Sentinel is a software-security ecosystem: Cloud analyzes pull requests and repository activity, CLI protects local and CI workflows, Audit organizes multi-tool investigations, and Oracle isolates merge authorization.
“Free download” means the repository is available without a purchase. Use, modification, and redistribution remain subject to each repository’s BUSL-1.1 license and Additional Use Grant.
Sentinel Cloud
Review PR security before merge.
Analyze pull requests through manual scans or the GitHub App, depending on the plan and repository setup. Review findings, scan history and available evidence in one workspace.
CLI scans run when invoked locally or in CI. Audit coordinates scoped investigations. Oracle handles merge authorization. Cloud PR automation is available on eligible plans when configured.
Sentinel scanner findings come from configured analysis engines. Optional AI features are separate — Sentinel Oracle can use configured AI providers for summaries and agent workflows; those outputs do not replace scanner evidence.
No Black Boxes
Know what each product covers
Sentinel Cloud, CLI, Audit and Oracle have separate scopes. Scanner results depend on the selected product, enabled checks, repository contents, and configured integrations. Audit reports tool health and coverage gaps; zero findings alone do not establish that a repository is safe.
Sentinel Cloud
Hosted pull-request scans, findings and scan history; GitHub App automation depends on plan and setup.
Sentinel CLI
On-demand local and CI workflows, including code and supply-chain commands documented in the repository.
Sentinel Audit
Orchestrates analyzers against a pinned commit, retaining coverage, raw evidence and human review state.
Sentinel Oracle
A separate merge authorization service with its own deployment and trust requirements.
No product guarantees complete detection. Review each repository’s documentation for supported languages, enabled checks, required setup and known limits.
Research and product evidence
Sentinel publishes product behavior and scan evidence in its repositories. Benchmark numbers are intentionally omitted here unless a reproducible methodology, dataset version, command, and raw results are published alongside them.
Sentinel CLI is a local-first command line product with code and supply-chain workflows. You choose when to invoke it; it can also be wired into CI or an AI-agent workflow. Review its documentation for command-specific network and API requirements.
CLI is distinct from the hosted Sentinel Cloud service. Some commands run locally, and Cloud-backed features can use an API key. Available scanners and evidence depend on the selected command and configuration.
Use the repository quick start to choose a scan, understand its data flow, and interpret its exit code before adding it to a required CI gate.
Sentinel is not an AI wrapper. It is a deterministic forensic engine — SAST, supply chain security, MCP server, dependency scanning, and PR auditing. Every finding is reproducible, auditable, and yours.
If you use AI coding agents, these skill files bridge the gap: they teach the agent to invoke Sentinel CLI operations directly — sentinel installfor package gating, sentinel scan for SAST analysis,sentinel precommit install for hook setup. The agent does not reason about security — it executes Sentinel commands and reports the output verbatim. Deterministic results are preserved; model hallucination is eliminated from the security path.
Each skill file encodes a three-tier enforcement protocol. The FORBIDDEN tier lists actions the agent must never take — suggesting npm installas an alternative to sentinel install, offering workarounds when Sentinel blocks a package, or committing without the pre-commit hook installed. The MANDATORY tier lists actions the agent must always take — run SAST before first commit, gate all dependency installations through sentinel install, report block verdicts with raw evidence. The Evidence Hierarchy tier assigns authority: Sentinel tool output (Tier 1) overrides local state (Tier 2), which overrides GitHub metadata (Tier 3), which overrides model reasoning (Tier 4). The model narrates findings; it never overrides them.
Adapting Sentinel output for AI consumption is not a goal of these skills. They exist because AI agents, left unguided, routinely bypass security tooling: they suggest direct npm install when Sentinel blocks a package, they commit secrets because no pre-commit hook was installed, they evaluate supply chain risk using model knowledge rather than real-time AST analysis. The skills close that gap without introducing a new attack surface — the agent holds no special credentials, executes no privileged code, and maintains no persistent state. It simply reads Sentinel output and formats it into the conversation.
One command writes the correct adapter to the correct path for the detected platform. Also includes a full MCP server implementation for tool-calling AI agents. No manual configuration. The skill loads automatically on the next agent session. All eight adapters maintained in a single source tree.
Sentinel Oracle
Merge Authority Physical Isolation.
