sentrycove 0.2.1__tar.gz

sentrycove-0.2.1/.gitignore

@@ -0,0 +1,24 @@
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.env
+.pytest_cache/
+.mypy_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# Node
+node_modules/
+clients/node/dist/
+*.tgz
+
+# .NET
+bin/
+obj/
+*.user

sentrycove-0.2.1/CHANGELOG.md

@@ -0,0 +1,48 @@
+# Changelog
+
+All notable changes to SentryCove are recorded here. The Python package, the
+Node package, the .NET package and the container image share one version
+number and are released together.
+
+## 0.2.1
+
+No changes to how SentryCove behaves. This is the first version published by
+the automated release pipeline.
+
+### Added
+- Release workflow that publishes to PyPI, npm and NuGet via trusted publishing
+  (no stored tokens), builds a multi-arch container image, and creates a GitHub
+  release — after checking that all versions match and the full test suite passes.
+- `RELEASING.md` with step-by-step setup for each registry.
+
+## 0.2.0
+
+First public release under the name SentryCove (the 0.1 prototype was called AgentGate).
+
+### Added
+- **Reverse proxy** (`sentrycove proxy`, container image): protect an app in any
+  language with no code change. Streams requests and responses, strips forged
+  forwarding headers, and tells the app who is calling via `X-SentryCove-Agent`.
+- **Decision API** (`sentrycove sidecar`): token-protected local service that
+  lets middleware in other languages use the same engine.
+- **Node package**: Express / Connect / `node:http` middleware and a guard for
+  Next.js and other web-standard runtimes.
+- **ASP.NET Core package** for .NET 8 and .NET 10.
+- `sentrycove check-config` to validate a policy file.
+
+### Security
+- Rules, honeypots and login paths are matched on a canonical path, so they can
+  no longer be dodged with upper-case, percent-encoding, extra slashes or
+  dot segments (`/LOGIN`, `/lo%67in`, `//login`, `/x/../login`).
+- An undeterminable client address is never banned or rate-counted (a ban
+  would otherwise have applied to every such client at once).
+- IPv4-mapped IPv6 peers (`::ffff:203.0.113.9`) are treated as the IPv4 address.
+
+### Changed
+- Renamed from AgentGate: package `sentrycove`, class `SentryCove`,
+  `request.state.sentrycove`, `sentrycove.yaml`, `SENTRYCOVE_*` environment variables.
+
+## 0.1.0
+
+Prototype (unreleased): ASGI middleware with Web Bot Auth verification,
+per-agent rules, honeypots, login and session monitoring, and alerts.

