Continuous security review on your box, with your AI.
Sentinel runs the deterministic Keelix engine on a schedule, diffs every pass against the last one, and notifies you when something actually changed. An optional AI layer — your Anthropic, OpenAI, or Gemini key, or a local model — explains the change and drafts a fix as text. The AI has no hands: it never executes anything.
One tick, four commands
The unit of work is a tick: scan → diff vs saved state → events → deterministic triage → optional single batched AI call → notify → persist. Everything lives on disk under ~/.keelix/sentinel/, so a tick is crash-proof by construction.
keelix auth login anthropic # or: openai | gemini (API key prompt) keelix sentinel install # systemd timer / launchd plist — prints, asks y/N, never enables itself keelix sentinel tick # one pass: scan → diff → events → triage → notify keelix sentinel run # the same tick in a loop (tmux/screen friendly) keelix sentinel status # last tick, last result, config summary keelix ask "what changed since yesterday?" keelix diff old.json new.json # standalone compare of two saved scans
Notifications go to ntfy, gotify, telegram, or a generic JSON webhook, with per-channel severity filters. Token fields accept indirection refs (env:NAME, keychain:item (macOS only), op://…) so secrets stay out of the config file.
Bring your own AI — any of four providers
Keelix has zero AI cost of its own: you bring the model. For keelix scan --ai, the provider is selected by KEELIX_AI_PROVIDER (with KEELIX_AI_MODEL / KEELIX_AI_BASE_URL) or, when that is unset, by ANTHROPIC_API_KEY. For the Sentinel loop, the provider comes from the ai: block in the sentinel config. Keys are resolved env-var first, then from the 0600-enforced ~/.keelix/credentials.json, then via indirection refs at use time.
| Provider | Credentials | Default model |
|---|---|---|
| anthropic | ANTHROPIC_API_KEY (ANTHROPIC_MODEL overrides) | claude-sonnet-4-6 |
| openai | OPENAI_API_KEY (OPENAI_MODEL) or Sign in with ChatGPT where enabled | gpt-5-mini |
| gemini | GEMINI_API_KEY (GEMINI_MODEL) | gemini-2.5-flash |
| openai-compatible | optional key; base_url required (Ollama, LM Studio, vLLM, OpenRouter) | required — no universal default |
The AI has no hands
- Pure text completion. No tool calling, no execution, no file access. The deterministic engine is the only thing that observes the system; the AI drafts fixes as text only. Prompt injection can influence text — never actions.
- Fenced input. Untrusted scan content rides inside nonce-tagged delimiters the model is instructed to treat as data, never as instructions.
- Sanitized output. AI text is length-capped in code, control characters are stripped, and URLs the scan never observed are defanged to
hxxps://— an injected banner cannot turn a notification into a phishing vector. - Deterministic floor. Notifications lead with code-generated facts (check IDs, severities, score); AI text is additive and labeled
AI summary:.keelix askanswers lead with the AI response followed by a deterministic footer of current scan facts. - Secrets stay invisible. Prompts are built only from the already-redacted scan result, and the collector never reads
~/.keelix/— your AI credentials are not part of the scanned surface.
Frequently asked
- What does keelix sentinel do?
- Sentinel turns the one-shot scanner into a continuous review. Each tick runs one complete pass: scan the box, diff against the saved state, derive events, decide deterministically whether the change is worth an AI triage call, notify your channels, and persist state. `keelix sentinel tick` runs one pass and exits (cron/systemd-timer style); `keelix sentinel run` loops the same tick as a foreground daemon.
- Which AI providers does Keelix Sentinel support?
- Bring your own model: Anthropic (ANTHROPIC_API_KEY), OpenAI (OPENAI_API_KEY or Sign in with ChatGPT where enabled), Gemini (GEMINI_API_KEY), or any OpenAI-compatible endpoint with a base_url — Ollama, LM Studio, vLLM, OpenRouter. Keelix has zero AI cost of its own, and local-model users get a setup where AI inference never leaves the box. Note: configured notification channels (ntfy, Telegram, etc.) still send notifications off-box regardless of the AI provider.
- Can the AI change anything on my server?
- No. The AI has no hands: it is a pure text completion with no tool calling, no execution, and no file access. The deterministic engine is the only thing that observes the system, and nothing executes remediations. The AI explains what changed, why it matters, and drafts fixes as text for you to review.
- Does Sentinel need a Keelix Cloud account?
- No. Everything — scanning, diffing, triage, notifications, the credential store — runs locally in the open-source CLI with zero cloud dependency. Pointing the AI provider at a local model via the openai-compatible endpoint keeps scan data on the box entirely.
- How does Sentinel defend against prompt injection in scan data?
- Scan content can contain attacker-controlled strings (service banners, container names, MCP tool descriptions). Sentinel fences untrusted data in nonce-tagged delimiters the model is told to treat as data, sanitizes all AI output in code (length cap, control characters stripped, unknown URLs defanged to hxxps://), and always leads notifications with code-generated facts. And because the AI has no hands, injection can influence text only — never actions.
Related
Put a sentinel on your box tonight.
Free, local-first, Apache-2.0. Bring any AI — or none: the deterministic engine never depends on it.