⬡ SentriAI

Local endpoint security monitoring and response — privacy-first, human-in-the-loop.

SentriAI is an open-source endpoint security agent written in Go. It runs silently on your machine, monitors system behaviour (CPU, memory, processes, and eventually network traffic and logs), and surfaces anomalies through a local web dashboard. No cloud. No telemetry. Your data stays on your machine.

Built with a clear philosophy: you are always in control. The system alerts, you decide.

---

Why SentriAI?

Enterprise EDR (Endpoint Detection & Response) tools cost thousands per machine per year. Most are black boxes. SentriAI is the open-source alternative — transparent, lightweight, and designed to be understood, not just installed.

Long-term vision: a full endpoint security platform with AI-assisted analysis, n8n alerting pipelines, and a central server for multi-machine monitoring. v0.1 is the foundation.

---

Current Status

Version	Status	What's In
v0.1.0	🟢 Active	Local agent, CPU/memory/battery monitoring, process tracking, heuristic alerts, local dashboard
v0.2.0	🔵 Planned	Process kill API, config file, FastAPI central server, Tailscale cross-machine
v0.3.0	🔵 Planned	SQLite event buffer, baseline profiling, statistical anomaly detection
v0.4.0	🔵 Planned	n8n alerting (Slack/email), TimescaleDB, multi-machine dashboard
v0.5.0+	🔵 Planned	ML-based anomaly detection, AutoGen incident report writer

---

Architecture (v0.1)

[Go Agent — your local machine]
        │
        │  collects metrics every 5 seconds
        │  serves HTTP on localhost:8080
        ▼
[Built-in web server]
        │
        ▼
[Local Dashboard — browser]
    CPU / Memory / Battery
    Top processes by CPU
    Heuristic alert engine
    Human-in-loop: you confirm before any action

Everything in v0.1 is local. No external server. No Docker required.

---

Features (v0.1)

• Real-time metrics — CPU usage, memory, battery, updated every 5 seconds
• Process monitoring — top 5 processes by CPU consumption
• Heuristic alert engine — configurable thresholds (warning at 80%, critical at 95%)
• Human-in-the-loop — no auto-kill, no autonomous actions; you confirm everything
• Cross-platform — works on Windows and Linux from a single Go binary
• Lightweight — minimal RAM footprint, no runtime dependencies, single binary

---

Getting Started

Prerequisites

• Go 1.22+ → go.dev/dl

Run in Development

git clone https://github.com/aaryam/sentriai.git
cd sentriai/agent
go mod tidy
go run main.go

Open your browser at: http://localhost:8080

Build a Binary

cd agent

# Linux / WSL2
go build -o sentriai-agent .

# Windows (cross-compile from Linux/WSL2)
GOOS=windows GOARCH=amd64 go build -o sentriai-agent.exe .

# macOS
GOOS=darwin GOARCH=amd64 go build -o sentriai-agent-mac .

Run the binary directly — no installer, no dependencies:

./sentriai-agent
# then open http://localhost:8080

---

Project Structure

sentriai/
├── agent/
│   ├── main.go              # Go agent — metrics + HTTP server + alert engine
│   ├── go.mod
│   ├── go.sum
│   └── dashboard/
│       └── index.html       # Local web dashboard
├── server/                  # FastAPI central server (v0.2, coming)
├── docs/                    # Architecture notes and decision logs
├── AGENTS.md                # Context file for AI coding agents
├── CHANGELOG.md
├── .gitignore
├── LICENSE
└── README.md

---

API (v0.1)

Method	Endpoint	Description
GET	/	Dashboard UI
GET	/api/metrics	System metrics as JSON
GET	/api/health	{"status":"ok","version":"0.1.0"}

Planned for v0.2:

• POST /api/kill?pid=X — terminate a process (user-confirmed only)
• POST /api/config — runtime config updates

---

Alert Thresholds

Heuristic baseline rules — not ML. Intentionally conservative to reduce false positives.

Metric	Warning	Critical
System CPU	≥ 80%	≥ 95%
Memory	≥ 80%	≥ 90%
Per-process CPU	—	≥ 95%

Context-aware detection (learning your machine's normal behaviour) is planned for v0.3.

---

Roadmap

• CPU, memory, battery collection (cross-platform)
• Real-time local dashboard
• Top-5 process monitor
• Heuristic alert engine
• Human-in-loop confirm modal
• /api/kill process termination endpoint (v0.2)
• Agent config file — YAML (v0.2)
• FastAPI central server (v0.2)
• Cross-machine support via Tailscale (v0.2)
• SQLite local event buffer (v0.3)
• Baseline anomaly detection — Z-score / Isolation Forest (v0.3)
• n8n alerting integration — Slack, email, webhook (v0.4)
• TimescaleDB time-series storage (v0.4)
• Windows Service + systemd daemon installers (v0.4)
• ML-based anomaly detection (v0.5)
• AutoGen incident report writer (v0.5)

---

Tech Stack

Layer	Technology
Agent	Go 1.22+
System metrics	gopsutil v3
Dashboard	Vanilla HTML + Chart.js
Server (v0.2)	FastAPI (Python)
Database (v0.4)	TimescaleDB
Alerting (v0.4)	n8n
Cross-machine testing	Tailscale

---

Design Philosophy

Sovereignty — Your machine's data stays on your machine. No telemetry, no cloud dependency.

Transparency — Open source, AGPL-3.0. You can read every line of code that runs on your system.

Human-in-the-loop — The agent alerts. You act. No autonomous destructive operations, ever.

---

License

AGPL-3.0 — see LICENSE.

Free for personal, educational, and research use. If you build a commercial product or SaaS on top of SentriAI, you must open-source your modifications under AGPL or obtain a commercial license.

---

Author

Built by Aarya (@Aaryam-7d6) — philosopher-engineer in progress.

"Accept or admit thyself as it is. Forgive thyself if necessary and be progressive towards it."