sentrycove-0.2.1/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

sentrycove-0.2.1/PKG-INFO

@@ -0,0 +1,238 @@
+Metadata-Version: 2.5
+Name: sentrycove
+Version: 0.2.1
+Summary: Open-source agent firewall and early-warning layer for web apps: verify AI agents, enforce per-agent policies, detect hijacked sessions and credential stuffing.
+Project-URL: Repository, https://github.com/XSiddhSaraf/sentrycove
+Project-URL: Issues, https://github.com/XSiddhSaraf/sentrycove/issues
+Project-URL: Changelog, https://github.com/XSiddhSaraf/sentrycove/blob/main/CHANGELOG.md
+Author: Siddharth
+License-Expression: Apache-2.0
+License-File: LICENSE
+Keywords: ai-agents,asgi,bot-detection,fastapi,security,waf,web-bot-auth
+Classifier: Development Status :: 3 - Alpha
+Classifier: Framework :: FastAPI
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Internet :: WWW/HTTP :: HTTP Servers
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Requires-Dist: cryptography>=42
+Requires-Dist: httpx>=0.27
+Requires-Dist: pydantic>=2.6
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: fastapi>=0.110; extra == 'dev'
+Requires-Dist: http-message-signatures>=0.5; extra == 'dev'
+Requires-Dist: mypy>=1.10; extra == 'dev'
+Requires-Dist: pytest>=8; extra == 'dev'
+Requires-Dist: ruff>=0.5; extra == 'dev'
+Requires-Dist: types-pyyaml; extra == 'dev'
+Requires-Dist: uvicorn>=0.30; extra == 'dev'
+Provides-Extra: server
+Requires-Dist: uvicorn>=0.30; extra == 'server'
+Description-Content-Type: text/markdown
+
+# SentryCove
+
+**An open-source agent firewall and early-warning layer for web apps.**
+Know *which* AI agent is calling your app, decide what each one may do, and get
+an alert within seconds when someone probes your app, brute-forces logins or
+replays a stolen session.
+
+> Status: **alpha (0.2)**. Start in `monitor` mode. APIs may change before 1.0.
+> Packages are not yet published to PyPI, npm or NuGet — install from this repository for now.
+
+## Why
+
+Bot traffic is no longer "bot vs human". AI agents browse with real browsers
+from cloud infrastructure, antidetect browsers replay stolen session cookies,
+and User-Agent strings prove nothing. SentryCove answers three questions on
+every request:
+
+1. **Who is this?** A cryptographically verified AI agent (Web Bot Auth / RFC 9421),
+   a self-declared bot, a script, or an ordinary browser.
+2. **Is it allowed to do this?** Per-agent rules: e.g. verified agents may read
+   docs; unverified bots may not submit forms.
+3. **Is something attacking us right now?** Honeypot hits, credential stuffing,
+   session hijacking, forged agent signatures → alert to Slack, a webhook or your logs.
+
+## Pick your integration
+
+One detection engine, four ways to put it in front of your app:
+
+| Your app | Use | Code change |
+|---|---|---|
+| Anything (PHP, Java, Go, Ruby, Rails, WordPress, ...) | [Reverse proxy](#reverse-proxy-any-language) (Docker) | none |
+| Python: FastAPI, Starlette, any ASGI app | [ASGI middleware](#python-fastapi--starlette--asgi) | one line |
+| Node: Express, Next.js, Hono, plain `http` | [`clients/node`](https://github.com/XSiddhSaraf/sentrycove/tree/main/clients/node) | a few lines |
+| ASP.NET Core (.NET 8 / 10) | [`clients/dotnet`](https://github.com/XSiddhSaraf/sentrycove/tree/main/clients/dotnet) | a few lines |
+
+All four read the same policy file — copy [`examples/sentrycove.yaml`](https://github.com/XSiddhSaraf/sentrycove/blob/main/examples/sentrycove.yaml)
+and adjust the paths.
+
+### Reverse proxy (any language)
+
+```
+client ──> your TLS terminator ──> sentrycove proxy ──> your app
+```
+
+```bash
+docker build -t sentrycove .
+docker run -p 8080:8080 --add-host=host.docker.internal:host-gateway \
+  -e SENTRYCOVE_UPSTREAM=http://host.docker.internal:3000 \
+  -v "$PWD/sentrycove.yaml:/etc/sentrycove/sentrycove.yaml:ro" \
+  sentrycove
+```
+
+or `docker compose -f deploy/docker-compose.yml up --build` for a complete
+example. Without Docker: `pip install ".[server]"` then
+`sentrycove proxy --upstream http://127.0.0.1:3000 --config sentrycove.yaml`.
+
+Your app receives two extra headers it can trust (client-sent copies are
+removed): `X-SentryCove-Agent` (e.g. `verified:example-agent`,
+`automation:curl`) and `X-SentryCove-Client-IP`. Make sure the app is only
+reachable through the proxy.
+
+### Python (FastAPI / Starlette / ASGI)
+
+```python
+from fastapi import FastAPI, Request
+from sentrycove import SentryCove
+
+app = FastAPI()
+app.add_middleware(SentryCove, config="sentrycove.yaml")
+
+@app.get("/")
+def home(request: Request):
+    return {"caller": request.state.sentrycove.label}   # e.g. "declared:GPTBot"
+```
+
+### Node and ASP.NET Core
+
+These use a thin middleware that asks a local SentryCove service (the
+"decision API") for a verdict — about 1 ms per request on localhost in our
+measurement:
+
+```bash
+export SENTRYCOVE_API_TOKEN=$(python -c "import secrets; print(secrets.token_urlsafe(32))")
+sentrycove sidecar --config sentrycove.yaml      # or deploy/docker-compose.sidecar.yml
+```
+
+```js
+// Express
+import { sentrycove } from "sentrycove/express";
+app.use(sentrycove({ url: "http://127.0.0.1:8787", token: process.env.SENTRYCOVE_API_TOKEN }));
+```
+
+```csharp
+// ASP.NET Core
+builder.Services.AddSentryCove(o => { o.Url = new Uri("http://127.0.0.1:8787"); o.Token = token; });
+app.UseSentryCove();
+```
+
+See [`clients/node`](https://github.com/XSiddhSaraf/sentrycove/tree/main/clients/node) (including Next.js) and
