An early-warning system for the dependencies you stopped watching.

Point it at a directory and it finds every project underneath, stopping at each project root so a monorepo counts once rather than fifty times. .gitignore and .sentinelloignore are honoured.

Resolves the exact installed versions from the lockfile and matches them offline against a local advisory cache. No per-project network call, and nothing about your code is uploaded.

A dated markdown file with the findings and a remediation prompt attached — triage before touching anything, prefer parent upgrades over overrides, verify fixes in the lockfile.

• GitLab gemnasium failed to download on 3.0.0 with `HTTP 406`, for everyone. Node’s built-in fetch attaches a `Sec-Fetch-Mode: cors` header that a program is not permitted to remove, and GitLab refuses any repository archive request carrying it — so this was never about your network, your IP, or how many times you retried. The download uses a plain HTTPS request now, and succeeds
• The archive is fetched by commit id rather than by branch name, so everyone updating from the same upstream commit shares one cached copy instead of each asking GitLab to build a fresh 60 MB archive. A first download that took nearly seven minutes now finishes in seconds
• The CLI used to finish its entire run — advisory written, summary printed — and then never return the terminal. The connection carrying the download was left open behind it, which kept the process alive; it is now closed as soon as the archive has been read
• A feed that refuses a download no longer stalls for three minutes before saying so. It reports in seconds and, in a terminal, offers to try again — retrying only the source that actually failed
• `--fail-on` is honest in both directions. It refuses a run whose advisory source could not be consulted, rather than reporting a clean scan it never performed; and it no longer fails a run over a source you switched off yourself with `SENTINELLO_OSV_FEED_URL=off` or `SENTINELLO_GEMNASIUM_FEED_URL=off` and never downloaded

• The scanners ship as a CLI on npm. `npx sentinello` walks a folder, finds every project underneath, checks them against npm audit, OSV and GitLab gemnasium, and writes a markdown advisory with a remediation prompt attached — no install, no account, no database, and nothing about your code leaves the machine
• Piped, the advisory is the only thing on stdout, so `npx sentinello | claude -p "$(cat -)"` hands an agent a complete work list without anything corrupting the document
• A first run no longer loses the gemnasium source to a refused download. GitLab declines its archive for a minute or two at a time, and the old retry gave up after thirteen seconds; the CLI now waits it out, says why it is waiting, and takes `--feed-wait` if the default of three minutes is wrong for you
• Both download estimates were measured rather than guessed: the OSV npm export is quoted at 204 MB rather than 196, and the gemnasium archive at 52 MB rather than 80. The consent prompt marks an estimate with a tilde so it is never mistaken for a size the server reported
• A value that looks like a flag is now rejected instead of taken literally — `--out --` used to write an advisory to a file named `--` inside your project and report success
• The What’s new panel no longer runs off the bottom of the window when a release has a lot to say

• get_project_advisory now returns the advisory document itself. Connected clients previously received only its metadata — a filename and a count — and never the document, despite the tool describing it as a complete work list
• The advisory export now holds one entry per distinct advisory with its sources merged, instead of one per scanner row: a vulnerability that npm audit and OSV both report is a single work item carrying both advisory IDs, not two near-identical ones. This applies to the portal’s Download .md as well, and the count now matches the dashboard
• A project too large to fit in one MCP response is now paginated — the document states that it is incomplete and gives the exact follow-up call to fetch the rest, instead of being silently cut off where an agent would read the remainder as clean
• Every input on every MCP tool now carries a description, and a new list_mutes tool exposes the mute IDs that unmute needs — previously obtainable only by creating the mute in the same session
• Fixed a gap in the severity counts: a finding whose severity was not one of the five known values was counted as a finding but placed in no severity bucket, so a project whose only finding had one appeared completely clean

• Connected MCP clients can pull a project’s full Markdown advisory with the new get_project_advisory tool — the same document as the portal’s Download .md, without copying it out of the browser
• Muted findings are now excluded from the project advisory export, so an agent is never handed work whose risk you have already accepted
• Note: because the advisory contains your export prompt, an MCP client can now read whatever you have written in Settings → Export

