🛡️ CodeSentinel AI

Autonomous Security Agent for DevSecOps

Every day, 30,000+ developers push vulnerable code to production without knowing it. CodeSentinel watches your GitLab 24/7 — like a senior security engineer who never sleeps. The moment you push code, it analyzes, scores risk, and comments on your MR — in 30 seconds. What used to take 3 hours of manual review now takes 30 seconds. Zero human intervention.

The Problem

• Developers push code with security vulnerabilities daily
• Manual security reviews are slow (hours/days) and inconsistent
• Vulnerabilities reach production before anyone notices
• Security teams are overwhelmed and can't review every commit

The Solution

CodeSentinel AI is an autonomous security agent that:

1. Watches your GitLab repos via webhooks
2. Analyzes every code push using Claude AI
3. Reports vulnerabilities directly on Merge Requests
4. Scores deployment risk (1-10) with GO/NO-GO recommendations
5. Alerts your team on Slack for critical issues
6. Dashboards everything in a real-time web interface

The Impact

• 30 seconds vs 3 hours for security review
• Zero manual intervention after one-time setup
• OWASP Top 10 + GDPR compliance checking built-in
• Prevents vulnerable code from reaching production

Architecture

┌─────────────┐     Webhook (push/MR)     ┌──────────────────┐
│   GitLab    │ ──────────────────────────▶│  CodeSentinel    │
│   Repo      │                            │  Express Server  │
└─────────────┘                            │  (port 3000)     │
                                           └────────┬─────────┘
                                                    │
                              ┌──────────────────────┼──────────────────────┐
                              ▼                      ▼                      ▼
                     ┌────────────────┐   ┌──────────────────┐   ┌─────────────────┐
                     │ Security       │   │ Compliance       │   │ Risk            │
                     │ Scanner        │   │ Checker          │   │ Scorer          │
                     │ (Claude API)   │   │ (Claude API)     │   │ (Claude API)    │
                     └────────┬───────┘   └────────┬─────────┘   └────────┬────────┘
                              │                    │                      │
                              └──────────┬─────────┘──────────────────────┘
                                         ▼
                              ┌──────────────────┐
                              │ Report Generator │
                              └────────┬─────────┘
                                       │
                    ┌──────────────────┬┴───────────────────┐
                    ▼                  ▼                     ▼
           ┌──────────────┐  ┌────────────────┐  ┌──────────────────┐
           │ GitLab MR    │  │ Slack Alert    │  │ Web Dashboard    │
           │ Comment      │  │ (Critical)     │  │ (Real-time)      │
           └──────────────┘  └────────────────┘  └──────────────────┘

Setup (5 Steps)

Step 1: Clone & Install

git clone <repo-url>
cd codesentinel
npm install

Step 2: Configure Environment

cp .env.example .env

Edit .env with your keys:

ANTHROPIC_API_KEY=sk-ant-xxxxxxxxxxxxx    # From console.anthropic.com
GITLAB_TOKEN=glpat-xxxxxxxxxxxxx          # GitLab → Settings → Access Tokens
GITLAB_URL=https://gitlab.com             # Your GitLab instance
WEBHOOK_SECRET=your-secret-here           # Any secret string
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/xxx/xxx/xxx  # Optional
PORT=3000

Step 3: Start the Server

npm start
# or for development:
npm run dev

Step 4: Configure GitLab Webhook

1. Go to your GitLab project → Settings → Webhooks
2. URL: http://your-server:3000/webhook
3. Secret Token: same as WEBHOOK_SECRET in .env
4. Trigger: ✅ Push events, ✅ Merge request events
5. Click Add webhook

Step 5: Push Code & Watch

Push code to your GitLab repo — CodeSentinel will automatically:

• Scan changed files for vulnerabilities
• Post a security report on your MR
• Alert Slack if critical issues are found
• Update the real-time dashboard

API Endpoints

| Endpoint | Method | Description | |----------|--------|-------------| | /webhook | POST | GitLab webhook receiver | | /health | GET | Server health check | | /dashboard | GET | Real-time web dashboard | | /api/results | GET | JSON scan results + stats |

Manual Scan

Scan local files without GitLab:

npm run scan -- ./path/to/code

Environment Variables

| Variable | Required | Description | |----------|----------|-------------| | ANTHROPIC_API_KEY | Yes | Claude API key | | GITLAB_TOKEN | Yes | GitLab personal access token | | GITLAB_URL | Yes | GitLab instance URL | | WEBHOOK_SECRET | Yes | Webhook validation secret | | SLACK_WEBHOOK_URL | No | Slack incoming webhook URL | | PORT | No | Server port (default: 3000) |

Tech Stack

• Runtime: Node.js + Express
• AI Engine: Claude API (Anthropic)
• Integration: GitLab API v4
• Notifications: Slack Webhooks
• Dashboard: Vanilla HTML/CSS/JS (zero dependencies)

License

MIT