# Project export: Sentinel This document was generated by HackStack to give an AI agent context about a hackathon project. Sections are labeled with their provenance; content marked as truncated was cut to keep this document small. ## Project metadata - Hackathon: UC Berkeley AI Hackathon 2026 - Tagline: Sentinel is an AI security engineer that scans your app, proves vulnerabilities with real attack simulations, and ships production-ready fixes before hackers find them. - Devpost: https://devpost.com/software/sentinel-poyh3v - GitHub: https://github.com/sudarshan-krishnan/Sentinel_AIHackathon_Berkley_2026 - Demo: https://sentinel-cal-hacks-2026.vercel.app/ - Video: https://www.youtube.com/embed/DniKpEK30rc?enablejsapi=1&hl=en_US&rel=0&start=&version=3&wmode=transparent - Result: winner (Finalist) - Team: 2 GitHub contributor(s) — Sudarshan (6 commits), Ishita Gupta (2 commits) ## Devpost submission (written by the team) ### Inspiration AI coding tools have made it possible for anyone to build and deploy software in hours. Platforms like Cursor, Claude Code, Replit, and Lovable dramatically lower the barrier to shipping products, but they don't answer a critical question: "Is this application actually secure?" We noticed that many founders, indie hackers, and student developers were deploying production applications without understanding common security risks such as exposed API keys, broken authentication, injection vulnerabilities, and insecure dependencies. Traditional security tools are designed for security professionals and often generate overwhelming reports filled with jargon and false positives. We wanted to build a security platform that works for the new generation of AI-powered builders—a system that doesn't just detect vulnerabilities, but actually proves, explains, and fixes them. ### What it does Sentinel is an AI-powered security platform that uses multiple specialized agents to scan applications, validate vulnerabilities, generate fixes, and continuously monitor security posture. Instead of producing long vulnerability reports, Sentinel follows a complete workflow: Detect vulnerabilities using specialized AI security agents. Simulate real-world attacks inside isolated sandboxes. Explain findings in plain English with visual evidence. Fix vulnerabilities by generating production-ready patches. Monitor applications continuously with a Trust Score. Sentinel can identify issues such as: Exposed secrets and API keys Authentication and authorization flaws SQL injection and XSS vulnerabilities Missing rate limits Vulnerable dependencies and supply-chain risks The result is a security experience that is understandable even for non-security experts. ### How we built it Sentinel combines three major components into a unified security pipeline: AI Security Engine We built a multi-agent architecture consisting of: Coordinator Agent Secrets Detection Agent Authentication Agent Injection Testing Agent Rate Limiting Agent Supply Chain Agent Validation Agent These agents work in parallel to investigate applications and verify findings. Exploit Simulation Layer Using Browserbase and isolated cloud sandboxes, Sentinel safely reproduces vulnerabilities against sandboxed copies of applications. Findings are only escalated when an exploit can actually be reproduced, dramatically reducing false positives. Platform Infrastructure Our stack includes: Next.js for the frontend Cloudflare Workers and Durable Objects for orchestration Browserbase for browser automation Upstash Redis for queues and rate limiting PostgreSQL and Prisma for persistence Anthropic and OpenAI models for reasoning and patch generation Sentry and Arize AI for observability Once a vulnerability is verified, Sentinel generates a fix and can automatically create a GitHub pull request containing the patch. ### Challenges we ran into Reducing false positives One of the biggest challenges in application security is alert fatigue. Most scanners report issues that are not actually exploitable. To address this, we built a validation layer that requires every finding to be reproduced in an isolated sandbox before it is considered verified. Safe exploit execution Running attack simulations is inherently risky. We needed a way to test exploits without touching production systems. We solved this by spinning up isolated environments for every scan, ensuring all attack activity remains contained. Multi-agent orchestration Coordinating multiple autonomous security agents introduced challenges around consistency, duplicate