Real-time spyware and intrusion detection for your Mac — with a live threat dashboard.
CrowdStrike costs $50/device/year and is built for IT departments. This is built for people who actually need it — journalists, activists, executives, or anyone who just doesn't want unknown software watching them.
Pegasus is commercial spyware built by the NSO Group and sold to governments worldwide. Once installed on your device it can:
- Read all your messages (iMessage, WhatsApp, Signal)
- Turn on your microphone and camera without any indicator
- Track your location in real time
- Exfiltrate your contacts, photos, and emails
- Persist silently across reboots
It has been used against journalists, lawyers, human rights activists, and heads of state. It is virtually undetectable by standard antivirus software because it uses zero-day exploits and never matches known malware signatures.
Behavioral detection is the only reliable approach.
Sentinel runs 5 monitors in parallel and streams every alert to a live web dashboard at localhost:8765.
Watches every process that starts on your Mac. Scores it 0–10 based on:
- Where the executable is running from (spyware hides in
/tmp,Library/Caches, hidden directories) - Whether its name matches known spyware patterns
- Whether it's a privacy-sensitive app (Contacts, Calendar) making unexpected network connections
Watches every active TCP/UDP connection for:
- Connections to known-bad ports (4444 Metasploit, 1337, 31337, 9999, IRC C2 ports, etc.)
- C2 beacon detection — the same process connecting to the same host repeatedly at regular intervals (the fingerprint of command-and-control malware)
- Privacy apps making outbound connections they have no reason to make
Scans all macOS launch daemons and agents every 30 seconds. This is the most important monitor. Any program that wants to survive a reboot on macOS must register a LaunchDaemon or LaunchAgent. Pegasus, FinFisher, Candiru — all of them. The moment a new persistence item appears, Sentinel fires a HIGH or CRITICAL alert with the binary path and a threat score.
Hashes critical system files at startup and checks for changes every 60 seconds:
/etc/hosts— spyware modifies this to redirect DNS and intercept traffic~/.ssh/authorized_keys— backdoors add SSH keys here/etc/sudoers,/etc/passwd— privilege escalation targets- Shell profiles (
~/.bashrc,~/.zshrc) — common malware persistence location
After collecting ~17 minutes of baseline data, trains an IsolationForest model on your normal CPU, memory, disk, network, and process patterns. Flags statistical deviations — useful for catching novel malware that doesn't match any known signature.
- Threat level badge — NORMAL (green) → GUARDED → ELEVATED → CRITICAL (flashing red)
- Live event feed — every alert streams in real time, color-coded by severity
- System metrics chart — 30-minute rolling CPU and memory history
- Active connections table — every live TCP/UDP connection and the process behind it
- Process list — top processes by CPU with live coloring
- iPhone Pegasus guide — step-by-step instructions for the Amnesty MVT tool
Every detected event gets a score from 0–10:
| Score | Severity | Example |
|---|---|---|
| 1–3 | LOW | New unknown process in a normal location |
| 4–6 | MEDIUM | Connection to exfiltration port from untrusted app |
| 7–8 | HIGH | New launch daemon pointing to a suspicious binary |
| 9–10 | CRITICAL | Process in Pegasus drop location + C2 port + hidden binary name |
Sentinel watches your Mac. For your iPhone, use Amnesty International's Mobile Verification Toolkit — the same tool used by security researchers at Citizen Lab and The Washington Post.
pip install mvt
# Back up your iPhone via Finder (not iCloud)
# Then:
mvt-ios check-backup ~/Library/Application\ Support/MobileSync/Backup/<device-id>MVT checks against a continuously updated database of confirmed Pegasus domains, IP addresses, and process signatures. It will tell you definitively if your phone has been compromised.
git clone https://github.com/Gavand1969/sentinel.git
cd sentinel
pip install -r requirements.txt
python main.pySentinel stores its database, ML model, and encryption key in ~/.sentinel/ — nothing is sent anywhere. All monitoring is local.
sentinel/
├── main.py # Entry point — FastAPI app + monitor launcher
├── src/
│ ├── core/event.py # SecurityEvent dataclass + severity levels
│ ├── monitors/
│ │ ├── process_monitor.py # Process detection + threat scoring
│ │ ├── network_monitor.py # Connection monitoring + C2 beacon detection
│ │ ├── system_monitor.py # CPU/memory/disk + feeds ML detector
│ │ ├── file_monitor.py # SHA-256 file integrity checking
│ │ └── persistence_monitor.py # Launch daemon/agent scanning
│ ├── detection/
│ │ ├── threat_intel.py # IOCs, behavioral signatures, scoring functions
│ │ └── ml_detector.py # IsolationForest anomaly detection
│ ├── storage/database.py # Async SQLite (aiosqlite)
│ ├── api/
│ │ ├── routes.py # REST API endpoints
│ │ └── ws_manager.py # Multi-client WebSocket broadcast
│ └── alerts/notifier.py # Desktop notifications + rate limiting
└── static/ # Dashboard frontend (no build step)
├── index.html
├── css/style.css
└── js/app.js
| Layer | Technology |
|---|---|
| Backend | Python 3.12, FastAPI, asyncio |
| Monitoring | psutil |
| ML | scikit-learn IsolationForest |
| Storage | SQLite (aiosqlite) |
| Encryption | Fernet (cryptography) |
| Frontend | Vanilla JS, Chart.js, WebSocket |
| Alerts | plyer (desktop notifications) |
- macOS
.appbundle with one-click installer - Email + Slack alert integration
- Live threat intel feed updates (Amnesty STIX database)
- iOS companion app (network traffic monitoring)
- Windows support
- Automated MVT iPhone scan integration
Sentinel is a defensive security tool. It monitors your own computer for unauthorized activity. It does not perform any offensive actions, exploit vulnerabilities, or access systems you do not own.
MIT — see LICENSE