Website  ·  Download  ·  Install guide  ·  Docs  ·  Changelog

SentinelGo turns every Windows, macOS and Linux machine in your fleet into a continuously monitored, audit-ready endpoint. Drop one small file on a device and it starts reporting what's installed, how it's secured, and what's happening on it, then keeps itself up to date.

No runtime to install, no agent zoo, no per-OS tooling. Just one binary that runs as a native service and stays out of the way.

✨ Why SentinelGo

📦 Deploy in minutes One static binary per platform with no dependencies. Copy it, run -install, done. It runs as a Windows Service, systemd unit or launchd daemon and restarts itself on failure.	🔍 See everything Hardware, software, network, security posture and live audit logs from every device, in one consistent format across all three operating systems.	🔄 Stays current by itself Signed, verified self-updates roll out new versions across your fleet. No manual upgrades, no drift.
🧾 Built for audits Audit events are queued on disk and delivered at least once, so nothing is lost to a reboot or a network outage.	🪶 Light footprint A single background process built to monitor quietly, without slowing down the people using the machine.	🔐 Secure by design Per-agent authentication, HTTPS only, signed releases, and personal data redacted before it leaves the device.

📡 What you get from every device

Area	What's collected
🖥️ Hardware & system	CPU, memory, disks, GPUs, RAM modules, displays, printers and peripherals; OS, uptime and last boot
🛡️ Security posture	Disk encryption (BitLocker, FileVault, LUKS), antivirus, firewall, Secure Boot, SIP, SELinux/AppArmor, TPM, open ports
🌐 Network	Adapters, IP addressing, gateways, DNS and Wi-Fi details
📦 Software	Installed apps from every major package source, with change history, plus browser extensions
📝 Audit logs	Windows Event Log, Linux journald and auth logs, macOS unified log, normalized and severity-tagged
👥 Local accounts	Users and group membership, never passwords or other credentials

⚡ How it works

1. Authenticate: each agent signs in and gets a short-lived token that it renews on its own.
2. Report: a heartbeat every few minutes, plus full hardware and software inventory.
3. Stream: audit events are collected, queued locally and uploaded in batches.
4. Stay current: new releases are downloaded, verified and installed automatically.

🚀 Get started

1. Download the binary for your platform from the latest release.

Windows	macOS	Linux
amd64	Apple Silicon · Intel	amd64 · arm64

2. Add your backend details to a config.json next to the binary.

3. Install it as a service:

sudo ./sentinelgo -install       # Linux / macOS
.\sentinelgo.exe -install        # Windows, as Administrator

That's it. The agent starts reporting right away and keeps running across reboots.

📖 Step-by-step instructions for each OS, including checksum verification, are in the install guide.

⚙️ Configuration

The agent reads one JSON file:

OS	Path
Linux / macOS	/opt/sentinelgo/.sentinelgo/config.json
Windows	C:\sentinelgo\.sentinelgo\config.json

{
  "supabase_url":           "https://<your-project>.supabase.co",
  "supabase_key":           "<anon-key>",
  "agent_secret":           "<agent-login-secret>",
  "auto_update":            true,
  "auto_update_interval":   "24h",
  "update_interval":        "5m",
  "audit_logs_enabled":     true,
  "software_sync_enabled":  true,
  "log_flush_interval":     "5m"
}

Use -config <path> for a different location. Every field can also be set with an environment variable. No credentials are built into the binary.

Full reference: docs/02-config-module.md

💻 Command-line reference

sentinelgo -install             # install as a system service (admin/root)
sentinelgo -uninstall           # remove the service
sentinelgo -run                 # run in the foreground
sentinelgo -status              # show installed/running processes and versions
sentinelgo -version             # print version
sentinelgo -config PATH         # use a custom config file

sentinelgo -collect-logs        # collect audit logs now
sentinelgo -upload-logs         # flush pending audit logs
sentinelgo -software-list       # show installed software inventory
sentinelgo -agent-info-update   # refresh hardware/system inventory

Full reference: docs/agent-commands-guide.md

🔨 Build from source

Requires Go 1.26 or newer. Every build is a CGO_ENABLED=0 static binary, and all platforms cross-compile from a single machine.

make build                 # dev build -> bin/sentinelgo[.exe]
make test                  # run the test suite
make verify-cross          # type-check every GOOS/GOARCH
make release VERSION=vX.Y.Z

🔐 Security

• HTTPS only, with a per-agent token issued at runtime. Nothing secret is embedded in the binary.
• Signed releases. Every binary is signed and checksummed, and both the updater and the installers verify it before running anything.
• Privacy first. Account inventory never includes credentials, and personal data is redacted from task output before upload.
• Continuously checked. CodeQL, gosec, govulncheck, Trivy and SonarCloud run on every change, release binaries are scanned with govulncheck before they are signed, and parsers are fuzzed on a schedule.

Found a vulnerability? Please report it privately. See SECURITY.md.

📚 Learn more

For	Read
🚀 Using SentinelGo	Install guide · Configuration · CLI · Changelog
🏗️ How it's built	Project overview · Security assurance case · Updater · Audit-log pipeline · Hardware metrics
🤝 The project	Contributing · Governance · Roadmap · Releases · Security policy · Code of Conduct

🙌 Get involved

Bug reports, ideas, docs and code are all welcome.

New here? Start with the contributing guide.

📈 Project health

---

Sponsored by

Licensed under Apache 2.0  ·  Made with ❤️ by the SentinelGo team