findings, and patch conflicts. We introduced dedicated Coordinator and Validator roles to manage communication and maintain deterministic results. Explaining security to non-experts Security reports are often difficult to understand. We spent significant effort translating technical findings into plain-language explanations supported by visual evidence and guided remediation. ### Accomplishments we're proud of Built a fully functional multi-agent security workflow. Created a validation system that proves exploitability before reporting issues. Generated real patches instead of generic remediation suggestions. Integrated live browser-based attack simulation. Produced an experience that makes security accessible to non-security builders. Unified detection, validation, explanation, and remediation into a single platform. ### What we learned Building Sentinel taught us several important lessons: Proof beats detection. A verified exploit is far more valuable than hundreds of theoretical warnings. Specialized agents outperform giant prompts. Giving each agent a focused responsibility improved reliability and reasoning quality. Security is also a UX problem. Users care less about vulnerability names and more about understanding risk and fixing it quickly. Isolation is critical. Safe testing environments are essential for trustworthy automated security validation. ### What's next Our roadmap includes: Launching a production-ready VS Code extension. Expanding continuous monitoring capabilities. Supporting additional vulnerability classes such as SSRF, CSRF, and IDOR. Releasing mobile notifications and voice-based security summaries. Building organization-wide security dashboards and Trust Passports. Our vision is simple: Make application security as accessible as modern AI coding tools. Sentinel helps builders understand what is vulnerable, see how it can be exploited, and fix it before attackers ever get the chance. ## README (from the GitHub repository) # Sentinel **AI agents that scan, simulate, and explain security risks in modern apps — before attackers find them.** --- ## Overview Sentinel is an AI-powered security platform built for the new generation of software: apps created with Cursor, Replit, Claude Code, Bolt, Lovable, freelancers, or plain momentum and vibes. These tools let anyone build and ship software faster than ever — but they don't tell you whether what you shipped is safe. Sentinel closes that gap. Connect a repo or paste a URL, and Sentinel deploys AI security agents to investigate your application, simulates real exploits in a sandboxed environment, explains what it found in plain English, and helps you fix it. Not a report generator. Not a dashboard full of CVE numbers. A system that **scans, proves, explains, and fixes.** --- ## The Problem Modern software development has a trust gap. AI-assisted tools have made it possible for founders, indie hackers, small business owners, and non-traditional developers to build production applications in hours. But security tooling hasn't kept up. The people shipping these apps aren't security engineers. They haven't audited every line of code. Many didn't write the code at all — an LLM did. The result: thousands of apps going live every day with exposed API keys, broken authentication, injection vulnerabilities, and misconfigured infrastructure. The builders don't know these problems exist, and the tools they're using don't warn them. Traditional security scanners are built for security teams at large companies. They output jargon-heavy reports, require expertise to interpret, and stop at detection. They don't explain, don't demonstrate, and don't help you fix anything. Sentinel is built for everyone else. --- ## Why Now Three things happened at the same time: 1. **AI tools democratized building.** Millions of new apps are being created by people who have never touched a security scanner in their life. 2. **AI agents got capable enough to investigate.** LLMs can now reason about codebases, identify vulnerability patterns, and generate meaningful patches — not just flag regex matches. 3. **Sandboxing infrastructure became accessible.