sentrik
什么是 Sentrik?
Sentrik 是一个 CLI + 仪表盘,可在每次提交时强制执行编码标准、合规规则和安全策略。专为使用 AI 编码代理(Claude Code、Cursor、Copilot)的团队打造,在这些团队中,代码生成的速度远超人工审查的速度。
问题: AI 代理编写的代码可以运行,但可能违反安全策略、合规要求或架构标准。直到审计时才会被发现。
解决方案: Sentrik 根据监管标准(OWASP、SOC 2、HIPAA、PCI-DSS、FDA IEC 62304 等)扫描每次变更,拦截未通过的 PR,并生成可直接用于审计的证据。
Related MCP server: DevStandards MCP Server
安装
pip install sentrik安装后立即可用免费层级——6 个标准包、193 条规则,无需许可证密钥或注册。付费层级可通过 hello@sentrik.dev 获取许可证密钥激活。
快速开始
# 1. Initialize your project (auto-detects language, frameworks, CI)
sentrik init
# 2. Scan your code
sentrik scan
# 3. Enforce the gate in CI (exit 1 on failure)
sentrik gate
# 4. Launch the dashboard
sentrik dashboard免费层级(永久免费,无需信用卡)
Sentrik 免费包含 6 个标准包、193 条规则:
标准包 | 规则数 | 检测内容 |
OWASP Top 10 | 69 | SQL 注入、XSS、认证缺陷、SSRF 等 |
SOC 2 | 30 | 安全与可用性的信任服务标准 |
Python Security | 18 | eval/exec、pickle、subprocess、Django/Flask 漏洞 |
Go Security | 15 | 注入、加密误用、unsafe、并发缺陷 |
Supply Chain Security | 26 | SLSA、SBOM、依赖完整性、AI 工具供应链 |
C/C++ Coding Standards | 35 | 现代 C/C++ 安全与防护实践 |
此外,所有层级均内置以下命令:
sentrik scan/sentrik gate- 扫描与强制执行sentrik vulns- 依赖漏洞扫描(CVE)sentrik sbom- 软件物料清单sentrik secrets- 硬编码密钥检测sentrik dashboard- 包含发现、图表和报告的 Web 界面sentrik threat-model- STRIDE 威胁分析sentrik quality-score- 代码质量评分(0-100)
付费层级
免费 | 团队 | 组织 | |
标准包 | 6(193 条规则) | 18(475 条规则) | 24(595 条规则) |
OWASP、SOC 2、Supply Chain、C/C++ | 是 | 是 | 是 |
HIPAA、PCI-DSS、ISO 27001、GDPR | - | 是 | 是 |
FDA IEC 62304、NIST、CMMC、Cloud IaC | - | 是 | 是 |
MISRA-C、DO-178C、ISO 26262 | - | - | 是 |
漏洞扫描 | 是 | 是 | 是 |
仪表盘 | 是 | 是 | 是 |
工作项对账 | - | 是 | 是 |
自定义规则包 | 5 | 25 | 100 |
并行扫描 | - | - | 是 |
治理与审计日志 | - | - | 是 |
付费层级可通过联系 hello@sentrik.dev 获取——请参阅 sentrik.dev/pricing。
CI/CD 集成
GitHub Actions(Marketplace)
# .github/workflows/sentrik.yml
name: Sentrik Gate
on: [pull_request]
jobs:
gate:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: maxgerhardson/sentrik-community@v1就这样——一行即可。该操作会自动检测 PR 上下文、运行把关、将 SARIF 上传到 GitHub Code Scanning,并将发现报告作为工件附加。
带选项:
- uses: maxgerhardson/sentrik-community@v1
with:
packs: "owasp-top-10,soc2,supply-chain-security"
fail-on: "critical,high"
license-key: ${{ secrets.SENTRIK_LICENSE_KEY }}使用输出:
- uses: maxgerhardson/sentrik-community@v1
id: sentrik
- run: echo "Found ${{ steps.sentrik.outputs.findings-count }} findings"
if: always()GitLab CI
sentrik:
image: maxgerhardson/sentrik:latest
script:
- sentrik gate --git-range "origin/main...HEAD"
rules:
- if: $CI_PIPELINE_SOURCE == "merge_request_event"Azure Pipelines
- script: |
pip install sentrik
sentrik gate --git-range "origin/main...HEAD"
displayName: Sentrik GateAI 代理集成
Sentrik 可作为 AI 编码代理的 MCP 服务器运行:
# Start MCP server for Claude Code, Cursor, VS Code
sentrik mcp-serverMCP 服务器让 AI 代理能够实时访问合规规则、扫描结果和修复指导——使它们从一开始就编写合规代码。
示例配置
入门(Web 应用)
# .sentrik/config.yaml
standards_packs:
- owasp-top-10
- supply-chain-security
gate:
fail_on:
- critical
- high医疗保健 / 医疗器械
standards_packs:
- owasp-top-10
- hipaa
- fda-iec-62304
- supply-chain-security
gate:
fail_on:
- critical
- high
- medium金融科技
standards_packs:
- owasp-top-10
- pci-dss
- soc2
- supply-chain-security
gate:
fail_on:
- critical
- high政府 / 国防
standards_packs:
- owasp-top-10
- nist-800-53
- cmmc
- supply-chain-security
gate:
fail_on:
- critical
- high
- medium社区
支持
渠道 | 用途 |
问题、想法、社区帮助 | |
直接支持(付费层级) | |
定价与许可 |
许可证
专有软件。免费层级永久可用,无需信用卡。
This server cannot be installed
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Servers
- FlicenseAqualityDmaintenanceProvides real-time policy enforcement for AI coding agents by intercepting and validating their actions against organizational standards like naming conventions, security policies, and compliance rules before execution. Prevents violations through immediate feedback and auto-correction suggestions.5
- FlicenseNot gradedqualityNot gradedmaintenanceProvides AI agents with access to 284+ development best practices, security guidelines, and coding standards across multiple languages and frameworks including comprehensive Drupal standards and OWASP Top 10 vulnerabilities.2
- AlicenseNot gradedqualityCmaintenanceTransforms static coding standards into a queryable live data store for AI agents, delivering task-specific rules and fix guidance on demand. This optimizes context window usage through progressive disclosure, ensuring agents apply relevant governance without loading massive documentation.2MIT
- AlicenseNot gradedqualityBmaintenanceIntegrates authoritative security compliance frameworks (ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF) into AI-assisted development, offering control lookups, cross-framework mappings, build-time guardrails, and automated audit evidence generation.1693MIT
Related MCP Connectors
Threat modeling, code/cloud/pipeline scanning, shadow-AI discovery, compliance checks and fixes.
Pay-per-call cybersecurity for AI agents: vuln scans, threat intel, compliance, code security.
Zero-install security baseline for AI coding agents — OWASP/CWE-cited rules over MCP.
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/maxgerhardson/sentrik-community'
If you have feedback or need assistance with the MCP directory API, please join our Discord server