Loading
Paste a repository. Nine specialised agents read it alongside deterministic security tooling, argue with each other about what they find, and return a report where every claim names a file, a line and a confidence.
Public repositories analyse instantly. Private repositories need GitHub sign-in, and their source is never made public.
Static analysis finds what is provably there. Models are good at judging whether it matters. Sentinel runs them in that order, and the report shows which did what.
The archive is read in memory — never written to disk, never executed. Files, languages, the module graph and every dependency manifest are indexed before an agent runs.
Eight agents work the same index in parallel. Each runs deterministic detectors first, then asks the model to reason about what those detectors actually found.
Each agent owns a category, exposes the same contract, and can be replaced or extended without touching the others. Two of them never produce findings — they coordinate and they challenge.
Hunts injection, authentication, authorization and secret-handling flaws.
Finds crashes, unhandled states and incorrect error handling.
Maps service boundaries, coupling and circular dependencies.
Measures coverage of the paths that actually matter.
Correlates manifests with advisories, licences and maintenance signals.
Anything can produce a list of warnings. The hard part is being right often enough that people keep reading.
Every finding names a file, a line and the check that produced it. If Sentinel cannot show you the evidence, it does not report the finding.
Each finding carries a validation status and a number. The report shows what raised it and what lowered it, including the case against.
Secret scanning, dependency advisories, the module graph and structural metrics are ordinary static analysis. The model interprets; it does not replace them.
Repository contents are never written to disk and never executed. Archives are read in memory with traversal, symlink and size-bomb guards.
Forty-seven findings usually come from six decisions. The plan targets the decisions and shows the score you get back.
No API key, no database, no queue — Sentinel still runs a real analysis and tells you exactly which capabilities are switched off.
Reports download as JSON or SARIF 2.1.0, which is what GitHub code scanning ingests — so a Sentinel run can become an annotation on a pull request rather than another dashboard nobody opens.
Findings that describe the same issue are merged. Where the evidence conflicts, the agents argue it out and the exchange is recorded in the report.
The validator looks for reasons each finding is wrong: is the file reachable, is there a mitigating control, is it test-only code. Confidence moves accordingly.
Findings are grouped by root cause and ordered by score gained per hour of work, with a patch where one can be generated safely.
Looks for N+1 queries, blocking work and accidental O(n²).
Flags patterns common in fast AI-assisted development.
Tracks complexity, duplication and dead code.
Plans the audit, assigns work and resolves conflicts between agents.
Challenges every claim and refuses to pass unproven findings.
.env
package.json
.env:1
We found 64 findings. They originate from 22 root causes. Working the plan end to end projects a score of 100, up from 55.