** Containerized environments and headless browsers make it possible to safely simulate attacks against live applications at low cost. The window is open for a security product that meets builders where they are: fast, visual, understandable, and actionable. --- ## What Sentinel Does Sentinel combines three capabilities that are usually separate products — or don't exist at all: ### 1. AI-Powered Vulnerability Investigation Sentinel doesn't just run a static rule set. It deploys AI security agents that explore your codebase the way a human pentester would: reading code, tracing data flows, identifying attack surfaces, and classifying vulnerabilities by type and severity. Findings are scored, prioritized, and translated into plain-English explanations that any builder can understand. ### 2. Sandboxed Attack Simulation Instead of telling you "there's an auth bypass on line 43," Sentinel shows you. It spins up an isolated sandbox environment, reproduces the exploit path, and generates a cinematic attack replay — a visual walkthrough of exactly how an attacker would breach your application. This is the moment that turns an abstract warning into a concrete understanding. ### 3. Explainability and Remediation Every finding comes with a plain-English risk explanation ("Someone could access your entire user database without logging in"), an impact assessment, and a suggested patch. The goal isn't just awareness — it's resolution. --- ## How the Three Repos Come Together Sentinel is the unified product formed by merging the strongest ideas, infrastructure, and prototypes from three purpose-built projects: | Project | What It Contributes to Sentinel | |---|---| | **VibeAudit** | The consumer-facing product layer. Web app UX, scan dashboard, trust scoring, plain-English findings, patch suggestions, VS Code extension scaffolding, and the core thesis that security should be accessible to non-experts. | | **Codebreaker** | The AI security intelligence engine. Agent orchestration, vulnerability investigation and localization, multi-model agent runtime, research-grade benchmark methodology (ECVEBench), and the infrastructure to run AI agents against real codebases at scale. | | **Synapse** | The sandbox and simulation layer. Isolated container environments, real-time app interaction, collaborative sandbox architecture, telemetry-aware testing concepts, and the foundation for exercising applications dynamically rather than just scanning them statically. | These weren't three disconnected experiments stapled together. They were three serious prototypes that each solved one piece of the same problem. Sentinel is the architecture where all three pieces fit. ``` ┌─────────────────────────────────────────────────────────┐ │ SENTINEL │ │ │ │ ┌─────────────┐ ┌──────────────┐ ┌───────────────┐ │ │ │ Product & │ │ AI Security │ │ Sandbox & │ │ │ │ UX │ │ Engine │ │ Simulation │ │ │ │ (VibeAudit) │ │ (Codebreaker)│ │ (Synapse) │ │ │ └──────┬──────┘ └──────┬───────┘ └──────┬────────┘ │ │ │ │ │ │ │ └────────────────┼──────────────────┘ │ │ │ │ │ ┌───────────▼────────────┐ │ │ │ Unified Scan Pipeline │ │ │ │ Detect → Simulate → │ │ │ │ Explain → Fix │ │ │ └────────────────────────┘ │ └─────────────────────────────────────────────────────────┘ ``` --- ## Core Features - **URL-based and repo-based scanning** — paste a deployed URL or connect a GitHub repo - **AI agent investigation** — security agents explore and reason about your codebase, not just pattern-match - **Trust scoring** — A–F grade that summarizes your application's security posture at a glance - **Plain-English risk explanations** — "Your checkout page leaks credit card data," not "CWE-79 reflected XSS" - **Sandboxed exploit simulation** — isolated environments where vulnerabilities are safely exercised - **Attack replay walkthroughs** — cinematic demonstrations of how an exploit works, narrated and visual - **Patch recommendations** — suggested code fixes for every finding - **Behavior-aware testing** — dynamic app interaction, not just static file scanning - **Developer workflow integration** — VS Code extension with inline findings and one-click patches (roadmap) --- ## Product Flow ``` Connect repo or paste URL │ ▼ Sentinel launches AI security agents │ ▼ Agents investigate the codebase + scan the live app │ ▼ Sandboxed simulations exercise real exploit paths │ ▼ Findings scored, prioritized, explained in plain English │ ▼ Attack replay generated — see the breach happen safely │ ▼ Patch suggestions produced — fix it before you ship ``` --- ## Example User Journey **Maya runs a small e-commerce business.** She hired a freelancer to build her storefront with Cursor and deployed it on Vercel. It looks great. She has no idea whether it's secure. 1. Maya pastes her store's URL into Sentinel. 2. Sentinel's AI agents investigate the codebase and the live deployment. 