See what a file would make your AI agent do.

AI coding agents follow instructions written in ordinary project files. Sentinel reads those files and tells you, in plain words, what they ask for.

CLAUDE.md
AGENTS.md
.cursorrules
settings.json
.mcp.json

File name

Your result appears here.

Pick a sample on the left, paste a file, or upload one. Then scan it.

How a file takes over an agent

No virus, no software bug. The agent does exactly what the file says, with your access to code, terminal and keys.

Invisible text

Characters with no width spell out an instruction. A reviewer sees a clean file. The agent reads every character.

Seen in TrapDoor, May 2026, and the Rules File Backdoor, March 2025.

Commands that run by themselves

A settings file tells the editor or the agent to run a script the moment the project is opened. Nothing asks first.

Seen in Miasma, June 2026: 73 Microsoft repositories switched off in 105 seconds. And in ChainDrop, August 2026.

A tool that changes after approval

A tool server behaves until it is trusted, then rewrites its own description into new orders.

Seen in Deadbugz, August 2026. Sentinel catches the change that adds the server. What the server does later needs a guard that watches the agent while it runs.

How Sentinel works

Four steps, all on your computer. Nothing is sent anywhere and nothing from the scanned project is ever run.

Find
the files agents obey, wherever each tool keeps them
Compare
before and after a change: what vanished, what now runs by itself
Check
26 rules with fixed, published weights. No guessing, no internet
Explain
what the agent would have done, and what to do about it

Optional, off by default. A sandboxed AI follows the file among decoy secrets while Sentinel watches what it reaches for. It can raise a warning. Only hard evidence can block.

What we measured

We ran Sentinel and two leading open-source scanners on the same 930 popular, healthy public projects, all at their default settings. Every square is one project. More green is better.

Sentinel fewest false alarms99.7% pass3 false alarms in 930 projects

Scanner B87% pass120 false alarms in 930 projects

Scanner A58% pass386 false alarms in 930 projects

Where we got it wrong

Our first version wrongly called 22 of 590 healthy projects compromised. We found the causes, fixed them, and re-tested on 340 projects it had never seen. It now calls none of the 930 compromised.

An experiment that fell short

A sandboxed AI followed 30 disguised attack files among decoy secrets. It caught 11, with no false alarms. That is below our own bar, so the feature ships switched off.

The projects are presumed healthy, not audited one by one, and both other scanners check far more things than Sentinel does. Tool names, versions, method and raw output are in the benchmark results.

Use it

You need Python 3.10 or newer and Git. Nothing else.

Windows: press Start, type PowerShell, press Enter. Mac or Linux: open Terminal.
Copy the block for your system below and paste it into that window. Paste all four lines at once.
Wait until it says Open http://127.0.0.1:8000, then open that address in your browser. Leave the window open.

Windows (PowerShell)

git clone https://github.com/GarvitAgrawal04/SENTINEL.git
cd SENTINEL
git pull
.\setup.bat

macOS or Linux

git clone https://github.com/GarvitAgrawal04/SENTINEL.git
cd SENTINEL
git pull
bash setup.sh

Ran it before? The same four lines are safe to run again. “Already exists” on the first line is fine: the third line brings your copy up to date.

What you should see

==> Using Python 3.12
==> Creating the virtual environment in .venv
==> Installing dependencies (first run takes a minute or two)
==> Self-test
ALL PASS
==> Open http://127.0.0.1:8000 in your browser

Start your agent through Sentinel. If the project is compromised, the agent does not start. This still works when an attacker skips your online checks.

Do the setup on the first tab once.
Open a second terminal window in the SENTINEL folder and switch the tools on. Windows: the first block. Mac or Linux: the second.
Go to the project you want to check and run the last block.

Windows: switch the tools on

Set-ExecutionPolicy -Scope Process Bypass
.venv\Scripts\Activate.ps1

macOS or Linux: switch the tools on

source .venv/bin/activate

Then, inside any project

sentinel scan .
sentinel run -- claude

What a dangerous project looks like

$ sentinel run -- claude
sentinel  verdict: COMPROMISED

[ !! ] .claude/settings.json   score 5
    S17b forced: 4 tools wired to auto-run the same payload
      what happens : Whichever of claude, cursor, gemini, vscode a
                     developer uses, opening this repo runs the same script.
[ !! ] .github/setup.js   score 39
    S18a forced: auto-exec target is opaque: 60,009 bytes on one line

sentinel: refusing to start `claude` here.