Sentinel Oracle provides a separate merge-authorization service. Its security depends on the deployment, credential isolation, network policy and repository configuration being followed as documented; it is not a guarantee that a compromised environment cannot merge.
Oracle also includes optional AI integrations and agent-facing interfaces. Those are distinct from deterministic scanner output and require the provider configuration described in its documentation.
Review the Oracle repository for its current supported deployment modes, network requirements, and merge authorization setup.
Shows the pending pull request and its QR challenge. It does not hold merge credentials.
STEP 02
Phone
Approve identity
Scans the challenge and signs the approval with a WebAuthn passkey.
STEP 03
Oracle
Authorize the merge
Verifies the challenge and passkey, then calls GitHub with its configured credentials.
STEP 04
GitHub
Apply the merge
Receives the merge request from Oracle after approval checks succeed.
Approval flow: QR challenge → phone passkey → Oracle verification → GitHub merge API. The workstation and phone do not receive Oracle’s GitHub credentials.
Sentinel Audit · terminal-first
An audit workflow that shows its work.
Sentinel Audit orchestrates the Cloud worker engine and selected specialist tools over a pinned repository commit. It records which tools ran, their coverage and raw evidence, correlates signals, and pauses for human adjudication. It does not declare a vulnerability confirmed by itself.
Sentinel Cloud supports repeat use: manual pull-request scans are available on eligible plans, and GitHub App automation is available on plans that include it once installed and configured. The CLI runs locally or in CI when invoked; teams can schedule it through their own workflow. These products have different capabilities and limits.
CLIRun local and CI scans on demand; integrate with scripts and agent workflows
CLOUDReview hosted PR scans, findings and scan history in a shared web workspace
AUDITCoordinate analyzers on a pinned commit and retain coverage and raw evidence
ORACLEApply an isolated authorization flow to repository merges
Automated PR Pipeline
01
PR Opened
GitHub webhook fires → Sentinel receives event
02
File Fetch
PR diff files fetched via GitHub API
03
AST + SAST
JS/TS → Acorn AST taint analysis. All files → LiteScanner
04
Correlation
Kill Chain Builder groups findings into attack chains
AI coding tools write and review code. Sentinel secures the supply chain it travels through. They are complementary — not competitors. Here is why you need both.
Why install Sentinel if I already use AI coding assistants?+
Coding assistants and Sentinel solve different problems. Sentinel provides command-line scans, hosted pull-request analysis, evidence orchestration, and merge authorization across separate products. A coding assistant can help interpret results, while the scanner output and its coverage should remain reviewable on their own.
What specific tasks does Sentinel handle that AI tools cannot?+
The exact tasks depend on the product and enabled checks. Sentinel CLI documents local code and dependency commands; Cloud hosts configured PR scans; Audit records tool health, evidence and coverage; Oracle handles a separate merge-authorization workflow. Review each product’s supported scope and limitations before relying on it as a gate.
Does Sentinel make my AI coding assistant redundant?+
No. An assistant can help with authoring and review, while Sentinel provides tools that can be run by people, CI systems and supported agents. Choose the workflow and checks that match your repository and threat model.
Which tasks take less time with Sentinel than with AI tools?+
Runtime varies with repository size, network access, selected analyzers and plan limits. Use the product’s own timing and coverage evidence for your workflow rather than assuming a fixed scan time.
Which tasks produce fewer errors with Sentinel?+
Sentinel scanner output is intended to be tied to concrete evidence, but static analysis can produce false positives and false negatives. Audit exposes coverage and tool health so reviewers can distinguish completed checks from missing evidence. No scan result is a guarantee of safety.
Is Sentinel harder to set up than an AI coding tool?+
The CLI is terminal-first and includes a quick start. Some local commands work without a Cloud account; cloud-backed workflows require the configuration described in their documentation. Audit also provides an interactive terminal menu for guided preflight and scan selection.
The CLI is free. Cloud plans scale from individual repository coverage to enterprise governance.
Colaboración con aprobación
¿Te han invitado a colaborar?
Pega la URL de Sentinel Cloud para solicitar acceso. El propietario debe aprobarla.
Three plans. Separate operating needs.
Cloud security that scales
Start with active-repository visibility, add PR automation when the team needs it, and reserve governance controls for organizations with audit and policy requirements.
