Sentinel AI

Multi-agent Security Engineering Platform powered by AI

Sentinel AI is a distributed, event-driven framework for automated security auditing. It orchestrates specialized AI agents to perform reconnaissance, infrastructure scanning, web security analysis, code auditing, CVE correlation, threat modeling, and professional report generation.

Features

• 8 specialized AI agents — Orchestrator, Recon, Infrastructure, Web Security, Code Audit, CVE Intelligence, Threat Modeling, Report
• Event-driven architecture — pub/sub event bus for inter-agent communication
• Multi-provider AI — works with OpenAI, Anthropic, Google, DeepSeek, and any OpenAI-compatible provider
• Memory tiers — working, session, long-term, and semantic memory
• Correlation engine — cross-agent attack chain detection
• Risk analysis — CVSS + EPSS + exploitability scoring
• Plugin system — extensible with Nmap, Nuclei, Semgrep, Trivy, Gitleaks, ZAP
• Professional reports — Markdown with executive summary, risk matrix, evidence mapping, remediation plan
• CLI + TUI — interactive dashboard, scan commands, event watcher

Installation

npm install @phosphor-dom/sentinel-ai

bun add @phosphor-dom/sentinel-ai

CLI Usage

# Show help
sentinel help

# Run a security audit
sentinel scan example.com
sentinel scan example.com --verbose
sentinel scan example.com --agents recon,web-security

# Interactive TUI dashboard
sentinel dashboard

# List available agents
sentinel agents

# Watch live events
sentinel events

# Generate report from last scan
sentinel report
sentinel report --output report.md

Library Usage

import { SentinelOrchestrator } from "@phosphor-dom/sentinel-ai"
import { EventBus } from "@phosphor-dom/sentinel-ai/core/event-bus"
import { MemoryManager } from "@phosphor-dom/sentinel-ai/core/memory-manager"

const orchestrator = new SentinelOrchestrator()
const bus = new EventBus()
const memory = new MemoryManager()

// Subscribe to events
bus.subscribe("VulnerabilityDetected", (event) => {
  console.log("Vulnerability found:", event.payload)
})

// Run an audit
await orchestrator.runAudit({
  target: "example.com",
  targetType: "domain",
  description: "Security audit of example.com",
})

Architecture

Orchestrator
├── Recon Agent          (DNS, WHOIS, subdomains, fingerprinting)
├── Infrastructure Agent (ports, TLS, certificates, misconfigs)
├── Web Security Agent   (OWASP Top 10, HTTP headers, JWT, APIs)
├── Code Audit Agent     (SAST, secrets, dependencies, IaC)
├── CVE Intelligence     (CVE/CWE/CVSS/EPSS correlation)
├── Threat Modeling      (STRIDE, attack trees, risk analysis)
└── Report Agent         (MD/DOCX/PDF professional reports)

Event System

Every agent communicates through the Event Bus:

bus.publish({
  id: crypto.randomUUID(),
  timestamp: new Date().toISOString(),
  type: "ReconCompleted",
  source: "recon-agent",
  target: "orchestrator",
  priority: "normal",
  payload: { /* findings */ },
})

Provider Abstraction

Sentinel AI supports any AI provider. Route by capability:

const provider = new ProviderAbstraction()
provider.register({
  name: "anthropic",
  models: ["claude-sonnet-4"],
  roles: { precision: "claude-sonnet-4", writing: "claude-sonnet-4" },
  priority: 1,
})

const response = await provider.complete("precision", {
  messages: [{ role: "user", content: "Analyze this code for vulnerabilities..." }],
})

Plugin System

const plugins = new PluginManager()
plugins.register({
  name: "nmap",
  version: "1.0",
  capabilities: ["port-scan", "service-detection"],
  inputs: ["target_ip", "ports"],
  outputs: ["open_ports", "services"],
  permissions: { network: ["target_ip"] },
})

const result = await plugins.execute("nmap", { target_ip: "10.0.0.1" })

Design Documents

Architecture and design docs available in docs/:

| Document | Content | |----------|---------| | ARCHITECTURE.md | System overview, agent hierarchy, execution flow (Mermaid) | | AGENT_FLOW.md | Communication protocol, state machine, capability matrix | | EVENT_SYSTEM.md | Event structure, categories, priority queues | | SKILL_SYSTEM.md | Skill structure, registry, all 24 integrated skills | | MCP_INTEGRATION.md | MCP layer, tool definitions, server config, execution flow |

Integrated Skills (24)

import { SkillRegistry } from "@phosphor-dom/sentinel-ai/skills"
const registry = new SkillRegistry()
registry.list().forEach((s) => console.log(s.name, s.capabilities))
const dns = registry.findByCapability("dns")
const manifest = registry.generateManifest()

| Category | Skills | Count | |----------|--------|-------| | Core | event-bus, provider-abstraction, memory-manager, inter-agent-communication | 4 | | Agents | orchestrator, recon, infrastructure, web-security, code-audit, cve-intelligence, threat-modeling, report | 8 | | Analysis | context-compression, correlation-engine, evidence-manager, risk-analysis | 4 | | Integration | plugin-manager, knowledge-base, vector-db | 3 | | Operations | model-router, failover-manager, token-optimizer, distributed-agents, observability | 5 |

MCP Integration

import { MCPServer, createMCPServer } from "@phosphor-dom/sentinel-ai/mcp"

const server = createMCPServer()
const result = await server.call({ tool: "dns_lookup", args: { domain: "example.com" } })

Built-in MCP tools: dns_lookup, whois_query, subdomain_discover, port_scan, tls_analyze, http_scan, jwt_decode, sast_scan, secret_scan, cve_lookup, epss_query.

License

MIT