SentinelX — your AI operates your servers.

install the agent

On each host, as root:

$ curl -fsSL https://get.sentinelx.app | bash

In an elevated PowerShell:

iwr -useb https://get.sentinelx.app/install.ps1 -OutFile "$env:TEMP\sx.ps1"
powershell -ExecutionPolicy Bypass -File "$env:TEMP\sx.ps1"

Per user, no admin rights:

iwr -useb https://get.sentinelx.app/install.ps1 -OutFile "$env:TEMP\sx.ps1"
powershell -ExecutionPolicy Bypass -File "$env:TEMP\sx.ps1" -User

Read the installer

No inbound ports.

The agent opens one outbound WebSocket to the hub and listens on no port, so it works behind NAT and firewalls.

You decide what runs. Every attempt is logged.

The hub records every attempt, refused ones included.

Example: real rows from the hub’s audit log, host anonymized.
ts	host	op	ok	command	error_signature
2026-10-18T03:58:51Z	linux-host	exec	refused	iptables -L -n	command not in allowlist: iptables
2026-10-18T03:58:54Z	linux-host	exec	refused	crontab -l	command not in allowlist: crontab
2026-10-18T03:58:56Z	linux-host	exec	ok	systemctl is-active nginx
2026-10-18T03:58:58Z	linux-host	exec	ok	df -h /

Any AI client, one hub.

One connector URL, once per account:

ChatGPT
Codex
Claude
Claude Code
Grok
Cursor
OpenCode
VS Code
Cline

Free for 1 host, no card Open-source agent, Apache-2.0 3,000+ servers connected Listed in ChatGPT apps

01Install the agent

Run this on each host you want to operate. It builds a virtualenv, registers a service (systemd / launchd / Windows service), writes a starter config, and starts enrollment.

Linux / macOS — one command, auto-detects your OS:

$ curl -fsSL https://get.sentinelx.app | bash

Windows — PowerShell (Python 3.12+ and git on PATH). Service install, in an elevated shell:

iwr -useb https://get.sentinelx.app/install.ps1 -OutFile "$env:TEMP\sx.ps1" powershell -ExecutionPolicy Bypass -File "$env:TEMP\sx.ps1"

…or a no-admin, per-user install (locked-down machines):

iwr -useb https://get.sentinelx.app/install.ps1 -OutFile "$env:TEMP\sx.ps1" powershell -ExecutionPolicy Bypass -File "$env:TEMP\sx.ps1" -User

Prerequisites — Linux: root + git, python3, systemd. macOS: none (Python via uv). Windows: Python 3.12+ and git. Behind a corporate proxy / blocked PyPI: add -Bundle <zip-or-url>. Every flag and the uninstall steps live in the installer repo.

02Enroll the host

The installer prints an enrollment URL. Open it, sign in at mcp.sentinelx.app with Google, click Enroll a new host, and paste the token back into the terminal. The host binds to your account and appears in the dashboard within seconds.

03Connect your LLM

Point your assistant at the hub — once per account, not per host. The connector URL is the same everywhere:

https://mcp.sentinelx.app/mcp/mcp

ChatGPT — install SentinelX from the app directory, click Connect, sign in. No URL to paste.

Claude.ai — Settings → Connectors → Add custom connector → paste the URL above, then authorize with Google.

Grok — grok.com/connectors → New Connector → Custom → paste the URL above, then authorize with Google.

VS Code, Cursor, Cline & other JSON clients — drop this into the client's MCP config (mind the transport key: VS Code uses "type": "http", Cline uses "type": "streamableHttp", Cursor needs only the URL):

{ "mcpServers": { "sentinelx": { "url": "https://mcp.sentinelx.app/mcp/mcp" } } }

04Operate

Per host, the AI is handed a fixed set of tools — nothing else:

sentinel_state: host facts
sentinel_capabilities: what's allowed
sentinel_exec: run a shell command, per the host’s policy
sentinel_edit: structured file edits
sentinel_script_run: temp bash / python script
sentinel_service_status: is it running, does it start at boot
sentinel_restart: restart an allowed service
sentinel_upload_file: upload to host
sentinel_list_hosts: multi-host fleet view

…and more — see the agent's docs

Then drive it in plain language:

Restart nginx on the VPS.
How much disk is left on the storage box?
Which services are down across the fleet?
Edit the config and reload the service.
Tail the error log and tell me what broke.
Resolve the merge conflict in this repo.

05Configure the allowlist

Everything is deny-by-default. The agent runs only what /etc/sentinelx/config.yaml permits (next to the install on macOS/Windows). Edit it to widen or narrow the agent's reach:

# /etc/sentinelx/config.yaml exec_mode: allowlist # or strict / unrestricted allowed_commands: # whole words; every command in a chain - systemctl status - docker ps - df -h services: # units it may manage nginx: actions: [status, restart, reload] file_ops: # paths it may read / write paths: - path: /etc/nginx/sites-available access: rw

You decide what runs, not the model: the agent executes only what this file allows, and every attempt, refused ones included, is logged. With exec_mode: allowlist (the default), every command in a line must be on the list; on trusted development hosts, exec_mode: unrestricted lets it run anything under the agent's account. sentinel_script_run isn't limited by the list: where the list must hold, turn it off with disabled_ops: [script_run]. Either way, the agent's OS account is the outer limit. Full schema & examples: config.example.yaml.

Security

What the agent may do is set on the host, in /etc/sentinelx/config.yaml:

The allowlist. With exec_mode: allowlist (the default), every command in a line must be on the list.
Logged attempts. The hub records every attempt, refused ones included.
Scripts. sentinel_script_run isn't limited by the allowlist; where the list must hold, turn it off with disabled_ops: [script_run].
The OS account. The agent's OS account is the outer limit: what that account can't do, the agent can't do.