Skip to content

website: bring Sentinel status up to date with pkg-registry #101

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tonibergholm merged 1 commit into from
Jul 9, 2026
Merged

website: bring Sentinel status up to date with pkg-registry #101

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions website/src/pages/index.astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,9 @@ $ bash demo/run_demo.sh</code></pre>
Agents run <code>npm install</code> and execute code nobody read.
Sentinel is a transparent auditing proxy in front of
registry.npmjs.org: every tarball is scored by a deterministic engine
and carries a verdict <em>before</em> install-time code runs. The
agent can request; only a human grants.
and carries a verdict <em>before</em> install-time code runs, and a
deny-by-default sandbox contains what does run. The agent can
request; only a human grants.
</p>
<pre><code> color-stream@1.4.1
────────────────────────────────────────
Expand All @@ -87,7 +88,7 @@ $ bash demo/run_demo.sh</code></pre>
<span class="bad">critical</span> [secret-exfil] reads ~/.npmrc, AWS credentials…

HTTP 403 x-sentinel-verdict: block</code></pre>
<p class="meta">TypeScript · auditing proxy live · policy &amp; permissions next</p>
<p class="meta">TypeScript · full security layer built · open-source launch prep</p>
<p><a href="/sentinel">Full page →</a> &nbsp; <a href={pkgRegistry}>GitHub →</a></p>
</section>

Expand Down
47 changes: 34 additions & 13 deletions website/src/pages/sentinel.astro
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ const repo = 'https://github.com/git-agentic/pkg-registry';
<Header />

<div class="badges">
<span class="badge"><span class="pulse"></span>Auditing proxy live · policy &amp; permissions next</span>
<span class="badge"><span class="pulse"></span>Full security layer built · open-source launch prep</span>
<span class="badge">Apache 2.0</span>
<span class="badge">TypeScript</span>
</div>
Expand Down Expand Up @@ -71,29 +71,50 @@ $ sentinel audit is-odd 3.0.1
<li>Deterministic scoring — start at 100, weighted penalties per
finding, any critical forces block — fully reproducible in CI; an
LLM adapter only adds context, never the score</li>
<li>Policy and approval gate: signed per-enterprise policy, capability
manifests, and a hard privilege boundary — the agent can request an
approval, only a human can grant it</li>
<li>Sandbox enforcement (macOS Seatbelt, Linux bubblewrap): lifecycle
scripts run with denied-by-default access to secrets and network;
detected violations quarantine that exact tarball fleet-wide</li>
<li>Policy and approval gate: signed per-enterprise policy — with a
lint and a dry-run impact preview against real audit history before
signing — capability manifests, and a hard privilege boundary: the
agent can request an approval, only a human can grant it, enforced
by signed Ed25519 role tokens on the control plane</li>
<li>Deny-by-default sandbox (macOS Seatbelt, Linux bubblewrap):
lifecycle scripts get no network, no credential env vars, no writes
outside a fixed floor, and no <code>$HOME</code> reads unless a
capability is approved; detected violations quarantine that exact
tarball fleet-wide</li>
<li>Agent-native surfaces: a stdio MCP server for agent hosts and a
CLI whose exit codes make <code>sentinel audit</code> a CI gate</li>
CLI whose exit codes make <code>sentinel audit</code> a CI gate;
<code>sentinel explain</code> turns a verdict into per-finding
remediation and a suggested last-known-good version — advisory
only, it never rewrites a lockfile</li>
<li>Whole-tree gates: audit every package in an npm/yarn/pnpm lockfile,
write a CycloneDX SBOM, post the verdict to the PR via a GitHub
Action</li>
<li>Signed audit attestations (DSSE/in-toto, Ed25519) verified offline
as a deploy-time gate, plus known-malicious advisory and CVE-range
(SCA) detection</li>
<li>Identity and history signals: typosquat and dependency-confusion
detection, and release-anomaly findings — maintainer takeover,
dormancy resurrection, new capabilities in a patch release</li>
<li>Durable history and observability (opt-in, zero-dependency
SQLite): verdict trends, top-flagged packages, and a violation
timeline on the dashboard, the CLI, and <code>/-/metrics</code></li>
<li>Hardened trust boundary: tarball fetches pinned to allowlisted
origins (no SSRF), Host-header spoofing refused, byte caps and
opt-in rate limits on expensive routes</li>
</ul>

<h2>Status</h2>
<p class="mute">
The auditing proxy is the live wedge: deterministic engine, whole-tree
lockfile gate, sandbox enforcement with runtime quarantine, MCP server,
GitHub Action, signed policies and attestations, advisory + CVE
detection. The long arc is policy and install-time permissions for the
whole ecosystem.
What started as the audit-proxy wedge has grown into the full layer
(July 2026): signed per-enterprise policy and install-time permission
manifests, a deny-by-default capability sandbox, offline signature and
Sigstore-provenance verification, known-malicious (GHSA) and CVE-range
detection, supply-chain identity and release-anomaly heuristics,
whole-tree lockfile auditing with SBOMs and signed attestations, a
CI-native GitHub Action, an agent-native MCP server, durable
observability, and a hardened network trust boundary. Current work is
open-source launch prep; the long arc is policy and install-time
permissions for the whole ecosystem.
</p>

<p class="mute">
Expand Down
Loading