3. The system finds a broken authentication check on the admin panel — anyone can access `/admin` by manipulating a cookie value. 4. Sentinel spins up a sandbox, reproduces the exploit, and generates a 30-second replay showing exactly how an attacker walks into her admin dashboard. 5. Maya sees: *"Someone can access your admin panel and view all customer [README truncated for size] ## Detected evidence (automated analysis) Indexed codebase: 270 recognized source files, 1540 KB. - Anthropic (technology) — detected in the code - CSS (language) — detected in the code - HTML (language) — detected in the code - JavaScript (language) — detected in the code - Next.js (technology) — detected in the code - OpenAI (technology) — detected in the code - React (technology) — detected in the code - SQL (language) — detected in the code - Tailwind CSS (technology) — detected in the code - TypeScript (language) — detected in the code - Vue (technology) — detected in the code - Redis (technology) — claimed on Devpost, not found in the code - AI coding agent: Claude Code — evidence: config files committed to the repository - AI coding agent: Codex — evidence: config files committed to the repository ## Codebase structure (from repository index) ### Files (120 of 328) ``` .github/workflows/ci.yml .gitignore .vscode/settings.json AGENTS.md app/.agents/skills/clerk-android/references/custom.md app/.agents/skills/clerk-android/references/prebuilt.md app/.agents/skills/clerk-android/SKILL.md app/.agents/skills/clerk-astro-patterns/evals/evals.json app/.agents/skills/clerk-astro-patterns/references/api-routes.md app/.agents/skills/clerk-astro-patterns/references/astro-react.md app/.agents/skills/clerk-astro-patterns/references/island-components.md app/.agents/skills/clerk-astro-patterns/references/middleware.md app/.agents/skills/clerk-astro-patterns/references/ssr-pages.md app/.agents/skills/clerk-astro-patterns/SKILL.md app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/astro.config.mjs app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/package.json app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/src/layouts/Layout.astro app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/src/middleware.ts app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/src/pages/index.astro app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/tsconfig.json app/.agents/skills/clerk-backend-api/evals/evals.json app/.agents/skills/clerk-backend-api/scripts/api-specs-context.sh app/.agents/skills/clerk-backend-api/scripts/execute-request.sh app/.agents/skills/clerk-backend-api/scripts/extract-endpoint-detail.sh app/.agents/skills/clerk-backend-api/scripts/extract-tag-endpoints.sh app/.agents/skills/clerk-backend-api/scripts/extract-tags.js app/.agents/skills/clerk-backend-api/SKILL.md app/.agents/skills/clerk-billing/evals/evals.json app/.agents/skills/clerk-billing/references/b2b-patterns.md app/.agents/skills/clerk-billing/references/b2c-patterns.md app/.agents/skills/clerk-billing/references/billing-components.md app/.agents/skills/clerk-billing/references/billing-webhooks.md app/.agents/skills/clerk-billing/SKILL.md app/.agents/skills/clerk-chrome-extension-patterns/evals/evals.json app/.agents/skills/clerk-chrome-extension-patterns/references/content-scripts.md app/.agents/skills/clerk-chrome-extension-patterns/references/create-clerk-client.md app/.agents/skills/clerk-chrome-extension-patterns/references/headless-extension.md app/.agents/skills/clerk-chrome-extension-patterns/references/sync-host.md app/.agents/skills/clerk-chrome-extension-patterns/SKILL.md app/.agents/skills/clerk-chrome-extension-patterns/templates/chrome-ext-basic-auth/package.json app/.agents/skills/clerk-chrome-extension-patterns/templates/chrome-ext-basic-auth/src/popup.tsx app/.agents/skills/clerk-chrome-extension-patterns/templates/chrome-ext-basic-auth/tsconfig.json app/.agents/skills/clerk-cli/references/agent-mode.md app/.agents/skills/clerk-cli/references/auth.md app/.agents/skills/clerk-cli/references/recipes.md app/.agents/skills/clerk-cli/SKILL.md app/.agents/skills/clerk-custom-ui/core-2/custom-sign-in.md app/.agents/skills/clerk-custom-ui/core-2/custom-sign-up.md app/.agents/skills/clerk-custom-ui/core-3/custom-sign-in.md app/.agents/skills/clerk-custom-ui/core-3/custom-sign-up.md app/.agents/skills/clerk-custom-ui/core-3/show-component.md app/.agents/skills/clerk-custom-ui/SKILL.md app/.agents/skills/clerk-expo-patterns/evals/evals.json app/.agents/skills/clerk-expo-patterns/references/oauth-deep-linking.md