ACTIVE REPOSITORIES
PRO
Manual PR analysis with 50 hosted scan runs per month, up to 3 tracked repositories, and 30 days of scan metadata retention. Local/offline scans remain separate. Group collaboration is available within its current configured limits.
Individual / small team
$39.99/MONTH
Tracked repositories
Up to 3
Metadata retention
30 days
API requests / month
No allowance
Hosted scans / month
50
Groups / members / shared repos*
1 / 1 / 1
API requests and hosted scan runs use separate allowances. *Collaboration limits are initial configuration values subject to commercial review.
RECOMMENDED FOR TEAMS
PRO QUANTUM
GitHub App pull request scanning, 250 hosted scan runs and 5,000 API requests per month, up to 10 tracked repositories, and 90 days of scan metadata retention. Group collaboration and member-attributed integrations are available within current configured limits.
Automated PR coverage
$79.99/MONTH
Tracked repositories
Up to 10
Metadata retention
90 days
API requests / month
5,000
Hosted scans / month
250
Groups / members / shared repos*
10 / 10 / 10
API requests and hosted scan runs use separate allowances. *Collaboration limits are initial configuration values subject to commercial review.
RECOMMENDED FOR TEAMS
ENTERPRISE
2,500 hosted scan runs and 100,000 API requests per month, higher repository capacity, certified report signing, and 365 days of scan metadata retention. SSO/SAML, SCIM, custom detection rules, and contracted support are not currently available.
Audit & governance
$789.99/MONTH
Tracked repositories
Up to 9,999
Metadata retention
365 days
API requests / month
100,000
Hosted scans / month
2,500
Groups / members / shared repos*
100 / 100 / 100
API requests and hosted scan runs use separate allowances. *Collaboration limits are initial configuration values subject to commercial review.
Compare all plans
Compare Sentinel Cloud plans
Capability
PRO
PRO QUANTUM
ENTERPRISE
Manual PR and baseline scans
Included
Included
Included
GitHub App PR auto-scan
Not included
Included
Included
Tracked repositories
Up to 3
Up to 10
Up to 9,999
Hosted PR scan runs / month
50
250
2,500
Cloud API requests / month
No API allowance
5,000
100,000
Scan metadata retention
30 days
90 days
365 days
Configured groups / members / shared repos
1 / 1 / 1
10 / 10 / 10
100 / 100 / 100
Analysis profile
STANDARD
AGGRESSIVE
ORACLE
Baseline file limit
250
500
1,000
Certified HMAC report signing
Not included
Not included
Included
Cloud scan runs and API requests are separate allowances. CLI, Audit and Oracle are separate products and are not gated by these Cloud plan limits. Collaboration values are configured caps, not a contractual service commitment.
Compare Sentinel Cloud plans
Capability
PRO
PRO QUANTUM
ENTERPRISE
Manual PR and baseline scans
Included
Included
Included
GitHub App PR auto-scan
Not included
Included
Included
Tracked repositories
Up to 3
Up to 10
Up to 9,999
Hosted PR scan runs / month
50
250
2,500
Cloud API requests / month
No API allowance
5,000
100,000
Scan metadata retention
30 days
90 days
365 days
Configured groups / members / shared repos
1 / 1 / 1
10 / 10 / 10
100 / 100 / 100
Analysis profile
STANDARD
AGGRESSIVE
ORACLE
Baseline file limit
250
500
1,000
Certified HMAC report signing
Not included
Not included
Included
Cloud scan runs and API requests are separate allowances. CLI, Audit and Oracle are separate products and are not gated by these Cloud plan limits. Collaboration values are configured caps, not a contractual service commitment.
A note to the community
We welcome community improvements, research and adaptations for individual or organizational workflows, within each repository’s license. The linked Cloud, CLI, Audit and Oracle repositories currently use BUSL terms with different Additional Use Grants; Sentinel Audit’s grant restricts using it in a security tool or service, and Oracle’s grant restricts selling or monetizing it. Read the exact license and change date before adapting or redistributing any version. Please credit the project and do not present a fork as an official Sentinel product.
Cloud features require a GitHub account. “Quantum” is a plan name; it does not claim quantum-computing detection. Listed prices are application configuration and have not been verified against live PayPal plan details. SSO/SAML, SCIM, managed groups, custom detection rules, contractual SLAs, and dedicated support are not currently available.
