SentinelCore

The company's own tool for checking a Linux server is safe: it scans for open doors, watches the logs for trouble, and tightens the settings that matter.

What this record is

SentinelCore is run by LESNAR AI on its own infrastructure. It is not sold, not hosted for anyone, and has no customer deployment. It appears in the register because it exists and is used, not because it is a product.

What the command actually does

Five modules and one orchestrator

Read from the source, not from a running system. This is the committed structure, named as the repository names it, with each component’s implementation state beside it.

Orchestrator Runs the stages in orderImplemented

Module Async port scanningImplemented

Module An inotify log watcherImplemented

Module Settings hardeningImplemented

Stage Present in the control flow, with no implementation behind it Wired · not built

Source fact: The repository contains five modules and one orchestrator, and two stages wired into the control flow but not implemented.
Interpretation: The order is read from the source, not observed on a running system. No operational handoff is claimed. These are components, not actors passing responsibility to one another.
Limit: Nothing here is operated, so nothing operated is shown. This evidences that the code is organised this way, and nothing more.

Evidence

What is committed

With no public surface there is no capture to show. What the register publishes instead is the set of commitments the system is built to hold, listed exactly as stated in the source.

Async port scanning.
An inotify log watcher.
Settings hardening on the checks that matter.
Two further stages wired in and not yet built.

Not claimedA commitment is not a measurement. No detection rate, no coverage figure, no benchmark and no security assurance is published, and none should be inferred from the fact that the code exists.

Evidence · measured

The suite, run and recorded

The one thing that can honestly be measured about a system with no public surface is whether its own tests pass, by a method anyone can repeat.

Methodpython3 -m pytest tests -q on the SentinelCore repository at a recorded commit, on a local Linux workstation. No network target was scanned and no host was modified.

Result133 tests passed, 0 failed, in 21.87s across 21 test files: detection, exposure graph, monitoring, evidence legal hold, offensive lifecycle and safety, and owned-source connectors.

Captured16 Sep 2026 · EV-SENTINEL-TESTS-01

StrengthMeasured by us, by a stated method, on a stated day.

What a passing suite does not proveThat SentinelCore is deployed, operated, or protecting any real server. It proves the implementation behaves as its own tests specify. Nothing about the world follows from that.

Why it is here

SentinelCore is the worked example behind one engineering principle: measure instead of assert. It is the company's deepest record and it belongs to nobody else.

Engineering principles →