app/.agents/skills/clerk-expo-patterns/references/protected-routes.md app/.agents/skills/clerk-expo-patterns/references/push-notifications.md app/.agents/skills/clerk-expo-patterns/references/token-storage.md app/.agents/skills/clerk-expo-patterns/SKILL.md app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/app.json app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/app/_layout.tsx app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/app/(auth)/_layout.tsx app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/app/(home)/_layout.tsx app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/app/(home)/index.tsx app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/package.json app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/tsconfig.json app/.agents/skills/clerk-expo/references/custom.md app/.agents/skills/clerk-expo/references/prebuilt.md app/.agents/skills/clerk-expo/SKILL.md app/.agents/skills/clerk-nextjs-patterns/evals/evals.json app/.agents/skills/clerk-nextjs-patterns/references/api-routes.md app/.agents/skills/clerk-nextjs-patterns/references/caching-auth.md app/.agents/skills/clerk-nextjs-patterns/references/middleware-strategies.md app/.agents/skills/clerk-nextjs-patterns/references/server-actions.md app/.agents/skills/clerk-nextjs-patterns/references/server-vs-client.md app/.agents/skills/clerk-nextjs-patterns/SKILL.md app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/app/layout.tsx app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/app/page.tsx app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/package.json app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/proxy.ts app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/tsconfig.json app/.agents/skills/clerk-nuxt-patterns/evals/evals.json app/.agents/skills/clerk-nuxt-patterns/references/composables.md app/.agents/skills/clerk-nuxt-patterns/references/nuxt-middleware.md app/.agents/skills/clerk-nuxt-patterns/references/server-api-routes.md app/.agents/skills/clerk-nuxt-patterns/references/ssr-auth.md app/.agents/skills/clerk-nuxt-patterns/SKILL.md app/.agents/skills/clerk-nuxt-patterns/templates/nuxt-basic-auth/app.vue app/.agents/skills/clerk-nuxt-patterns/templates/nuxt-basic-auth/nuxt.config.ts app/.agents/skills/clerk-nuxt-patterns/templates/nuxt-basic-auth/package.json app/.agents/skills/clerk-orgs/evals/evals.json app/.agents/skills/clerk-orgs/references/enterprise-sso.md app/.agents/skills/clerk-orgs/references/invitations.md app/.agents/skills/clerk-orgs/references/nextjs-patterns.md app/.agents/skills/clerk-orgs/references/roles-permissions.md app/.agents/skills/clerk-orgs/SKILL.md app/.agents/skills/clerk-react-patterns/evals/evals.json app/.agents/skills/clerk-react-patterns/references/custom-flows.md app/.agents/skills/clerk-react-patterns/references/hooks.md app/.agents/skills/clerk-react-patterns/references/protected-routes.md app/.agents/skills/clerk-react-patterns/references/router-integration.md app/.agents/skills/clerk-react-patterns/SKILL.md app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/index.html app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/package.json app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/src/App.tsx app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/src/main.tsx app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/tsconfig.json app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/vite.config.ts app/.agents/skills/clerk-react-router-patterns/evals/evals.json app/.agents/skills/clerk-react-router-patterns/references/loaders-actions.md app/.agents/skills/clerk-react-router-patterns/references/protected-routes.md app/.agents/skills/clerk-react-router-patterns/references/ssr-auth.md app/.agents/skills/clerk-react-router-patterns/SKILL.md app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/app/app.css app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/app/root.tsx app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/app/routes.ts app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/app/routes/home.tsx app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/package.json app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/react-router.config.ts app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/vite.config.ts app/.agents/skills/clerk-setup/evals/evals.json [208 more files omitted for size] ``` ### Dependencies - app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/package.json: @astrojs/node@^9.0.0, @clerk/astro@^2.0.0, astro@^5.0.0 - app/.agents/skills/clerk-chrome-extension-patterns/templates/chrome-ext-basic-auth/package.json: @clerk/chrome-extension@latest, plasmo@latest, react@latest, react-dom@latest - app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/package.json: @clerk/expo@latest, expo@latest, expo-router@latest, expo-secure-store@latest, react@latest, react-native@latest - app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/package.json: @clerk/nextjs@latest, @types/react@latest, @types/react-dom@latest, next@latest, react@latest, react-dom@latest, typescript@latest - app/.agents/skills/clerk-nuxt-patterns/templates/nuxt-basic-auth/package.json: @clerk/nuxt@latest, nuxt@latest - app/.agents/skills/clerk-react-patterns/templates/react-basic-auth/package.json: @clerk/react@^5.0.0, @types/react@^19.0.0, @types/react-dom@^19.0.0, @vitejs/plugin-react@^4.0.0, react@^19.0.0, react-dom@^19.0.0, typescript@^5.6.0, vite@^6.0.0 - app/.agents/skills/clerk-react-router-patterns/templates/react-router-basic-auth/package.json: @clerk/react-router@latest, @react-router/dev@latest, @react-router/node@latest, react@latest, react-dom@latest, react-router@latest, vite@latest - app/.agents/skills/clerk-tanstack-patterns/templates/tanstack-basic-auth/package.json: @clerk/tanstack-react-start@latest, @tanstack/react-router@latest, @tanstack/react-router-devtools@latest, @tanstack/react-start@latest, @vitejs/plugin-react@^4.0.0, react@^19.0.0, react-dom@^19.0.0, typescript@^5.6.0, vite@^7.0.0, vite-tsconfig-paths@^5.0.0 - app/.agents/skills/clerk-vue-patterns/templates/vue-basic-auth/package.json: @clerk/vue@latest, @vitejs/plugin-vue@latest, typescript@latest, vite@latest, vue@latest, vue-tsc@latest - apps/chrome/package.json: @tailwindcss/cli@^4.0.0, @types/chrome@^0.0.268, @types/react@^19.0.0, @types/react-dom@^19.0.0, esbuild@^0.21.5, lucide-react@^0.469.0, react@^19.0.0, react-dom@^19.0.0, tailwindcss@^4.0.0, typescript@^5.4.0 - apps/vscode/package.json: @types/node@^20.11.0, @types/vscode@^1.85.0, esbuild@^0.21.5, typescript@^5.4.0 - package.json: @anthropic-ai/sdk@^0.104.1, @clerk/nextjs@^7.4.3, @elevenlabs/client@^1.11.1, @ffmpeg-installer/ffmpeg@^1.1.0, @neondatabase/serverless@^1.1.0, @sentry/nextjs@^10.57.0, @tailwindcss/postcss@^4, @types/fluent-ffmpeg@^2.1.27, @types/node@^20, @types/react@^19, @types/react-dom@^19, @upstash/ratelimit@^2.0.8, @upstash/redis@^1.38.0, @vapi-ai/web@^2.5.2, @xyflow/react@^12.11.0, cloudinary@^2.6.1, dotenv@^17.4.2, drizzle-kit@^0.31.10, drizzle-orm@^0.45.2, eslint@^9, eslint-config-next@16.2.7, fluent-ffmpeg@^2.1.3, framer-motion@^12.40.0, geist@^1.7.2, ioredis@^5.11.1, lucide-react@^1.17.0, next@16.2.7, openai@^4.103.0, playwright-core@^1.60.0, react@19.2.4, react-dom@19.2.4, recharts@^3.8.1, tailwindcss@^4, tsx@^4.22.4, typescript@^5, vitest@^2.1.9, zustand@^5.0.14 ### Recent commits (newest first) - functions - Merge pull request #5 from sudarshan-krishnan/dashboard - dashboard - components in place - Merge pull request #4 from sudarshan-krishnan/videogen-vapi - va[pi and cloudinary(vid gen) - Merge pull request #3 from sudarshan-krishnan/backend - backend complete - Merge pull request #2 from sudarshan-krishnan/oauth - clerk - outh - Merge pull request #1 from sudarshan-krishnan/initial-ui/ux - inital ui - hardcoded - ideation purposes - user journey pending to update - (by isha) - ideation ## Key source files (fetched from GitHub, selected and truncated for size) ### CLAUDE.md ```markdown @AGENTS.md ``` ### AGENTS.md ```markdown # This is NOT the Next.js you know This version has breaking changes — APIs, conventions, and file structure may all differ from your training data. Read the relevant guide in `node_modules/next/dist/docs/` before writing any code. Heed deprecation notices. ``` ### package.json ``` { "name": "sentinel", "version": "0.1.0", "private": true, "scripts": { "dev": "next dev --turbopack", "build": "next build", "start": "next start", "lint": "eslint", "test": "vitest run", "test:watch": "vitest", "typecheck": "tsc --noEmit", "db:generate": "drizzle-kit generate", "db:push": "drizzle-kit push", "db:migrate": "tsx scripts/db-migrate.ts", "db:studio": "drizzle-kit studio", "ratelimit:clear": "tsx