Skip to main content
Glama

什么是 Sentrik?

Sentrik 是一个 CLI + 仪表盘,可在每次提交时强制执行编码标准、合规规则和安全策略。专为使用 AI 编码代理(Claude Code、Cursor、Copilot)的团队打造,在这些团队中,代码生成的速度远超人工审查的速度。

问题: AI 代理编写的代码可以运行,但可能违反安全策略、合规要求或架构标准。直到审计时才会被发现。

解决方案: Sentrik 根据监管标准(OWASP、SOC 2、HIPAA、PCI-DSS、FDA IEC 62304 等)扫描每次变更,拦截未通过的 PR,并生成可直接用于审计的证据。

Related MCP server: DevStandards MCP Server

安装

pip install sentrik

安装后立即可用免费层级——6 个标准包、193 条规则,无需许可证密钥或注册。付费层级可通过 hello@sentrik.dev 获取许可证密钥激活。

快速开始

# 1. Initialize your project (auto-detects language, frameworks, CI)
sentrik init

# 2. Scan your code
sentrik scan

# 3. Enforce the gate in CI (exit 1 on failure)
sentrik gate

# 4. Launch the dashboard
sentrik dashboard

免费层级(永久免费,无需信用卡)

Sentrik 免费包含 6 个标准包193 条规则

标准包

规则数

检测内容

OWASP Top 10

69

SQL 注入、XSS、认证缺陷、SSRF 等

SOC 2

30

安全与可用性的信任服务标准

Python Security

18

eval/exec、pickle、subprocess、Django/Flask 漏洞

Go Security

15

注入、加密误用、unsafe、并发缺陷

Supply Chain Security

26

SLSA、SBOM、依赖完整性、AI 工具供应链

C/C++ Coding Standards

35

现代 C/C++ 安全与防护实践

此外,所有层级均内置以下命令:

  • sentrik scan / sentrik gate - 扫描与强制执行

  • sentrik vulns - 依赖漏洞扫描(CVE)

  • sentrik sbom - 软件物料清单

  • sentrik secrets - 硬编码密钥检测

  • sentrik dashboard - 包含发现、图表和报告的 Web 界面

  • sentrik threat-model - STRIDE 威胁分析

  • sentrik quality-score - 代码质量评分(0-100)

付费层级

免费

团队

组织

标准包

6(193 条规则)

18(475 条规则)

24(595 条规则)

OWASP、SOC 2、Supply Chain、C/C++

HIPAA、PCI-DSS、ISO 27001、GDPR

-

FDA IEC 62304、NIST、CMMC、Cloud IaC

-

MISRA-C、DO-178C、ISO 26262

-

-

漏洞扫描

仪表盘

工作项对账

-

自定义规则包

5

25

100

并行扫描

-

-

治理与审计日志

-

-

付费层级可通过联系 hello@sentrik.dev 获取——请参阅 sentrik.dev/pricing

CI/CD 集成

GitHub Actions(Marketplace)

# .github/workflows/sentrik.yml
name: Sentrik Gate
on: [pull_request]
jobs:
  gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: maxgerhardson/sentrik-community@v1

就这样——一行即可。该操作会自动检测 PR 上下文、运行把关、将 SARIF 上传到 GitHub Code Scanning,并将发现报告作为工件附加。

带选项:

      - uses: maxgerhardson/sentrik-community@v1
        with:
          packs: "owasp-top-10,soc2,supply-chain-security"
          fail-on: "critical,high"
          license-key: ${{ secrets.SENTRIK_LICENSE_KEY }}

使用输出:

      - uses: maxgerhardson/sentrik-community@v1
        id: sentrik
      - run: echo "Found ${{ steps.sentrik.outputs.findings-count }} findings"
        if: always()

GitLab CI

sentrik:
  image: maxgerhardson/sentrik:latest
  script:
    - sentrik gate --git-range "origin/main...HEAD"
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

Azure Pipelines

- script: |
    pip install sentrik
    sentrik gate --git-range "origin/main...HEAD"
  displayName: Sentrik Gate

AI 代理集成

Sentrik 可作为 AI 编码代理的 MCP 服务器运行:

# Start MCP server for Claude Code, Cursor, VS Code
sentrik mcp-server

MCP 服务器让 AI 代理能够实时访问合规规则、扫描结果和修复指导——使它们从一开始就编写合规代码。

示例配置

入门(Web 应用)

# .sentrik/config.yaml
standards_packs:
  - owasp-top-10
  - supply-chain-security
gate:
  fail_on:
    - critical
    - high

医疗保健 / 医疗器械

standards_packs:
  - owasp-top-10
  - hipaa
  - fda-iec-62304
  - supply-chain-security
gate:
  fail_on:
    - critical
    - high
    - medium

金融科技

standards_packs:
  - owasp-top-10
  - pci-dss
  - soc2
  - supply-chain-security
gate:
  fail_on:
    - critical
    - high

政府 / 国防

standards_packs:
  - owasp-top-10
  - nist-800-53
  - cmmc
  - supply-chain-security
gate:
  fail_on:
    - critical
    - high
    - medium

社区

  • 讨论 - 提问、分享技巧、展示你的成果

  • 问题 - 报告缺陷或请求功能

  • 文档 - 完整的 CLI 参考、配置指南、API 文档

支持

渠道

用途

GitHub Discussions

问题、想法、社区帮助

support@sentrik.dev

直接支持(付费层级)

sales@sentrik.dev

定价与许可

许可证

专有软件。免费层级永久可用,无需信用卡。

F
license - not found
Not graded
quality - not tested
B
maintenance

Maintenance

UpdatingMaintainers
UpdatingResponse time
3wRelease cycle
6Releases (12mo)
Commit activity

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Servers

  • F
    license
    A
    quality
    D
    maintenance
    Provides real-time policy enforcement for AI coding agents by intercepting and validating their actions against organizational standards like naming conventions, security policies, and compliance rules before execution. Prevents violations through immediate feedback and auto-correction suggestions.
    5
  • A
    license
    Not graded
    quality
    C
    maintenance
    Transforms static coding standards into a queryable live data store for AI agents, delivering task-specific rules and fix guidance on demand. This optimizes context window usage through progressive disclosure, ensuring agents apply relevant governance without loading massive documentation.
    2
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Integrates authoritative security compliance frameworks (ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF) into AI-assisted development, offering control lookups, cross-framework mappings, build-time guardrails, and automated audit evidence generation.
    169
    3
    MIT

View all related MCP servers

Related MCP Connectors

  • Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.

  • Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.

  • Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.

View all MCP Connectors

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/maxgerhardson/sentrik-community'

If you have feedback or need assistance with the MCP directory API, please join our Discord server