Sentinel

An open-source Claude Code companion: a tray app and bundled local daemon for in-flight security scanning, permission rules, and sandbox isolation; multi-account routing; token-cost optimization; usage metrics; and overage alerts.

Website: https://intevity.github.io/sentinel · Documentation: https://intevity.github.io/sentinel/docs/

---

Table of contents

• What it is
• Download
• Quick start
• Documentation
• Features
• Security
• Building from source
• Contributing
• License

What it is

Sentinel sits transparently between Claude Code and Anthropic's API. Activate it once and every Claude request flows through a local daemon that can scan and sandbox it, enforce permission rules, route across the Claude accounts you own, trim wasted tokens, and catch overage spend — all on your machine, with no telemetry and credentials kept in your OS keychain.

It covers both surfaces: the Claude Code CLI (terminal) and the Claude Desktop app (Chat + Code). Sentinel detects whichever you have installed — including the second one you add later — and routes each through the proxy with a single click.

Claude Code CLI  ─┐
                  ├─→  127.0.0.1:47284  ──→  api.anthropic.com
Claude Desktop   ─┘   (sentinel daemon)
                            │
                            │  Unix socket / named pipe
                            ▼
                      Sentinel App (Tauri v2 tray app)

• App (packages/app) — a Tauri v2 tray app that bundles and supervises the daemon, patches ~/.claude/settings.json for the CLI, and writes the desktop app's Claude-3p gateway config on activation.
• Daemon (packages/daemon) — a Node.js reverse proxy, OTLP telemetry receiver, MCP server, and SQLite store, compiled into a single binary embedded in the app.

See the Architecture guide for the full picture.

Download

Grab the latest installer from the Releases page, or pick your platform:

Platform	Format	Download
macOS — Apple Silicon (M1/M2/M3/M4/M5)	.dmg	Latest release
macOS — Intel	.dmg	Latest release
Windows 10/11	.msi / NSIS	Latest release
Linux (Debian/Ubuntu)	.deb	Latest release
Linux (Fedora/RHEL)	.rpm	Latest release
Linux (portable)	.AppImage	Latest release

macOS release builds are signed with a Developer ID certificate and notarized by Apple, so they open with a normal double-click. Full per-OS steps (including Linux system libraries) are in the Installation guide.

Quick start

1. Install and launch Sentinel — the tray icon appears and the daemon starts automatically.
2. Click "Activate Sentinel" to point the Claude Code CLI at the proxy (writes ANTHROPIC_BASE_URL=http://127.0.0.1:47284 into ~/.claude/settings.json), then restart Claude Code.
3. (If you use the Claude Desktop app) Click Enable on the Claude Desktop card to route it too, then fully quit and reopen the desktop app. See Connect Claude Desktop.
4. Add Account and complete the OAuth flow for each Claude subscription you own.
5. (Optional) Turn on Auto switching in Settings to route across accounts automatically.

The full walkthrough is in the Quick start guide.

Documentation

Complete documentation lives at https://intevity.github.io/sentinel/docs/ — for end users and developers alike:

• Getting started — install, first launch, quick start.
• Features — a page for everything Sentinel does.
• Guides — task-oriented how-tos.
• Reference — settings, troubleshooting, privacy.
• Developers — architecture, building, testing, releases.

The docs are built with Astro Starlight and live in packages/site/src/content/docs/.

Features

• Security scanning — in-flight detectors for secrets, PII, prompt injection, and risky tool use, with observe/block modes and an approve/deny hold.
• Permission rules — allow/deny/ask rules kept in lockstep with Claude Code's settings.json.
• Sandbox isolation — optional OS-level limits on the files and domains Claude Code's commands can reach.
• Multi-account routing — enroll the Claude accounts you own; switch manually or let Auto mode favor the window that resets soonest.
• Token optimization — curated cheaper subagents, reversible payload compression, and MCP code execution.
• Usage, metrics, and overage alerts — real cost/token telemetry, rate-limit windows, spend caps, and threshold notifications.

Security

• The proxy listens only on 127.0.0.1:47284 — never exposed to the network.
• Inactive-account credentials are stored by the OS credential store: Keychain on macOS and libsecret on Linux, both under the service name Sentinel-credentials. Windows has no usable in-box Credential Manager CLI, so Sentinel keeps a single DPAPI-encrypted file at ~/.sentinel/credentials.dat — readable only by the signed-in user account.
• The daemon never logs credential values; security findings store redacted fingerprints only.
• The IPC socket is created with 0600 permissions; ~/.claude.json and ~/.claude/settings.json writes use atomic rename.
• There is no telemetry.

Full details: Privacy & security model.

Building from source

git clone https://github.com/Intevity/sentinel
cd sentinel
pnpm install
pnpm build:app        # build + launch your local changes (unsigned), any OS

Prerequisites (pnpm 9+, Rust stable, Node 24+, platform toolchains) and the full dev loop — including the daemon-only fast path and the signed release build — are documented in Building from source.

Contributing

Contributions are welcome. Run pnpm typecheck, pnpm lint, and pnpm test before opening a PR, and write commits in the enforced conventional-commit format (release notes are generated from them). See the Contributing guide and CLAUDE.md for the development reference.

License

MIT © Intevity