Sentinel Local
Sentinel Local is an open-source, privately hosted endpoint security dashboard that brings Windows Defender status, process-attributed network connections and bounded Wi-Fi checks into one view, and can explain anonymised security indicators using a local Ollama model.
- Local endpoint security monitor and Windows Defender dashboard. Private connection and Wi-Fi checks, optional local AI review, optional ClamAV scans.
- Python
- Anyone who wants to understand their machine's protection without a security subscription
- Developers curious which process is holding a connection and to where
- People who want AI help reading an alert without sending host data to a cloud service
- Linux and macOS users wanting a ClamAV front-end scoped to folders they choose
- Python 3.11+ (source install) or a packaged x64 executable
- psutil 7.2.2 for the portable .pyz
- Windows 10/11 with Defender, or Linux with iproute2
- Ollama with a downloaded model (optional — for local AI review)
- ClamAV (optional — for folder scans on Linux and macOS)
Overview
Protection settings on a desktop are scattered across half a dozen panels, and the alerts that surface rarely explain themselves. Sentinel Local gathers what the operating system already knows — Defender state, firewall status, scan history, which process holds which TCP connection, what the Wi-Fi interface reports — and puts it in one loopback dashboard. Where an indicator needs interpreting, it can hand anonymised flags to a local Ollama model rather than a cloud service. It observes and advises; Defender and your configured OS protections remain the things that actually block malware.
What it does
- One dashboard for Defender status, firewall state, scan history and collection health
- Sampled, process-attributed TCP connections so an unexplained connection has a name against it
- Bounded Wi-Fi review — reported encryption plus local-device and router port checks, confined to the local /24
- Local AI review through Ollama on anonymised indicator flags, with no file contents or paths in the prompt
- Optional on-demand scans — Defender quick and full on Windows, ClamAV on explicitly chosen folders elsewhere
- Failures, missing permissions and skipped coverage stay visible rather than reading as a clean result
- Loopback-only dashboard with a per-instance token, Host/Origin checks and a restrictive CSP
Quickstart
Install from source
The helper creates the project's .venv, installs the pinned psutil wheel, verifies it and opens the dashboard.
git clone https://github.com/dibyapp/sentinel-local.git
cd sentinel-local
python tools/setup.py --openLinux and macOS
Use python3; some distributions need their Python venv package first.
python3 tools/setup.py --openTest a local AI connection
Uses fictional evidence, collects no host observations and never changes findings.
python app.py --ai-check ollama --ai-model your-downloaded-modelRun a local AI review
python app.py --ai-review ollama --ai-model your-downloaded-modelWhat it helps with, and where each check stops
The project is unusually direct about the limits of each signal, which is the right instinct for security tooling — a monitor that overstates its coverage is worse than no monitor, because it manufactures confidence.
| What it does | Where the coverage ends |
|---|---|
Shows Defender, firewall, scan history and collection health | Only the sources the OS exposes |
Reviews anonymous indicator flags with a local model | No file-content classification, no clean-PC guarantee |
Displays sampled process-attributed TCP connections | Short-lived activity and UDP can be missed |
Reviews reported Wi-Fi encryption and local devices | No firmware, passwords or packet capture |
Keeps failures and skipped coverage distinct | A completed scan is not exhaustive detection |
Local AI review without sending your machine anywhere
The useful thing an LLM can do here is explain an indicator in plain language. The dangerous thing would be shipping host telemetry to a third party to get it. Sentinel separates those: the prompt carries anonymised indicator flags, and explicitly excludes executable names, file contents, command lines, personal paths, network addresses, Wi-Fi names, raw logs and tokens.
Ollama is the tested path and keeps everything on the machine. Restricted Codex, Claude Code and Gemini CLI adapters exist as opt-in alternatives, and any cloud review requires an evidence preview and explicit consent first. A connection test runs against fictional evidence, so you can verify the wiring without collecting anything real.
No model downloads, silent provider fallback, security-setting changes or AI-generated commands execute as a result of a review.
How to read a connection alert
The evidence rule flags twenty or more simultaneous public TCP connections for review. A busy browser or an AI tool can cross that line during entirely normal use, and the project says so rather than letting the number imply something it does not.
A separate statistical model learns from twenty successful samples and flags deviations from that baseline. Neither rule establishes a malicious destination, data theft or infection — and initial learning is not known-clean, so existing behaviour can be absorbed into the baseline it is measured against.
The phrase the dashboard uses is deliberately narrow: no current issues in available checks describes the checks performed, not every file on the computer.
Platform support and what is still beta
Windows 10/11 with Defender is the most complete path: native PowerShell reads for protection, process, TCP and Wi-Fi state, plus Defender quick and full scans. The x64 beta executable is locally validated and unsigned — signing is a consumer-release gate the project has not passed yet.
Linux uses psutil, iproute2 and optional NetworkManager and firewall tools, with ClamAV folder scans; the x64 build is checked on Ubuntu under WSL, which normally has no physical Wi-Fi interface, so network validation there is still pending. macOS is experimental, and ARM64 build workflows exist but are not validated.
Treat it as a desktop beta observing your system, not as a certified antivirus engine replacing one.
What is Sentinel Local?
Sentinel Local is an open-source endpoint security monitor that shows Windows Defender status, firewall state, process-attributed network connections and Wi-Fi checks in one private dashboard. It can use a local Ollama model to explain anonymised indicators. Core monitoring needs no account or cloud subscription.
Does it replace my antivirus?
No. Microsoft Defender and your separately configured OS protections handle malware blocking. Sentinel provides observations and advisory analysis, and it is not an independently certified antivirus engine.
Does it send my data to the cloud?
Not by default. The dashboard binds to IPv4 loopback with a per-instance token, nothing is exported or uploaded automatically, and the local Ollama path keeps review on your machine. Cloud review is opt-in, requires an evidence preview and explicit consent, and the prompt excludes file contents, paths, addresses, Wi-Fi names, logs and tokens.
Why did it flag my connections when nothing is wrong?
The rule flags twenty or more simultaneous public TCP connections for review, and a busy browser or AI tool can meet that threshold in normal use. It is a prompt to look, not evidence of a malicious destination or an infection.
Which platforms are supported?
Windows 10/11 with Defender and Linux x64 have local validation. macOS source support is experimental pending native validation, and ARM64 build workflows are prepared but not yet validated. Android, iOS, BSD and embedded platforms need separate designs.