Star
Air-gapped · Multi-cloud · DevSecOps CI/CD PR Gate · 68+ Tests Passing

Catch cloud IAM privilege escalation
before it ships — on your own metal.

Deterministic AWS, Azure & GCP IAM auditing — zero LLM hallucinations, reproducible audit trails, and a native IDE MCP server for Cursor & Claude Code. Runs 100% offline.

⭐ Star on GitHub Quickstart →
Runs on every OS
macOSIntel & Apple Silicon
WindowsDocker Desktop
LinuxDocker Engine
WSLUbuntu on Windows

100% On-Prem & Air-Gapped

Zero outbound telemetry. Your IAM policies, findings, and compliance logs never leave your private network.

Ground-Truth Deterministic Engine

Findings come from structural rule packs — version-stamped, auditable, reproducible. Not an LLM guess.

Native IDE Integration (MCP)

A stdio JSON-RPC MCP server puts automated security checks inside Cursor & Claude Code as code is written.

DevSecOps CI/CD PR Gate

Drop-in GitHub Action (uses: Pratikchandrathakur/IAM-Sentinel@v1). Pulls IAM from terraform show -json and blocks dangerous merges via SARIF & Markdown PR summaries.

100% Offline Remediation

Zero model / Ollama required. Every scan returns an instant deterministic remediation report + least-privilege policy skeleton with zero external dependencies.

Config-Driven Custom Rules

Add custom organizational rule definitions using simple JSON configs (custom_rules.example.json) without altering codebase logic.

Drop-in GitHub Action CI/CD Guardrail

Block dangerous IAM privilege-escalation in Terraform plans or policy JSON files on every Pull Request.

.github/workflows/iam-security.yml
name: "IAM Security PR Guardrail"
on: [pull_request]
jobs:
  iam-guardrails:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Run IAM Sentinel PR Gate
        uses: Pratikchandrathakur/IAM-Sentinel@v1
        with:
          tfplan: "tfplan.json" # or paths: "policies/*.json"
          fail-on: "HIGH" # fails PR if HIGH or CRITICAL findings exist

Install in 3 steps — any OS

Works anywhere Docker runs. A GPU is optional — only for the written remediation narrative.

bash — iam-sentinel
1git clone https://github.com/Pratikchandrathakur/IAM-Sentinel && cd iam-sentinel
2cp .env.example .env # set API keys (+ LICENSE_KEY if you have one)
3docker compose up -d --build
 → open http://127.0.0.1:8080 · health: /api/health · dashboard included
macOS Windows (no NVIDIA) → set LLM_NARRATIVE_ENABLED=false for the CPU-only deterministic core (you still get every finding).
Linux WSL + NVIDIA → full stack including the local model. Per-OS steps in INSTALL.md.

Pricing

Open-core: run it free, upgrade for seats, history & enterprise controls. Licensing is enforced offline via Ed25519 signatures.

Community

Free
  • 1 seat
  • 100 scans / month
  • AWS · Azure · GCP engines
  • Native IDE MCP server
  • Audit trail
Get started
MOST POPULAR

Team

$199 / month
  • 10 seats
  • 5,000 scans / month
  • Cross-run remediation diff
  • SHA-256 provenance
  • Everything in Community
Start Team

Enterprise

$4,999 / year
  • Unlimited seats & scans
  • SSO (OIDC) + RBAC
  • Built-in TLS
  • Air-gapped licensing
  • Priority SLA
Contact sales

Capability matrix

Entitlements are enforced offline — no phone-home.

CapabilityCommunityTeamEnterprise
Deterministic AWS / Azure / GCP detection✓✓✓
Native IDE MCP server✓✓✓
Audit trail & SHA-256 provenance✓✓✓
Cross-run remediation diff—✓✓
SSO (OIDC) + RBAC——✓
Seats · Scans/mo1 · 10010 · 5,000∞ · ∞

FAQ

Does any data leave our network?

No. No outbound calls except to your own optional local model. Zero telemetry.

Do we need a GPU?

No. Findings are deterministic and CPU-only. A GPU only powers the optional prose remediation.

Is it really deterministic?

Yes — findings come from a structural rule engine, version-stamped and reproducible. The LLM only explains verified findings.

How is licensing enforced?

An offline Ed25519-signed key in .env, verified against a bundled public key. Tampering breaks it; the app fails safe.

Which clouds?

AWS, Azure & GCP IAM/RBAC today — auto-detected. The finding schema is provider-agnostic.

How do I deploy?

One docker compose up. Full per-OS steps (Mac/Win/Linux/WSL) in INSTALL.md.

⭐ Star it on GitHub Request a pilot