Sentinel Local

Sentinel Local is a local-first Windows 11 security center. Its safe release combines a device-first home-network map with live Windows protection status, explicit malware scans, privacy controls, network-member review, and evidence-based diagnostics.

The application uses a React and TypeScript interface inside Tauri v2, with narrowly scoped Rust commands for local Windows and network observations. It does not run a localhost web server in packaged builds.

Current capabilities

• Read-only Windows Security, firewall, adapter, VPN-like adapter, gateway, and neighbor observations
• Microsoft Defender quick and full scan launch after explicit user action
• ClamAV on-demand file scanning when an official installation is detected
• Detection and official guidance for ClamAV, simplewall, Proton VPN Free, uBlock Origin, Wireshark, and Nmap
• Editable local network-member names, types, trust labels, and metadata-only SQLite storage
• Persistent light and dark interface themes
• Expandable device evidence in the overview inspector
• Hash-verified ClamAV quarantine and removal restricted to Sentinel Local's quarantine directory
• Private-gateway validation before opening router controls
• Responsive, keyboard-accessible security map and device inspector

Safety boundaries

• ClamAV quarantine requires an unchanged hash and moves only the explicitly scanned file into Sentinel Local's private local quarantine. Permanent removal is limited to a previously quarantined copy and requires confirmation.
• Microsoft Defender findings hand remediation to Windows Security. Firewall changes, network resets, and member restrictions remain unavailable.
• Router changes remain in the router's own interface. Sentinel Local never stores router or VPN credentials.
• Device vendors and types are observations, not proof of a person's identity.
• Sentinel Local does not claim to make a user anonymous.
• There is no telemetry, advertising, subscription, paid recommendation, affiliate link, or automatic tool installation.

Technology

• Tauri v2 and Rust
• React 19 and TypeScript
• Vite
• SQLite through rusqlite
• Vitest and Testing Library

Development

Requirements:

• Windows 11 x64
• Node.js 20 or newer
• Current stable Rust toolchain
• Microsoft WebView2
• Tauri's Windows build prerequisites

Install dependencies and run the web interface:

npm install
npm run dev

Run the Tauri application:

npm run tauri -- dev

Run verification:

npm run lint
npm test
npm run build
Set-Location src-tauri
cargo test

Build the Windows installer:

npm run tauri -- build

Security architecture

• Packaged UI assets only, with a restrictive Content Security Policy
• Named and typed Tauri commands rather than a generic shell bridge
• Fixed Windows queries and allowlisted external destinations
• Standard-user startup with no permanent elevation
• Private-address and detected-gateway validation for router handoff
• User-profile path validation for ClamAV scan targets
• Metadata-only local logging by default

See SECURITY.md for responsible disclosure and supported-version information.

Release status

Version 0.3 adds dark mode, expanded device inspection, editable member names and device categories, and guarded ClamAV remediation. Status, topology, diagnostics, tool detection, Defender scans, ClamAV file scans, and findings use local Windows data; unavailable information is shown as unavailable rather than replaced with sample data. Windows Update status is currently a 45-day installed-hotfix recency check.

Sentinel Local is not a replacement for Microsoft Defender, a managed endpoint-security platform, or professional incident response. Release installers are currently unsigned, so Windows may show a publisher warning. The repository intentionally has no open-source license yet; all rights remain reserved until a license is selected.