+[`clients/dotnet`](https://github.com/XSiddhSaraf/sentrycove/tree/main/clients/dotnet) for details.
+
+## What it detects
+
+| Detection | Signal | Default action |
+|---|---|---|
+| Verified AI agent | Valid Web Bot Auth signature from a trusted signer | Classified `verified`, rules decide |
+| Forged / replayed agent signature | Signature fails or nonce reused | **High** alert |
+| Bots on sensitive endpoints | Rule match (e.g. unverified bot POSTing a form) | Alert; block in `enforce` |
+| Probing / scanning | Request to a honeypot path (`/.env`, `/.git/*`…) | **Critical** alert; IP ban in `enforce` |
+| Brute force | N failed logins from one IP in a window | **High** alert |
+| Credential stuffing | Site-wide spike of failed logins | **Critical** alert |
+| Session hijack | Session cookie reused from a different browser/device | **High** alert |
+
+## Rollout: monitor → enforce
+
+1. Deploy with `mode: monitor`. Nothing is blocked; you only get alerts.
+2. Tune rules and honeypot paths until alerts are meaningful.
+3. Switch to `mode: enforce`. Blocking applies to `block` rules, honeypots and bans.
+
+By default SentryCove fails open: a bug or outage in SentryCove never takes
+your app down. Set `fail_open: false` (and `failOpen` / `FailOpen` in the Node
+and .NET middleware) if you prefer requests to be refused instead.
+
+## Security design
+
+- **Rules cannot be dodged with path tricks.** Paths are matched in a canonical
+  form, so `/LOGIN`, `/login/`, `//login`, `/lo%67in` and `/x/../login` all hit
+  a rule on `/login`.
+- **No SSRF**: key directories are fetched only from origins you list under
+  `web_bot_auth.trusted_agents`, over HTTPS, without redirects, size-capped.
+- **Spoof-resistant client IP**: `X-Forwarded-For` is ignored unless you set
+  `trusted_proxy_hops`, and then only the proxy-written entry is used. The
+  reverse proxy strips forged forwarding and `X-SentryCove-*` headers.
+- **Unknown addresses are never banned**: if the client address cannot be
+  determined, IP bans and per-IP counters are skipped rather than applied to
+  everyone at once.
+- **Decision API is authenticated**: every call needs a bearer token, compared
+  in constant time; it binds to localhost by default.
+- **Bounded memory**: every tracker is size-capped and expires.
+- **Privacy**: session tokens are stored only as truncated SHA-256 hashes; raw
+  tokens never appear in alerts. Webhook URLs come from environment variables.
+- **Strict config**: unknown keys are rejected so a typo cannot silently
+  disable a protection.
+
+## Limitations (honest list)
+
+- State is **per process**. With several workers or hosts, counters and bans
+  are not shared (a shared Redis backend is planned). Run one SentryCove
+  process per app for now.
+- **Reverse proxy**: no WebSocket support yet (connections are refused), no
+  TLS termination (run it behind your load balancer, Caddy or nginx), and it
+  is a single Python process — fine for small and medium sites, not a CDN.
+- **Next.js / edge runtimes** cannot see the response status, so failed-login
+  monitoring needs the Express middleware or the reverse proxy; see
+  [`clients/node`](https://github.com/XSiddhSaraf/sentrycove/tree/main/clients/node) for how the client address is determined.
+- Session-hijack detection compares User-Agent and Accept-Language, so a
+  browser auto-update can cause a false positive. It alerts; it never blocks.
+- Web Bot Auth is an IETF **draft**; the verifier implements Ed25519 signatures
+  with `@method`, `@authority`, `@scheme`, `@path`, `@query` and header
+  components (including `;key=` dictionary members). Key-directory response
+  signatures are not yet verified (HTTPS to a trusted origin is relied on).
+- Behind a proxy that rewrites `Host`, signatures covering `@authority` will
+  fail to verify — preserve the original Host header.
+
+## Roadmap
+
+- Publish to PyPI, npm, NuGet and a container registry
+- Shared state via Redis; WebSocket proxying; JA4 TLS fingerprints
+- LLM-assisted alert triage: plain-language "what happened, how bad, what to do"
+- Optional hosted console: fleet view, shared threat intelligence, team alert routing
+
+## Repository layout
+
+```
+src/sentrycove/     engine, ASGI middleware, reverse proxy, decision API, CLI   (Python)
+clients/node/       Express middleware and Next.js / fetch guard                (TypeScript)
+clients/dotnet/     ASP.NET Core middleware                                     (C#)
+deploy/             Docker Compose examples
+examples/           example policy and FastAPI app
+```
+
+## Development
+
+```bash
+pip install -e ".[dev]"
+pytest
+ruff check src tests && mypy --ignore-missing-imports src
+
+(cd clients/node && npm ci && npm test)
+dotnet run -c Release --project clients/dotnet/tests/SentryCove.AspNetCore.Tests
+```
+
+Releases are described in [RELEASING.md](https://github.com/XSiddhSaraf/sentrycove/blob/main/RELEASING.md).
+
+The Node and .NET suites start the real decision API and run the middleware
+against it. The Python suite includes real-socket reverse-proxy tests, an
+interoperability test that verifies signatures produced by the independent
+`http-message-signatures` library, and the RFC 8037 JWK-thumbprint vector.
+
+## License
+
+Apache-2.0. Contributions require agreeing to the CLA — see
+[CONTRIBUTING.md](https://github.com/XSiddhSaraf/sentrycove/blob/main/CONTRIBUTING.md). Report vulnerabilities privately as
+described in [SECURITY.md](https://github.com/XSiddhSaraf/sentrycove/blob/main/SECURITY.md).