AI-Powered Security Hardening for Developers & CI/CD
Stop security vulnerabilities before they reach production. Sentinel scans SAST, SCA, and DAST across Python, JS/TS, and HTML, explains real exploit paths with built-in Mistral AI, and applies safe auto-fixes with 1 click.
pip install sentinel-scanner
Dual-Tier AI Architecture
Enjoy built-in AI assistance with automatic rate limiting and exponential backoff retry, or bring your own Mistral key for unrestricted high-speed analysis.
Default Community Tier
Ready instantly with zero setup or registration. Uses Sentinel's embedded Mistral AI engine.
- ✓ Included by default: No API key needed
- ✓ Smart Rate Limiter: 1.0 req/s client pacing
- ✓ HTTP 429 Adaptive Backoff: Exponential retry & Retry-After support
- ✓ SQLite Local Cache: Zero repeated queries
sentinel scan .
Bring Your Own Key (BYOK)
Provide your personal Mistral API key for unthrottled maximum throughput and custom models.
- ✓ Unrestricted Speed: Artificial rate limiting bypassed
- ✓ Custom Models: `mistral-small-latest`, `codestral-latest`, etc.
- ✓ Custom Pacing Option: `--ai-rate-limit
` - ✓ Local Backend: Fully offline with `--ai-backend local` (Ollama)
export MISTRAL_API_KEY=your-key
sentinel scan . --ai-model codestral-latest
Automated GitHub Security Bot
Sentinel runs automatically on every Pull Request and push, posting rich Markdown vulnerability reports and uploading SARIF security alerts.
1-Command Workflow Generator
Initialize the complete GitHub Action bot workflow in any repository with a single command:
sentinel init --github-action
- 📌 Generates
.github/workflows/sentinel.yml - 📌 Posts / updates PR comments automatically
- 📌 Writes directly to GitHub Actions Job Summary
- 📌 Uploads SARIF annotations to GitHub Code Scanning
See Sentinel In Action
Watch Sentinel conduct multi-engine scans, evaluate attack scenarios with AI, and apply auto-fixes live in the terminal.
Vulnerability Remediation Playground
Select a vulnerability to see how Sentinel identifies structural patterns and generates secure remediations offline or with AI.
SQL Injection (CWE-89)
OWASP Top 10Concatenating untrusted user inputs directly into SQL query strings.
Protocol: Parameterized Queries. Replace string concatenation or formatting inside SQL executions with placeholders and pass query parameters as a tuple. Example: Change cursor.execute(f'SELECT * FROM users WHERE username = "{user}"') to cursor.execute('SELECT * FROM users WHERE username = ?', (user,)).
# Unsafe SQL Construction
def get_user(user_id):
query = f"SELECT * FROM users WHERE id = {user_id}"
return db.execute(query)# Click 'Apply Auto-Fix' to see secure codeBuilt-in Security Capabilities
Sentinel brings together multiple scanner paradigms into a unified, developer-friendly hardening engine.
Static Application Security (SAST)
Parses Abstract Syntax Trees (AST) in Python, JavaScript, TypeScript, and HTML templates to detect SQLi, XSS, command execution, hardcoded credentials, and weak hashing.
Software Composition (SCA)
Scans requirements.txt, pyproject.toml, package.json, and go.mod against OSV.dev and NVD databases with local SQLite caching.
Dynamic Web App Scan (DAST)
Actively crawls live web endpoints, injecting parameter fuzzers to detect reflected XSS, SQL error leakage, and missing security headers (CSP, HSTS, X-Frame-Options).
Dual-Tier AI Hardening & Auto-Fix
Evaluates finding severity with Mistral Cloud or local Ollama. Includes built-in API rate limiting, 429 exponential backoff, and direct 1-click AST code rewrite capabilities.
Multi-Format Reporting
Export scan results in **Markdown** (for GitHub PR comments), **SARIF v2.1.0** (for GitHub Security tab), **JSON**, or interactive **HTML** dashboards.
CI/CD & Pre-Commit Ready
Automate pipeline governance with `--ci`, severity threshold gates (`--fail-on critical,high`), and pre-commit hooks.
CLI Commands & Usage
Common commands to scan, auto-fix, export reports, and initialize CI/CD workflows.
| Goal | Command | Description |
|---|---|---|
| Standard Scan | sentinel scan . |
Scans project with built-in rate-limited AI assistance |
| Unrestricted AI | sentinel scan . --ai-api-key <key> |
Runs with your personal Mistral key at full unrestricted speed |
| Custom AI Model | sentinel scan . --ai-model codestral-latest |
Uses designated cloud model (e.g. Codestral or Mistral-Small) |
| Custom Rate Limit | sentinel scan . --ai-rate-limit 2.0 |
Controls requests-per-second limit to match your quota |
| Generate PR Bot | sentinel init --github-action |
Creates .github/workflows/sentinel.yml ready for PR comments |
| Export Markdown | sentinel scan . --output-format markdown |
Exports GitHub-flavored Markdown report for CI step summary |
| DAST Live Audit | sentinel scan --dast https://myapp.dev |
Crawls and audits a live web application |
| Interactive Fixes | sentinel scan . --fix |
Prompts interactively to apply safe auto-fixes for each flaw |
Secure Your Repository in Seconds
Install Sentinel via PyPI or Docker and harden your applications today.
🔍 Sentinel Security Scan Report
High🔎 Detailed Findings & AI Remediation Recommendations
app/auth.py:42Direct user input concatenated into raw SQL statement.