Sentinel CLI 4.3.1

Adds terminal security hardening profiles and guided PR scan progress. Sentinel Cloud Pulses now submit the full pull request pinned to its head SHA; local Lite remains available without a Cloud subscription.

Sentinel CLI v4.3.0

Added

• Added sntnl hardening for local, informational review of package-manager configuration, lockfiles, and startup/lifecycle scripts.
• Added agile, strict, and CI preference profiles with independently configurable toggles.
• Added the sentinel-hardening skill for AI agents and documented scope, privacy behavior, and limitations.
• Added pnpm lockfile detection to �udit-deps.

Fixed

• Updated the Sentinel PR audit action to build the CLI from the checked-out source.
• Updated the reported CLI version to 4.3.0.

The hardening audit does not execute project code, install packages, or upload source. Package-age quarantine and provenance verification remain preferences only in this release.

Sentinel CLI v4.2.0

Adds the sentinel-cicd-guard and sentinel-disclosure-dossier agent skills, clarifies that CLI scans run when invoked and may be scheduled through user-configured CI, and aligns package metadata with the sntnl-cli package. The previous untagged skills commit is included.

v4.1.0 — Group Credentials & Remote Scan

Changes

• Add group credentials and idempotency key support for remote scanning
• Add build identity SHA calculation optimization
• Update plan status gating and pulse usage rendering
• License: BUSL-1.1

v4.0.0 — Sentinel CLI

Sentinel CLI v4.0.0

Deterministic, local-first security intelligence platform. SAST, supply chain, network auditor, build intelligence, and MCP server for AI coding agents.

What's New in v4.0.0

Build Intelligence (v2)

Complete forensic build observation: process trees, file artifacts, SHA-256 integrity chains, trust scoring, and explainability. New commands for release baselines, trust calibration, and continuous learning.

Network Auditor (Behavior-based)

31 behavior classifiers mapped to MITRE ATT&CK. Monitors process execution, Git activity, network connections, and DNS queries to detect repository exfiltration patterns. SHA-256 evidence chaining and timeline reconstruction.

MCP Server (17 Tools)

Model Context Protocol server exposing Sentinel capabilities as standard MCP tool calls for AI coding agents (Claude, Cursor, Cline, Windsurf, OpenCode, Roo, Gemini, Codex).

Supply Chain Shield

Multi-layer package auditing: CVE lookup (OSV.dev), typosquat detection (Damerau-Levenshtein + homoglyph), provenance verification (SLSA), registry reputation, and malicious pattern detection.

Token Intelligence

Classifies and risk-assesses any token string — GitHub PATs, AWS keys, Stripe secrets, Slack tokens. Produces risk scores, scope analysis, and actionable recommendations.

Export System

Export findings in JSON, Markdown, PDF, SARIF, and policy formats for CI integration and compliance.

Data Protection

AES-256-CBC encryption for .env files, classified data detection, pre-commit hooks.

Security Guard

OS-level package manager interception (npm/yarn/pip), pre-commit and pre-push hooks, security-gated installation.

Red Team & Validation

26 attack scenarios, 10 campaigns, 30+ Atomic Red Team tests mapped to MITRE ATT&CK. Replay datasets, regression suites, and stress testing.

Interactive Hub

Bilingual (EN/ES) operations menu with 12 modules: PR Bot, workspace audits, system doctor, integrity check, permissions audit, scan, guard, classified docs, signal vault, security policy, network auditor.

Architecture

Sentinel CLI
├── SAST Engine (30 deterministic rules)
├── Supply Chain Shield (5-layer audit)
├── Network Auditor (31 behavior classifiers)
├── Build Flight Recorder (forensic observation)
├── GitHub Integration (PR audit, workflow)
├── System Integrity (chain-of-trust verification)
├── Security Guard (OS-level interception)
├── Threat Intelligence Memory (local vault)
├── MCP Server (17 tools for AI agents)
└── Skills System (8 AI agent platforms)

Quick Start

npm install -g @sentinel/cli

# Scan a project
sentinel-cli scan ./src

# Audit dependencies
sentinel-cli audit-deps

# Start network monitoring
sentinel-cli network start

# Observe a build
sentinel-cli build observe "npm run build"

# Install skills for AI agents
sentinel-cli install-skills

Stats

• 90+ CLI commands across 12 categories
• 1,040 automated tests (Node 20 + 22)
• 30 SAST rules covering secrets, eval, network, crypto, obfuscation
• 31 behavior classifiers mapped to MITRE ATT&CK
• 17 MCP tools for AI agent integration
• 8 AI agent platforms supported (Claude, Cursor, Cline, Windsurf, OpenCode, Roo, Gemini, Codex)

Tags

security sast supply-chain cli audit devsecops mcp ai-agents webauthn ci-cd red-team mitre-attack

v1.3.0 — Hash Chain, MITRE ATT&CK, Risk Context

v1.3.0 — Evidencia encadenada, contexto de riesgo y marco MITRE

Evidence Hash Chain

• SHA-256 encadenado por cada Evidence en la sesión
• verifyEvidenceChain() para detectar manipulación
• Incluido en Verdict y exportación

MITRE ATT&CK Mapping

• 32 comportamientos mapeados a técnicas MITRE (T1213, T1041, T1562, T1590, etc.)
• Cobertura por táctica en reportes

Behavior Timeline

• Organización automatica: Preparation → Collection → Packaging → Exfiltration
• Cada behavior asignado a su etapa según propósito

Risk Context Mejorado

• Multiplicadores de secuencia progresivos (preparation 1.3x → exfil 2.0x)
• Multiplicador temporal según intervalo entre behaviors
• computeRiskConfidence() con bonuses por cantidad y diversidad

Cifras

• 705 tests (35 suites) — 0 TS errors
• 3 nuevas fuentes, 1 archivo de test nuevo
• Docs actualizadas: risk-engine.md, NETWORK_AUDITOR.md (3 secciones nuevas)

v1.2.0 — Behavior-based Network Monitor

Behavior-based Network & Process Monitoring

v1.0 — Corpus Fundacional

• Pipeline de detección de exfiltración con 6 perfiles CRITICAL
• 31 perfiles canónicos, 15 sesiones grabadas
• Anti-evasión (8 señales), evidence chains (4 tipos), canarios
• Sistema de riesgo con 4 niveles (LOW/MEDIUM/HIGH/CRITICAL)
• Replay engine para validación de corpus
• Cobertura 83.9% efectiva 100%

v1.1 — Documentación y Limpieza

• 10 documentos técnicos en docs/
• README con Behavior-based Network & Process Monitoring
• Limpieza de scripts obsoletos

v1.2 — Usabilidad y Defensa (este release)

• Menú interactivo: nuevo submenú Network Auditor con 10 opciones (Start/Stop/Status/Live Events/History/Replay/Export/Settings/Auto-start/Back)
• Config persistente: ~/.sentinel/network-config.json\ (autoStart, alertThreshold, trustedHosts/Processes, performanceBudget)
• Auto-start: registro de Windows Scheduled Task y systemd user service
• Kill detection: \monitor_disabled\ — detecta taskkill/Stop-Process/wmic contra sentinel por nombre o PID real
• CI: GitHub Actions (Node 20/22, npm ci, build, test, 684 tests)
• 14 tests nuevos para configuración y kill detection