Sentinel

An autonomous DevSecOps agent that uses GitLab Orbit context to actively defend your pipeline.

Comment

Inspiration

Alert fatigue is the bane of DevSecOps. Traditional static analysis (SAST) tools lack context, spamming developers with thousands of false positives until the alerts are entirely ignored. While AI agents promise to fix this, Large Language Models (LLMs) inherently struggle when analyzing a single code diff in isolation—they simply don't know the wider architecture.

We realized that to build a truly autonomous security agent, we needed to give it a global memory. We were inspired by the potential of GitLab Orbit. By giving our AI the ability to query the structured, global context of the entire repository, we could transform a noisy linter into a highly accurate, context-aware digital teammate that only barks when there is a real fire.

What it does

Sentinel is an autonomous, 4-pillar DevSecOps architecture built to intercept, analyze, and neutralize threats before they ever hit production.

  1. Intelligent Detection Engine: A hybrid pipeline that scans for Secrets, IaC flaws, and Supply Chain attacks. It uses local, high-speed heuristics as a first pass, then escalates complex logic to Gemini for deep analysis.
  2. Automated Active Defense: If a critical threat (like an exposed GCP key) is detected, Sentinel doesn't just alert—it triggers a "Kill-Switch" to surgically revoke access in the cloud provider. It also invokes The Lorax & The Accountant to calculate the estimated financial and carbon-emission blast radius of a potential crypto-mining hijacking.
  3. Autonomous Remediation: Via The Alchemist, Sentinel actively rewrites vulnerable code (e.g., swapping hardcoded credentials for os.environ.get()) and offers the secure refactor back to the developer instantly.
  4. SecOps Operations Loop: A robust orchestrator that supports "Time Machine" historic scanning and the deployment of Honeytokens (Traps) to catch internal snooping.

How we built it

Sentinel is orchestrated entirely in Python, running natively inside GitLab CI pipelines.

At its core is The Orbit Lens. When Sentinel detects a suspicious newly exposed port or dependency in a Merge Request, it queries GitLab Orbit for global repository context. For example, the AI asks Orbit: "Has this specific package been used in other microservices in this repo?" or "Is port 8080 historically bound to internal testing services here?" Orbit provides the factual bedrock that grounds Gemini's decision-making.

For the AI brain, we integrated the Google Gemini API, building a highly resilient Failover Cascade that automatically routes requests through gemini-2.5-flash, gemini-2.5-flash-lite, and gemini-1.5-flash depending on quota limits and availability, ensuring the pipeline never fails open.

Challenges we ran into

  1. AI Latency & Quota Bottlenecks: Running LLMs on every single commit diff is expensive and slow. We solved this by building a hybrid architecture. We implemented The Bloodhound—a local Shannon Entropy scanner using complex mathematical heuristics (calculating character classes and bits of entropy) to filter out obvious non-secrets before ever making a network call to Gemini.
  2. Contextual Hallucinations: Early iterations of the agent kept flagging internal, safe test-dependencies as "Supply Chain Attacks." Integrating GitLab Orbit was the breakthrough challenge that solved this, requiring us to build dynamic prompt structures that injected Orbit's context directly into the Gemini instructions.
  3. Cross-Platform Execution: We encountered severe UnicodeEncodeError crashes on Windows runners due to our rich, emoji-heavy terminal output. We had to architect low-level sys.stdout UTF-8 reconfigurations to ensure our security logs remained beautiful and readable across all operating systems.

Accomplishments that we're proud of

We are incredibly proud of successfully merging deterministic mathematics (Shannon Entropy) with probabilistic AI (Gemini) and structured context (GitLab Orbit).

We're also uniquely proud of The Lorax feature. Cybersecurity is rarely framed as an environmental issue. By calculating the carbon footprint (\text{kgCO}_2\text{e}) of a rogue GPU cluster spun up by an attacker using a leaked credential, we are helping organizations understand the devastating environmental impact of poor security hygiene.

What we learned

Context is everything. We learned firsthand that an LLM without structured architectural context is just an expensive, slow regular expression. By utilizing GitLab Orbit, we learned how to bridge the gap between "dumb" code diffs and true architectural awareness. We also gained deep experience in building fault-tolerant API orchestrators that gracefully handle rate limits in high-throughput CI/CD environments.

What's next for Sentinel

We plan to expand Sentinel's capabilities far beyond the CI/CD pipeline.

  • Full ChatOps Integration: Hooking the orchestrator into Slack/Discord so SecOps teams can manually query Orbit and trigger the Kill-Switch from their phones.
  • Blast Radius Mapping: Using Orbit to not just analyze the current repo, but to trace the blast radius of a vulnerable dependency across an entire organization's ecosystem of microservices.
  • MR Generation: Upgrading The Alchemist from just suggesting code to actually using the GitLab API to automatically open a remediation Merge Request.

Built With

Share this project:

Updates