Sentinel

Built by the Nano Collective — a community collective building AI tooling not for profit, but for the community.

Sentinel is an installable, Nanocoder-driven workflow that runs continuous, configurable security and code audits across the repositories in a GitHub organisation, and files what it finds as issues for a human to act on.

You install Sentinel into your own organisation, point it at the repositories you care about, write the rule packs that describe what to look for, and a scheduled GitHub Actions workflow does the audit pass. Findings land as issues on the affected repository, written up for a reviewer. Local models are a first-class path, so the audited code never has to leave hardware you own.

Sentinel is in active development toward its v1. This repository and its documentation describe the v1 design settled in the Sentinel whitepaper. Features are being built; where something is planned rather than shipped, the docs say so.

Quick Start

From inside a fresh repository in your GitHub organisation:

npx @nanocollective/sentinel init
# or
pnpm dlx @nanocollective/sentinel init

init scaffolds the configuration (sentinel.yaml), the scheduled GitHub Actions workflow, an empty rule-packs/ directory, and a starter pack template. Answer the prompts (model provider, schedule, first repositories), review the generated files, write your first rule pack, commit, and push. The first scheduled run lands later that day, or you can dispatch the workflow manually.

Sentinel ships no rule packs of its own. The value comes from the packs you write for the code you actually ship — see Writing a Rule Pack.

You can also run an audit locally, off-cycle, for calibrating a pack:

npx @nanocollective/sentinel run \
  --rule-pack ./rule-packs/solana-anchor.md \
  --repo ../my-program \
  --output findings.md

Documentation

Full documentation is available online at docs.nanocollective.org or in the docs/ folder:

• Getting Started — Install Sentinel into your organisation and get the first run green
• Rule Packs — The pack format, the authoring guide, and worked examples
• Configuration — The sentinel.yaml reference
• Workflow — The scheduled audit, run modes, and the execution model
• Findings & Issues — The severity model, issue filing, dedup, and suppression
• CLI — init, run, and estimate command reference
• Community — Contributing, Discord, and how to help

What Sentinel is not (in v1)

Sentinel is a triage layer, not a replacement for a real audit. It is not a substitute for a formal security audit, not a SAST replacement (run Semgrep/CodeQL alongside it), not a secret scanner, not a hosted service, not a rule pack catalogue, and not a fix-it tool — it files issues, it does not open PRs. See the whitepaper for the full scope.

Community

The Nano Collective is a community collective building AI tooling for the community, not for profit. We'd love your help.

• Contribute: See CONTRIBUTING.md for development setup and guidelines.
• The collective: nanocollective.org · docs · GitHub · Discord
• Support the work: The Support page covers donations and sponsorship.
• Paid contribution: The Economics Charter sets out how scoped paid bounties work.