinel scan --path . --branch main # diff vs a branch
sentinel scan --path . --all --output report.md  # save to file

LLM providers

Set LLM_PROVIDER in ~/.sentinel/.env:

Supported languages

Security

• Sandbox: network_mode=none, non-root uid 1000, memory + CPU hard limits
• Webhooks: HMAC-SHA256 verified before any payload is parsed
• Sensitive paths: auth / payment / migrations always require human approval
• Secrets: stored in ~/.sentinel/.env — never committed to version control
• Pre-scan: regex secret detection on every diff before any LLM call

Self-hosted (team use)

Run on a shared server with Ollama — no API keys, no quota:

ollama pull qwen2.5-coder:7b
LLM_PROVIDER=ollama sentinel serve

Or with Docker Compose:

docker compose -f docker/docker-compose.yml up -d

License

AGPL-3.0 — free to use and self-host. If you offer SENTINEL as a hosted service, your full stack must be open-sourced under the same license.