{"id":48828427,"url":"https://github.com/fasilmveloor/sentinel","last_synced_at":"2026-04-14T19:02:08.493Z","repository":{"id":341243107,"uuid":"1169059796","full_name":"fasilmveloor/sentinel","owner":"fasilmveloor","description":"AI-powered API security testing tool","archived":false,"fork":false,"pushed_at":"2026-04-09T18:05:39.000Z","size":490,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-09T20:09:10.215Z","etag":null,"topics":["ai-security","api-security","api-security-testing","penetration-testing"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fasilmveloor.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":"docs/ROADMAP.md","authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-02-28T05:46:54.000Z","updated_at":"2026-04-09T18:05:56.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/fasilmveloor/sentinel","commit_stats":null,"previous_names":["fasilmveloor/sentinel"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/fasilmveloor/sentinel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fasilmveloor%2Fsentinel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fasilmveloor%2Fsentinel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fasilmveloor%2Fsentinel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fasilmveloor%2Fsentinel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fasilmveloor","download_url":"https://codeload.github.com/fasilmveloor/sentinel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fasilmveloor%2Fsentinel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31810741,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-14T18:05:02.291Z","status":"ssl_error","status_checked_at":"2026-04-14T18:05:01.765Z","response_time":153,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ai-security","api-security","api-security-testing","penetration-testing"],"created_at":"2026-04-14T19:02:01.170Z","updated_at":"2026-04-14T19:02:08.485Z","avatar_url":"https://github.com/fasilmveloor.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Sentinel\n\nSentinel is an autonomous API security tester for OpenAPI-described services. It combines an AI-assisted planning layer with a bounded execution loop, shared scan context, and deterministic attack modules.\n\nCore idea:\n\n```text\ntask -\u003e execute -\u003e learn -\u003e follow-up\n```\n\nSentinel does not put AI inside the execution layer. Attack modules stay deterministic. The autonomous behavior comes from the loop around them.\n\n## Overview\n\nSentinel v3 scans APIs as a bounded autonomous system:\n\n- seed tasks from API structure\n- execute deterministic attacks\n- learn from responses through shared context\n- enqueue follow-up work when new artifacts appear\n\nExample chain:\n\n```text\nSQLi -\u003e extract ID -\u003e enqueue IDOR -\u003e probe object access\n```\n\nThis keeps execution predictable while still allowing multi-step exploration.\n\n## Key Features\n\n- Autonomous loop with explicit limits on iterations and executed tasks\n- Context-driven chaining using `ScanContext`\n- Deterministic attack modules with no AI inside execution\n- Deduplicated task scheduling through `TaskQueue`\n- AI-assisted planning and prioritization outside the execution layer\n- Multiple report formats and CLI workflows\n\n## How It Works\n\nHigh-level flow:\n\n```text\nOpenAPI -\u003e Parser -\u003e TaskQueue -\u003e SentinelOrchestrator -\u003e Attack Modules -\u003e ScanContext -\u003e follow-up tasks -\u003e Reporter\n```\n\nMain runtime pieces:\n\n- `TaskQueue`: deduplicated FIFO queue of scan tasks\n- `ScanContext`: shared state for discovered IDs, tokens, findings, and executed task signatures\n- `SentinelOrchestrator`: bounded loop that executes tasks, updates context, and applies simple chaining rules\n\nCurrent Tier 1 chaining is intentionally simple:\n\n- if the scan discovers IDs, Sentinel can enqueue IDOR follow-up tasks for matching endpoints\n\n## Usage\n\nInstall dependencies:\n\n```bash\npyenv activate env\npip install -r requirements.txt\n```\n\nIf you use the project pyenv environment, activate it before running Sentinel or pytest:\n\n```bash\npyenv activate env\n```\n\nRun a standard scan:\n\n```bash\npython -m sentinel scan \\\n  --swagger api-spec.yaml \\\n  --target https://api.example.com\n```\n\nRun autonomous mode:\n\n```bash\npython -m sentinel autonomous \\\n  --swagger api-spec.yaml \\\n  --target https://api.example.com\n```\n\nAutonomous mode still uses deterministic attack modules. The difference is that Sentinel can learn from intermediate results and schedule follow-up work instead of stopping after a single plan/execute pass.\n\nExample with authentication:\n\n```bash\npython -m sentinel autonomous \\\n  --swagger api-spec.yaml \\\n  --target https://api.example.com \\\n  --auth-token YOUR_TOKEN\n```\n\nCommon options:\n\n- `--swagger`, `-s`: OpenAPI specification path\n- `--target`, `-t`: base URL of the target API\n- `--auth-token`: bearer token for authenticated testing\n- `--llm`: planning provider (`gemini`, `openai`, `claude`, `local`)\n- `--format`, `-f`: report format\n- `--output`, `-o`: report path\n\n## Architecture\n\nSentinel v3 keeps the execution layer simple:\n\n```text\nOpenAPI Spec\n  -\u003e Parser\n  -\u003e seed tasks\n  -\u003e TaskQueue\n  -\u003e SentinelOrchestrator\n      -\u003e execute attack\n      -\u003e update ScanContext\n      -\u003e enqueue follow-up tasks\n  -\u003e Reporter\n```\n\nImportant constraints:\n\n- AI is not used inside attack modules\n- chaining is deterministic\n- the loop is bounded\n- backward-compatible scan mode is preserved\n\n## Project Structure\n\n```text\nsentinel/\n├── sentinel/\n│   ├── agent.py\n│   ├── autonomous.py\n│   ├── orchestrator.py\n│   ├── scan_context.py\n│   ├── tasks.py\n│   ├── parser.py\n│   ├── models.py\n│   ├── main.py\n│   ├── reporter.py\n│   ├── html_reporter.py\n│   ├── json_reporter.py\n│   └── attacks/\n├── docs/\n├── tests/\n│   ├── unit/\n│   ├── integration/\n│   └── e2e/\n└── test_server/\n```\n\n## Testing\n\nRun tests from the project root:\n\n```bash\npyenv activate env\npytest -q\n```\n\nRun specific layers:\n\n```bash\npytest -q tests/unit\npytest -q tests/integration\npytest -q tests/e2e\n```\n\nTesting approach:\n\n- unit tests cover task signatures, queue behavior, scan context extraction, and loop controls\n- integration tests mock attackers and validate loop/chaining behavior without real HTTP\n- e2e tests use the local test server to verify autonomous behavior end to end\n\n## Documentation\n\n- [Architecture](docs/ARCHITECTURE.md)\n- [Autonomous Mode](docs/autonomous_mode.md)\n- [Testing](docs/testing.md)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffasilmveloor%2Fsentinel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffasilmveloor%2Fsentinel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffasilmveloor%2Fsentinel/lists"}