scripts/clear-rate-limit.ts" }, "dependencies": { "@anthropic-ai/sdk": "^0.104.1", "@clerk/nextjs": "^7.4.3", "@elevenlabs/client": "^1.11.1", "@ffmpeg-installer/ffmpeg": "^1.1.0", "@neondatabase/serverless": "^1.1.0", "@sentry/nextjs": "^10.57.0", "@upstash/ratelimit": "^2.0.8", "@upstash/redis": "^1.38.0", "@vapi-ai/web": "^2.5.2", "@xyflow/react": "^12.11.0", "cloudinary": "^2.6.1", "drizzle-orm": "^0.45.2", "fluent-ffmpeg": "^2.1.3", "framer-motion": "^12.40.0", "geist": "^1.7.2", "ioredis": "^5.11.1", "lucide-react": "^1.17.0", "next": "16.2.7", "openai": "^4.103.0", "playwright-core": "^1.60.0", "react": "19.2.4", "react-dom": "19.2.4", "recharts": "^3.8.1", "zustand": "^5.0.14" }, "devDependencies": { "@tailwindcss/postcss": "^4", "@types/fluent-ffmpeg": "^2.1.27", "@types/node": "^20", "@types/react": "^19", "@types/react-dom": "^19", "dotenv": "^17.4.2", "drizzle-kit": "^0.31.10", "eslint": "^9", "eslint-config-next": "16.2.7", "tailwindcss": "^4", "tsx": "^4.22.4", "typescript": "^5", "vitest": "^2.1.9" } } ``` ### apps/chrome/package.json ``` { "name": "sentinel-chrome", "displayName": "Sentinel — AI Security Assistant", "description": "GitHub Advanced Security for AI agents, in your browser. Prompt Shield, secret-leak prevention, GitHub trust overlay, agent/MCP discovery, and a Security Copilot — all wired to your real Sentinel dashboard.", "version": "0.1.0", "private": true, "type": "module", "scripts": { "icons": "node scripts/make-icons.mjs", "build:js": "node esbuild.mjs", "build:css": "tailwindcss -i ./src/styles/app.css -o ./dist/app.css --minify", "build": "node scripts/make-icons.mjs && node esbuild.mjs && npm run build:css", "watch": "node esbuild.mjs --watch", "typecheck": "tsc --noEmit" }, "devDependencies": { "@tailwindcss/cli": "^4.0.0", "@types/chrome": "^0.0.268", "@types/react": "^19.0.0", "@types/react-dom": "^19.0.0", "esbuild": "^0.21.5", "tailwindcss": "^4.0.0", "typescript": "^5.4.0" }, "dependencies": { "lucide-react": "^0.469.0", "react": "^19.0.0", "react-dom": "^19.0.0" } } ``` ### apps/vscode/package.json ``` { "name": "sentinel-copilot", "displayName": "Sentinel Agent Security", "description": "GitHub Advanced Security for AI agents — inline agentic risk, MCP/tool-permission analysis, attack paths, and an Explain-like-I'm-12 mode, live as you code.", "version": "0.1.0", "publisher": "sentinel", "license": "MIT", "repository": { "type": "git", "url": "https://github.com/sudarshan-krishnan/Sentinel_CalHacks_2026" }, "engines": { "vscode": "^1.85.0" }, "categories": ["Linters", "Other"], "main": "./dist/extension.js", "activationEvents": ["onStartupFinished", "onUri"], "contributes": { "viewsContainers": { "activitybar": [ { "id": "sentinel", "title": "Sentinel", "icon": "media/sentinel.svg" } ] }, "views": { "sentinel": [ { "type": "webview", "id": "sentinel.copilot", "name": "Mission Control" }, { "id": "sentinel.findings", "name": "Findings" }, { "id": "sentinel.agents", "name": "AI Agents & MCP" } ] }, "commands": [ { "command": "sentinel.scanWorkspace", "title": "Scan Workspace", "category": "Sentinel", "icon": "$(refresh)" }, { "command": "sentinel.fixAllAndPr", "title": "Fix All & Open Pull Request", "category": "Sentinel", "icon": "$(git-pull-request)" }, { "command": "sentinel.fixAll", "title": "Apply All Fixes (no PR)", "category": "Sentinel", "icon": "$(wand)" }, { "command": "sentinel.createPr", "title": "Commit & Open Pull Request", "category": "Sentinel", "icon": "$(git-commit)" }, { "command": "sentinel.openLog", "title": "Show Log", "category": "Sentinel", "icon": "$(output)" }, { "command": "sentinel.applyFix", "title": "Sentinel: Apply Fix", "category": "Sentinel" }, { "command": "sentinel.explain", "title": "Explain like I'm 12", "category": "Sentinel" }, { "command": "sentinel.showFix", "title": "Show recommended fix", "category": "Sentinel" }, { "command": "sentinel.signIn", "title": "Sign In (connect to dashboard)", "category": "Sentinel", "icon": "$(sign-in)" }, { "command": "sentinel.signInWithCode", "title": "Sign In with a connection code", "category": "Sentinel" }, { "command": "sentinel.signOut", "title": "Sign Out (use Local Mode)", "category": "Sentinel", "icon": "$(sign-out)" }, { "command": "sentinel.cloudScan", "title": "Scan a GitHub repo in the cloud", "category": "Sentinel", "icon": "$(cloud)" }, { "command": "sentinel.accountMenu", "title": "Account & Mode…", "category": "Sentinel" }, { "command": "sentinel.analyzeSelection", "title": "Analyze Selected Code", "category": "Sentinel", "icon": "$(search)" }, { "command": "sentinel.explainSelection", "title": "Explain Security Risk", "category": "Sentinel", "icon": "$(comment-discussion)" }, { "command": "sentinel.findVulnsSelection", "title": "Find Vulnerabilities", "category": "Sentinel", "icon": "$(bug)" }, { "command": "sentinel.secureFixSelection", "title": "Generate Secure