Skip to content
sentrasec

For developers

Build secure software without changing how you work.

Sentrasec runs where your code already goes: the terminal, the pipeline, the pull request. Findings arrive with the code path that produced them and a fix you can apply.

Start scanning CLI reference

One command, every surface

A single scan covers source, dependencies, infrastructure definitions, containers and more: no separate tool per concern.

  • SAST
  • Secrets
  • SCA
  • IaC
  • Container
  • DAST
  • API security
  • Runtime
  • CSPM
  • KSPM
  • Compliance
  • Adversary simulation
Scan a repository
$ sentrasec scan .$ sentrasec scan . --scanners sast,secrets,sca$ sentrasec scan . --format sarif > results.sarif

Results are deduplicated across scanners before they are reported, so one underlying issue found three ways is one finding, not three.

The workflow

Security runs on the path the code already takes, at the point where changing it is cheapest.

  1. git push
  2. CI
  3. sentrasec scan
  4. PR annotation
  5. Suggested fix
  6. Merge
The scan runs in CI on every push. Findings become annotations on the pull request, each carrying a suggested fix, so the review that was already happening is where security gets resolved.

No new dashboard

A finding shows up as a comment on the lines that caused it. If nothing is wrong, nothing interrupts you.

Fails only when it should

Gating is policy-driven, using severity thresholds, exceptions and per-service rules, so the build breaks on what matters and not on noise.

Same results locally

The engine in CI is the engine on your machine. You can reproduce and clear a finding before you push.

Workspace Chat

Ask about a finding instead of researching it.

Every finding is connected to the rule, weakness class and fixes behind it, so the follow-up questions have answers already.

Explain finding

What the rule matched, the path it followed, and why it matters here.

Suggest fix

A concrete change for the affected code, in the language it is written in.

Explain rule

What the detection tests for, and when it legitimately does not apply.

Explain CVE

Affected ranges, exploitation conditions and the upgrade that resolves it.

Explain CWE

The underlying weakness class, separate from this particular instance.

Explain OWASP

How the finding maps to the category your programme reports against.

How Workspace Chat works

Or stay in your editor

Through MCP, your coding agent can run the same scans and read the same graph without you leaving the file you are working in.

Add Sentrasec to Claude Code
$ claude mcp add sentrasec -- sentrasec mcp

Claude Code, Cursor, Copilot, VS Code and Continue all connect over the same interface. The agent discovers the available tools automatically and picks the right one from a plain-language request.

AI coding agents