Getting started

Sentient monitors coding agent activity on your machine. It has two parts: sentientd, a monitor that runs as root, and sen, the CLI you use to see what happened.

The quickest path on Linux:

# 1. download a release, or build from source (below)
# 2. install and start the daemon
sudo systemctl enable --now sentientd
# 3. check what your agent has done
sen status
sen serve        # dashboard on http://127.0.0.1:7357

Architecture

Two independent sources feed sentientd: kernel events from Tetragon, and the agent's own session logs. sentientd correlates them, applies the rules and stores the result. sen and the dashboard read it through a local API.

Everything runs on your machine, with no network port and no telemetry. Cyan arrows are the two capture paths.

Supported platforms

Platform	Status	Capture
Linux	Supported	Agent session logs today. Kernel capture through Tetragon (eBPF) is next.
macOS	Planned	Apple's built-in `eslogger`, then Endpoint Security once the entitlement is granted.
Windows	Not yet	Not on the roadmap yet. It would need its own capture method, such as ETW.

Supported agents: Claude Code. Others will follow.

Build from source

Prebuilt binaries will be on the releases page. To build your own, you need Go 1.26 and make.

Linux macOS Windows

git clone https://github.com/nosaka4i/sentient
cd sentient
make build                      # bin/sen, bin/sentientd
VERSION=0.1.0 make build        # optional: stamp a version

Then install the daemon.

Planned. macOS support isn't built yet. These steps are a preview and will change.

brew install go
git clone https://github.com/nosaka4i/sentient
cd sentient
make build

On macOS, sentientd will run as a launchd daemon and capture through eslogger.

Not yet supported. Sentient doesn't run on Windows. You can use it inside WSL 2, which is Linux, by following the Linux steps.

Install the daemon

Manual steps for v0.1. A package or sen install may come later.

sudo install -d -m 0755 /opt/sentient/bin
sudo install -d -m 0700 /opt/sentient/data
sudo install -m 0755 bin/sentientd bin/sen /opt/sentient/bin/
sudo groupadd --system sentient            # who may use the socket
sudo usermod -aG sentient "$USER"          # log in again to pick it up
sudo install -m 0644 deploy/sentientd.service /etc/systemd/system/
sudo systemctl daemon-reload
sudo systemctl enable --now sentientd
sudo ln -s /opt/sentient/bin/sen /usr/local/bin/sen

By default sentientd reads ~/.claude/projects for /root and every home under /home. To limit it, pass --home in the unit file.

Recommended setup

Run coding agents in an account without root or passwordless sudo. sentientd runs as root, so an agent in a regular account can't stop it or edit its records. If the agent's account has passwordless sudo, the dashboard's /health page warns about it. To remove it:

sudo grep -rn NOPASSWD /etc/sudoers /etc/sudoers.d/   # find the rule
sudo visudo -f /etc/sudoers.d/<file>                  # remove NOPASSWD
sudo -l -U <account>                                  # check: no NOPASSWD left

A sandbox or a separate account for agents works too.

Reference

CLI · sentientd options · API