Fix", "category": "Sentinel", "icon": "$(wand)" }, { "command": "sentinel.scanFile", "title": "Scan File", "category": "Sentinel", "icon": "$(file-code)" }, { "command": "sentinel.scanFolder", "title": "Scan Folder", "category": "Sentinel", "icon": "$(folder)" }, { "command": "sentinel.analyzeRepository", "title": "Analyze Repository", "category": "Sentinel", "icon": "$(repo)" }, { "command": "sentinel.reviewChanges", "title": "Review Changes", "category": "Sentinel", "icon": "$(git-compare)" }, { "command": "sentinel.scanDiff", "title": "Scan Diff", "category": "Sentinel", "icon": "$(diff)" }, { "command": "sentinel.prSummary", "title": "Generate Secure PR Summary", "category": "Sentinel", "icon": "$(git-pull-request)" }, { "command": "sentinel.explainIssue", "title": "Explain Issue", "category": "Sentinel" }, { "command": "sentinel.suggestFix", "title": "Suggest Fix", "category": "Sentinel" }, { "command": "sentinel.securityAnalysis", "title": "Security Analysis", "category": "Sentinel" } ], "submenus": [ { "id": "sentinel.editorSubmenu", "label": "Sentinel", "icon": "media/sentinel.svg" }, { "id": "sentinel.explorerSubmenu", "label": "Sentinel", "icon": "media/sentinel.svg" } ], "menus": { "view/title": [ { "command": "sentinel.scanWorkspace", "when": "view == sentinel.copilot || view == sentinel.findings || view == sentinel.agents", "group": "navigation@1" }, { "command": "sentinel.cloudScan", "when": "view == sentinel.copilot || view == sentinel.findings", "group": "navigation@2" }, { "command": "sentinel.fixAllAndPr", "when": "view == sentinel.copilot || view == sentinel.findings", "group": "navigation@3" }, { "command": "sentinel.openLog", "when": "view == sentinel.copilot || view == sentinel.findings || view == sentinel.agents", "group": "navigation@4" } ], "view/item/context": [ { "command": "sentinel.applyFix", "when": "view == sentinel.findings", "group": "inline@1" }, { "command": "sentinel.explain", "when": "view == sentinel.findings", "group": "inline@2" } ], "editor/context": [ { "submenu": "sentinel.editorSubmenu", "group": "1_modification", "when": "editorTextFocus" } ], "sentinel.editorSubmenu": [ { "command": "sentinel.analyzeSelection", "group": "1_analyze@1", "when": "editorHasSelection" }, { "command": "sentinel.explainSelection", "group": "1_analyze@2", "when": "editorHasSelection" }, { "command": "sentinel.findVulnsSelection", "group": "1_analyze@3", "when": "editorHasSelection" }, { "command": "sentinel.secureFixSelection", "group": "2_fix@1", "when": "editorHasSelection" }, { "command": "sentinel.scanFile", "group": "3_file@1" } ], "explorer/context": [ { "submenu": "sentinel.explorerSubmenu", "group": "navigation@99" } ], "sentinel.explorerSubmenu": [ { [truncated — 3142 more characters] ``` ### app/.agents/skills/clerk-nuxt-patterns/templates/nuxt-basic-auth/package.json ``` { "name": "nuxt-basic-auth", "private": true, "scripts": { "dev": "nuxt dev", "build": "nuxt build" }, "dependencies": { "nuxt": "latest", "@clerk/nuxt": "latest" } } ``` ### app/.agents/skills/clerk-astro-patterns/templates/astro-basic-auth/package.json ``` { "name": "clerk-astro", "type": "module", "scripts": { "dev": "astro dev", "build": "astro build" }, "dependencies": { "astro": "^5.0.0", "@clerk/astro": "^2.0.0", "@astrojs/node": "^9.0.0" } } ``` ### app/.agents/skills/clerk-expo-patterns/templates/expo-basic-auth/package.json ``` { "name": "clerk-expo", "scripts": { "start": "expo start" }, "dependencies": { "@clerk/expo": "latest", "expo": "latest", "expo-router": "latest", "expo-secure-store": "latest", "react": "latest", "react-native": "latest" } } ``` ### app/.agents/skills/clerk-vue-patterns/templates/vue-basic-auth/package.json ``` { "name": "vue-basic-auth", "private": true, "scripts": { "dev": "vite", "build": "vue-tsc && vite build" }, "dependencies": { "vue": "latest", "@clerk/vue": "latest" }, "devDependencies": { "@vitejs/plugin-vue": "latest", "typescript": "latest", "vite": "latest", "vue-tsc": "latest" } } ``` ### app/.agents/skills/clerk-nextjs-patterns/templates/nextjs-basic-auth/package.json ``` { "name": "clerk-nextjs", "private": true, "scripts": { "dev": "next dev", "build": "next build" }, "dependencies": { "next": "latest", "react": "latest", "react-dom": "latest", "@clerk/nextjs": "latest" }, "devDependencies": { "typescript": "latest", "@types/react": "latest", "@types/react-dom": "latest" } } ``` [263 more indexed source files omitted to keep this export small. The full file list is in the Codebase structure section above.]