Sentinel mr-report 0.2.0 URL adress: https://gitlab.com/jakubrojicek11/sentinel-mr-report/-/tree/v0.2.0?reftype=tags
If an AI agent changes your code, who checks what the code is now capable of doing?
It is small. It is JavaScript-only. It does not use an LLM. It does not need an account. It does not send your source code to a remote service.
It simply looks at the old and new versions of changed JavaScript files, extracts facts from the syntax tree, and tells you how the capability or risk surface changed.
And if you want it to, it can fail your GitLab pipeline when a dangerous capability appears.
Why should we make an AI rediscover facts that a deterministic program can establish directly?
Yesterday, one of your JavaScript files could: read a configuration value, read a file, make an HTTP request.
«"Please understand all of this and tell me whether anything important changed."»
If the syntax tree establishes that a file gained a call to "childprocess", we don't need a language model to have an existential crisis about whether "childprocess" exists.
That's a terrible way to spend everyone's afternoon if the question can be answered mechanically.
«Before: no process execution After: process execution Evidence: "childprocess.exec" File: "runner.js"»
For each changed ".js" file, it can compare the old and new versions directly from the Git objects available inside the CI runner.
«"Something security-related may have changed somewhere in this enormous diff."»
The MR Report itself uses: Git Tree-sitter deterministic fact extraction ordinary program logic
It does not need: an LLM an OpenAI API key an external analysis service telemetry a Sentinel account
Your source code does not need to be uploaded somewhere just to answer a basic question about what changed.
If the same input is processed twice, the fact extraction does not suddenly wake up in a different mood.
«"Yesterday the model thought "exec()" looked suspicious, today it feels pretty chill about it."»