Sentrik

io.github.maxgerhardsonPublished by GitHub account maxgerhardsonv1.2.0Updated Oct 24, 2026

Governance runtime for AI-generated code. Enforce compliance and security standards.

VerifiedSTDIODesktop onlyDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Runs Sentrik's compliance and security scanning as an MCP server so AI coding agents can check code against standards and see findings.

What you can do
Sentrik is a governance runtime for AI-generated code, exposed to assistants through the command sentrik mcp-server. It gives agents access to compliance rules, scan results, and remediation guidance so generated code can be checked against standards such as OWASP Top 10, SOC 2, HIPAA, PCI-DSS, and supply chain rules. The underlying CLI also scans code, gates pull requests, detects hardcoded secrets, scans dependencies for CVEs, produces SBOMs, and generates threat models and quality scores.
When to use it
Useful for teams whose AI coding agents produce code faster than humans can review it and who need security, compliance, or architectural standards enforced before code ships. It fits workflows that already use Sentrik's CLI or CI gate and want the assistant to see the same findings and guidance.
Requirements
Runs locally as a stdio process, installed from the npm package sentrik (the README also shows pip install sentrik). Desktop only. The free tier needs no license key or sign-up; Team and Organization features require a license key supplied through the GUARD_LICENSE_KEY environment variable. Network access is needed for dependency vulnerability scanning and license activation.
Before you install
The optional GUARD_LICENSE_KEY secret is read from the environment and should be stored as a secret, not committed. Paid tiers are arranged by contacting the vendor. Scanning reads source code and dependency data, and the dashboard and CI integrations write findings reports and SARIF output; review what is uploaded to third-party services such as GitHub Code Scanning before enabling it.

Installation

In SourceWeft

  1. Open Sentrik in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Sentrik

Governance runtime for AI-generated code

Scan, gate, and trace compliance automatically — before it ships.

Website • Docs • Community • Pricing

What is Sentrik?

Sentrik is a CLI + dashboard that enforces coding standards, compliance rules, and security policies on every commit. Built for teams using AI coding agents (Claude Code, Cursor, Copilot) where code is generated faster than humans can review it.

The problem: AI agents write code that works but may violate security policies, compliance requirements, or architectural standards. Nobody catches it until audit time.

The solution: Sentrik scans every change against regulatory standards (OWASP, SOC 2, HIPAA, PCI-DSS, FDA IEC 62304, and more), gates PRs that fail, and generates audit-ready evidence.

Install

bash
pip install sentrik

Installing gives you the free tier immediately — 6 standards packs, 193 rules, no license key or sign-up. Paid tiers are activated with a license key from [email protected].

Quick Start

bash
# 1. Initialize your project (auto-detects language, frameworks, CI)sentrik init
# 2. Scan your codesentrik scan
# 3. Enforce the gate in CI (exit 1 on failure)sentrik gate
# 4. Launch the dashboardsentrik dashboard

Free Tier (forever, no credit card)

Sentrik includes 6 standards packs with 193 rules for free:

PackRulesWhat it catches
OWASP Top 1069SQL injection, XSS, auth flaws, SSRF, and more
SOC 230Trust services criteria for security & availability
Python Security18eval/exec, pickle, subprocess, Django/Flask vulns
Go Security15Injection, crypto misuse, unsafe, concurrency bugs
Supply Chain Security26SLSA, SBOM, dependency integrity, AI tool supply chain
C/C++ Coding Standards35Modern C/C++ safety and security practices

Plus built-in commands at every tier:

  • sentrik scan / sentrik gate - Scan and enforce
  • sentrik vulns - Dependency vulnerability scanning (CVEs)
  • sentrik sbom - Software bill of materials
  • sentrik secrets - Hardcoded secrets detection
  • sentrik dashboard - Web UI with findings, charts, and reports
  • sentrik threat-model - STRIDE threat analysis
  • sentrik quality-score - Code quality scoring (0-100)

Paid Tiers

FreeTeamOrganization
Standards packs6 (193 rules)18 (475 rules)24 (595 rules)
OWASP, SOC 2, Supply Chain, C/C++YesYesYes
HIPAA, PCI-DSS, ISO 27001, GDPR-YesYes
FDA IEC 62304, NIST, CMMC, Cloud IaC-YesYes
MISRA-C, DO-178C, ISO 26262--Yes
Vulnerability scanningYesYesYes
DashboardYesYesYes
Work item reconciliation-YesYes
Custom rule packs525100
Parallel scanning--Yes
Governance & audit log--Yes

Paid tiers are available by contacting [email protected] — see sentrik.dev/pricing.

CI/CD Integration

GitHub Actions (Marketplace)

yaml
# .github/workflows/sentrik.ymlname: Sentrik Gateon: [pull_request]jobs:  gate:    runs-on: ubuntu-latest    steps:      - uses: actions/checkout@v4        with:          fetch-depth: 0      - uses: maxgerhardson/sentrik-community@v1

That's it — one line. The action auto-detects PR context, runs the gate, uploads SARIF to GitHub Code Scanning, and attaches the findings report as an artifact.

With options:

yaml
      - uses: maxgerhardson/sentrik-community@v1        with:          packs: "owasp-top-10,soc2,supply-chain-security"          fail-on: "critical,high"          license-key: ${{ secrets.SENTRIK_LICENSE_KEY }}

Using outputs:

yaml
      - uses: maxgerhardson/sentrik-community@v1        id: sentrik      - run: echo "Found ${{ steps.sentrik.outputs.findings-count }} findings"        if: always()

GitLab CI

yaml
sentrik:  image: maxgerhardson/sentrik:latest  script:    - sentrik gate --git-range "origin/main...HEAD"  rules:    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

Azure Pipelines

yaml
- script: |    pip install sentrik    sentrik gate --git-range "origin/main...HEAD"  displayName: Sentrik Gate

AI Agent Integration

Sentrik works as an MCP server for AI coding agents:

bash
# Start MCP server for Claude Code, Cursor, VS Codesentrik mcp-server

The MCP server gives AI agents real-time access to compliance rules, scan results, and remediation guidance — so they write compliant code from the start.

Example Configurations

Starter (web app)

yaml
# .sentrik/config.yamlstandards_packs:  - owasp-top-10  - supply-chain-securitygate:  fail_on:    - critical    - high

Healthcare / Medical Device

yaml
standards_packs:  - owasp-top-10  - hipaa  - fda-iec-62304  - supply-chain-securitygate:  fail_on:    - critical    - high    - medium

Fintech

yaml
standards_packs:  - owasp-top-10  - pci-dss  - soc2  - supply-chain-securitygate:  fail_on:    - critical    - high

Government / Defense

yaml
standards_packs:  - owasp-top-10  - nist-800-53  - cmmc  - supply-chain-securitygate:  fail_on:    - critical    - high    - medium

Community

  • Discussions - Ask questions, share tips, show what you've built
  • Issues - Report bugs or request features
  • Documentation - Full CLI reference, configuration guide, API docs

Support

ChannelFor
GitHub DiscussionsQuestions, ideas, community help
[email protected]Direct support (paid tiers)
[email protected]Pricing and licensing

License

Proprietary. Free tier available forever with no credit card required.

Source: README.md at commit 019e929

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.0LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.