Sentinel comments on each pull request with what the change would make agents do, and fails the check when it is compromised.

This is a file for your GitHub repository. Do not paste it into a terminal. In your repository on GitHub choose Add file, Create new file, name it as shown on the tab below, paste the text, and commit.

.github / workflows / sentinel.yml

name: sentinel
on: { pull_request: {} }
permissions: { contents: read, pull-requests: write }
jobs:
  behaviour-diff:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: GarvitAgrawal04/SENTINEL/action@main
        with: { fail-on: compromised }

Pull request: chore: bump deps

Sentinel, agent behaviour diff Compromised

This pull request changes what AI coding agents will do in this repository: .mcp.json, AGENTS.md.

Exfiltration-shaped instructionS5, −40Your agent is told to send credentials off the machine.
Instruction hidden in a commentS2, −35Your agent reads an instruction that never renders in a preview.
Guardrail weakenedS20, needs approval“Do not upload the .env file anywhere.” Negation removed.
New MCP server, not approvedS19, needs approvalproductivity-suite, https://example.invalid/mcp

Approvals were read from the base branch’s AGENTS.lock (signature valid).

The extension underlines the dangerous line as you save, explains it when you hover, and shows the verdict in the status bar.

Download the extension

Click the button above. A small file is saved to your Downloads folder. Do not double-click it: on Windows that opens the wrong installer.
Open VS Code. Press Ctrl+Shift+P, type Install from VSIX, press Enter, and pick the file you downloaded.
Press Ctrl+Shift+P again, type Sentinel: Try it on a demo file, press Enter. A demo file opens with red and yellow underlines.
If a message says it could not reach your scanner, click Use the hosted demo scanner, or run the setup on the first tab so everything stays on your computer.

After that it checks CLAUDE.md, AGENTS.md, .cursorrules, settings.json, tasks.json and .mcp.json every time you save them.

What the extension reports

AGENTS.md: Compromised, trust score 15 of 100

  Exfiltration-shaped instruction  (S5, line 5)
    what happens : Your agent is told to send credentials to
                   https://example.invalid/k.
    what to do   : Remove the instruction. Rotate anything it names.

  Concealment from the user  (S13, line 5)
    what happens : Your agent is told not to tell you what it is doing.
    what to do   : Remove it. No legitimate project instruction needs this.

  score: AGENTS.md: 100 S5:-40 S13:-45 = 15 | forced -> 15

You do not need a key for this website, the scanner, the VS Code extension, the gate or the pull-request check. Only the optional sandbox uses one, and it uses your own key from your own account. This website will never ask you for it.

Get a key from a provider you have an account with: Groq (has a free tier), OpenAI, Anthropic, Together, Mistral, OpenRouter or DeepInfra.
Do the setup on the first tab. Then open a second terminal in the SENTINEL folder and switch the tools on (the “Before your agent starts” tab shows how).
Run the first block below and answer three questions: provider, model (press Enter for the suggested one), key. The key stays hidden as you type or paste it.
Run the second block to check the key, then try the sandbox on a file.

Add your key

sentinel apikey

Check it, then use it

sentinel apikey --test
sentinel detonate CLAUDE.md

The key is saved only in the .env file inside your SENTINEL folder. That file is never uploaded. To take the key out again, run sentinel apikey --remove. Never paste a key into a website, a chat or an issue.

What you should see

$ sentinel apikey
The optional sandbox needs an API key from a model provider.
It will be stored only in:
  C:\Users\you\SENTINEL\.env
That file is git-ignored and never uploaded.

Provider (anthropic, deepinfra, groq, ...) [groq]:
Model [openai/gpt-oss-20b]:
API key (hidden as you type):
Saved (key …wxyz). Check it with:  sentinel apikey --test

$ sentinel apikey --test
The key works. Try:  sentinel detonate CLAUDE.md

What Sentinel does not do

It checks files. An attack that begins after a tool server is approved needs a guard that watches the agent while it runs.
Its rules catch patterns. A cleverly reworded instruction can pass them, and one of our own tests documents that miss.
A clean result means checked, not safe.