Website ·
Download ·
Install guide ·
Docs ·
Changelog
SentinelGo turns every Windows, macOS and Linux machine in your fleet into a continuously monitored, audit-ready endpoint. Drop one small file on a device and it starts reporting what's installed, how it's secured, and what's happening on it, then keeps itself up to date.
No runtime to install, no agent zoo, no per-OS tooling. Just one binary that runs as a native service and stays out of the way.
✨ Why SentinelGo
📦 Deploy in minutes
One static binary per platform with no dependencies. Copy it, run -install, done. It runs as a Windows Service, systemd unit or launchd daemon and restarts itself on failure.
🔍 See everything
Hardware, software, network, security posture and live audit logs from every device, in one consistent format across all three operating systems.
🔄 Stays current by itself
Signed, verified self-updates roll out new versions across your fleet. No manual upgrades, no drift.
🧾 Built for audits
Audit events are queued on disk and delivered at least once, so nothing is lost to a reboot or a network outage.
🪶 Light footprint
A single background process built to monitor quietly, without slowing down the people using the machine.
🔐 Secure by design
Per-agent authentication, HTTPS only, signed releases, and personal data redacted before it leaves the device.
📡 What you get from every device
| Area | What's collected |
|---|
| 🖥️ Hardware & system | CPU, memory, disks, GPUs, RAM modules, displays, printers and peripherals; OS, uptime and last boot |
| 🛡️ Security posture | Disk encryption (BitLocker, FileVault, LUKS), antivirus, firewall, Secure Boot, SIP, SELinux/AppArmor, TPM, open ports |
| 🌐 Network | Adapters, IP addressing, gateways, DNS and Wi-Fi details |
| 📦 Software | Installed apps from every major package source, with change history, plus browser extensions |
| 📝 Audit logs | Windows Event Log, Linux journald and auth logs, macOS unified log, normalized and severity-tagged |
| 👥 Local accounts | Users and group membership, never passwords or other credentials |
⚡ How it works
- Authenticate: each agent signs in and gets a short-lived token that it renews on its own.
- Report: a heartbeat every few minutes, plus full hardware and software inventory.
- Stream: audit events are collected, queued locally and uploaded in batches.
- Stay current: new releases are downloaded, verified and installed automatically.
🚀 Get started
1. Download the binary for your platform from the latest release.
| Windows | macOS | Linux |
|---|
amd64 | Apple Silicon · Intel | amd64 · arm64 |
2. Add your backend details to a config.json next to the binary.
3. Install it as a service:
sudo ./sentinelgo -install # Linux / macOS
.\sentinelgo.exe -install # Windows, as Administrator
That's it. The agent starts reporting right away and keeps running across reboots.
📖 Step-by-step instructions for each OS, including checksum verification, are in the install guide.
The agent reads one JSON file:
| OS | Path |
|---|
| Linux / macOS | /opt/sentinelgo/.sentinelgo/config.json |
| Windows | C:\sentinelgo\.sentinelgo\config.json |
{
"supabase_url": "https://<your-project>.supabase.co",
"supabase_key": "<anon-key>",
"agent_secret": "<agent-login-secret>",
"auto_update": true,
"auto_update_interval": "24h",
"update_interval": "5m",
"audit_logs_enabled": true,
"software_sync_enabled": true,
"log_flush_interval": "5m"
}
Use -config <path> for a different location. Every field can also be set with an environment variable. No credentials are built into the binary.
Full reference: docs/02-config-module.md
sentinelgo -install # install as a system service (admin/root)
sentinelgo -uninstall # remove the service
sentinelgo -run # run in the foreground
sentinelgo -status # show installed/running processes and versions
sentinelgo -version # print version
sentinelgo -config PATH # use a custom config file
sentinelgo -collect-logs # collect audit logs now
sentinelgo -upload-logs # flush pending audit logs
sentinelgo -software-list # show installed software inventory
sentinelgo -agent-info-update # refresh hardware/system inventory
sentinelgo dlp status [-json] # DLP state from the cached policy (admin/root; -config PATH for a custom install)
sentinelgo dlp test [-file F] # run the cached DLP policy on a file or stdin; prints masked findings only
Full reference: docs/agent-commands-guide.md
Requires Go 1.26 or newer. Every build is a CGO_ENABLED=0 static binary, and all platforms cross-compile from a single machine.
make build # dev build -> bin/sentinelgo[.exe]
make test # run the test suite
make verify-cross # type-check every GOOS/GOARCH
make release VERSION=vX.Y.Z
🔐 Security
- HTTPS only, with a per-agent token issued at runtime. Nothing secret is embedded in the binary.
- Signed releases. Every binary is signed and checksummed, and both the updater and the installers verify it before running anything.
- Privacy first. Account inventory never includes credentials, and personal data is redacted from task output before upload.
- Continuously checked. CodeQL, gosec, govulncheck, Trivy and SonarCloud run on every change, release binaries are scanned with govulncheck before they are signed, and parsers are fuzzed on a schedule.
Found a vulnerability? Please report it privately. See SECURITY.md.
📚 Learn more
🙌 Get involved
Bug reports, ideas, docs and code are all welcome.
New here? Start with the contributing guide.
Sponsored by
Licensed under Apache 2.0 · Made with ❤️ by the SentinelGo team