• Dropdowns, the dependency-path popover, and the advisory export menu no longer get clipped by the table or dialog they sit in — they render above the page and flip above the trigger when there is no room below
• The default advisory-export prompt now asks the agent to plan before editing anything, group findings that share a single fix, and spell out the code impact of each version bump — and it targets zero findings while ruling out the shortcuts to a fake zero: muting, widening ranges, or narrowing the scan, with anything genuinely unfixable listed in a dated residual table

• The git branch a project was scanned on now has a column of its own in the project list — plain text, no icon — instead of sitting under the project name

• Restarting the container no longer kills a scan that is midway through writing, and the worker now starts immediately instead of retrying for ~30 seconds first
• Set stop_grace_period: 60s (or --stop-timeout 60) in your compose file to give it room — the README and Docker docs now cover this

• Sentinello now scans Python, Go, and Rust projects alongside npm — lockfiles are resolved entirely offline, and every project reports its scan coverage (full, partial, or unauditable) so gaps are visible instead of silent
• GitLab’s gemnasium database joins npm audit and OSV as an offline advisory source, deduplicated against the others by CVE/GHSA alias; Settings → Sources is now a Languages × Sources matrix with per-cell notification scope, and npm audit itself can be turned off as long as one source stays active
• Findings now record the git branch they came from, shown in the project list, the project header, and every notification
• Project rows carry their own actions — scan now, copy or download the advisory, mute or unmute, and edit tags — so a triage pass no longer needs a trip into each project
• The projects dashboard went from ~3.3s to ~0.03s, and navigation now shows loading states instead of appearing frozen
• Security: 25 dependency advisories cleared, including libvips CVEs that were live in the portal’s image optimizer and nine Next.js advisories affecting the shipped portal
• The default advisory-export prompt now covers minimum release age, lockfile verification, and stale overrides

• Set up MCP entirely in Settings → MCP: generate a token to turn the /api/mcp endpoint on, clear it to turn it off — the SENTINELLO_MCP_ENABLED and SENTINELLO_MCP_API_TOKEN environment variables are gone (an existing env token is imported once on upgrade)
• Ready-to-paste connection snippets for Claude Code, Codex, Cursor, and Claude Desktop, pre-filled with your token
• When SENTINELLO_PORTAL_BASE_URL is set in the environment it’s shown read-only in Settings → Advanced, since it stays authoritative and is re-applied on every boot

• Malware advisories now match the exact compromised version — a clean or already-remediated version of a once-compromised package is no longer flagged
• Duplicate findings now resolve themselves on the next scan, so old or stranded entries clear out automatically
• Production and development labels are now computed one consistent way across every source (npm and OSV)

• Streamlined the project header — rename inline beside the title, with mute and tags as one-tap icons
• Filter findings by source (npm / OSV) from a new dropdown beside the dependency-type filter
• Unified, consistent dropdowns across the app, with type-to-search on long lists like time zones

• Expanded upgrade steps for the 2.0 breaking changes
• README notes the localhost-only port binding

• OSV as an opt-in second source (Settings → Sources, off by default) with malicious-package detection, matched against the public OSV database in a local cache
• Findings now merge across sources — one row per vulnerability, every source tagged, the best available fix, and the union of dependency paths, with a source filter and a dependency-path popover
• Security hardening: the MCP endpoint is off by default and requires a token, webhook delivery is guarded against SSRF, an optional portal login gate, and the container runs as an unprivileged user
• Settings is now a top-level section with a sidebar and a Profile page

• MCP server at /api/mcp for Claude Desktop, Cursor, and other clients
• New Settings → MCP section with server URL and token management
• What’s-new pill plus a Release notes history

• The running version renders cleanly in the footer

• Filter notifications by environment
• Simpler notification-target edit form
• Duplicate an existing notification target

• The home view is split into dedicated Projects and Libraries pages

• The worker reloads the scan schedule the moment you save changes in the portal

• Confirmation prompts before deleting roots and notification targets
• Update notice moved to a dismissible top banner
• Worker prunes stale roots when a host mount disappears

• Drop audit findings whose installed version isn’t actually in the vulnerable range
• Allow deleting a notification target that has delivery history

• The first public release of Sentinello

Rank findings by exploitability and whether the vulnerable code is actually reachable — triage what matters first.

More notification channels and ways to plug Sentinello into the tools your team already uses.

Catch risky patterns in your own source code, not just known CVEs in your dependencies.

Flag committed secrets and license issues across the same portfolio, in the same queue.