Raunplaymore/sentinel
Sentinel watches what your AI agents actually do — file access, network calls, risky commands — and alerts you when something looks wrong.
What's novel
Sentinel watches what your AI agents actually do — file access, network calls, risky commands — and alerts you when something looks wrong.
Code Analysis
9 files read · 3 roundsA macOS background daemon that monitors AI agent behavior (file access, network connections, shell commands, package installs) and system health (battery, thermal, memory), correlating events across collectors and alerting users via native notifications, ntfy.sh, Slack, or Telegram when suspicious a
Strengths
Genuinely novel cross-collector event correlation (download join with in-place JSONL rewrite), thoughtful security design (trust-downgrade whitelist that prevents laundering of dangerous patterns), and production-grade engineering (LRU caches, background sweepers, fail-soft config validation, ADR-driven architecture). The typosquatting detector with proper shell tokenization and Levenshtein scoring is a real algorithm, not a wrapper.
Weaknesses
core.py at 77KB is a god-file that mixes config resolution, daemon lifecycle, signal handling, and collector orchestration — it would benefit from further decomposition. The agent_log_parser at 58KB similarly bundles too many concerns (log parsing, command extraction, download detection, typosquatting integration) into one module.
Score Breakdown
Signal breakdown
Innovation
Craft
Traction
Scope
Evidence
Commits
34
Contributors
1
Files
67
Active weeks
3
Repository
Language
Python
Stars
1
Forks
0
License
MIT