sentinel

1.9.0-betaindexed

Lightweight, modular security toolkit performing on-device threat detection and continuous RASP monitoring, with configurable detectors, DSL configuration, smart weighted risk aggregation and detailed incident reports.

AndroidNative·rexiox/sentinel

Stars

—

Used by

dependents

—

Health

/ 100

Logo

Sentinel is a lightweight, modular Kotlin Multiplatform security toolkit designed to analyze runtime environments and detect potential security threats in real time on both Android and iOS.

[!CAUTION] Development Stage Notice: Sentinel is currently in active development and testing phase. API structures may change, and new features are being added regularly. Caution is advised when using in production environments.

Documentation

For detailed usage guides, API references, and integration steps, please visit our official documentation: Sentinel Documentation

Why Sentinel?

Most mobile apps rely only on server-side security, but attacks happen on the client. Sentinel provides real-time, on-device threat detection with minimal performance overhead.

☑️️ Detect compromised devices (root / jailbreak)
☑️️ Detect runtime manipulation (Frida, Xposed (Android))
☑️️ Detect app tampering & reverse engineering
☑️️ Detect emulators & unsafe environments
☑️️ Designed for Kotlin Multiplatform (KMP)

Features

♦️ Works on Android and iOS with a single codebase. ♦️ Easily enable, disable, or extend security checks. ♦️ Weighted category scoring to prevent artificial risk inflation. ♦️ Set your own critical risk level to control app behavior. ♦️ Use a clean and expressive API for configuration. ♦️ Get a full breakdown of detected threats. ♦️ Minimal runtime overhead for optimal performance. ♦️ Real-time monitoring of dynamic instrumentation, hooking, and injection attempts.

Security Coverage

The Sentinel delivers broad-spectrum security coverage for Android and iOS, protecting against multiple threat types.

Quick Start

implementation("co.rexiox:sentinel:{version}")

You can use the following method to print the appId and appIntegrity values required for your security or configuration processes and assign them to the relevant fields within the config as a ByteList:

appId: Package name for Android, Bundle Identifier for iOS
appIntegrity: Package signature for Android, unique digital fingerprint of the Provisioning Profile file for iOS

SentinelLogger.print(tag = "APP_ID", msg = Sentinel.Identity.appId.toByteList())
SentinelLogger.print(tag = "APP_INTEGRITY", msg = Sentinel.Identity.appIntegrity.toByteList())

Android Usage

val sentinel = Sentinel.configure(context = context) {
    config {
        appId = listOf<Byte>()
        appIntegrity = listOf<Byte>()
        threshold = 90
        isLoggingEnabled = true
    }

    all()
    // root()
    // tamper()
    // hook()
    // emulator()
    // debug()
    // location()
}

iOS Usage

val sentinel = Sentinel.configure {
    config {
        appId = listOf<Byte>()
        appIntegrity = listOf<Byte>()
        threshold = 90
        isLoggingEnabled = true
    }

    all()
    // jailbreak()
    // tamper()
    // hook()
    // simulator()
    // debug()
}

Running Inspection

Instead of basic checks, Sentinel performs a thorough inspection of the environment and provides a detailed report based on threat severity.

inspect() is a suspend function and must be executed within a coroutine scope.

val report = sentinel.inspect()

Report

After the inspection completes, Sentinel returns a SecurityReport. This report aggregates all detected threats and provides a unified severity score and risk level for the current runtime environment.

You can optionally log the report to the console / logcat for debugging purposes:

SentinelLogger.report(report = report)

RASP - Runtime Application Self-Protection (Detection)

Sentinel extends protection beyond initial startup checks by continuously monitoring the application during runtime. Through background scanning mechanisms, it detects unauthorized access attempts, runtime tampering, and external manipulation activities in real time.

sentinel.runtime {
    onCompromised {
        print(msg = "Device integrity failed (Root/Jailbreak detected).")
    }

    onTampered {
        print(msg = "App tampering detected.")
    }

    onHooked {
        print(msg = "Runtime hook detection.")
    }

    onSimulated {
        print(msg = "Running on Emulator/Simulator environment.")
    }

    onDebugged {
        print(msg = "Active debugging session detected.")
    }

    onCritical { score ->
        print(msg = "High risk score reached: $score")
    }

    onSafe {
        print(msg = "All systems nominal.")
    }
}

Attestation

Sentinel Attest is a KMP module that cryptographically signs the device integrity report generated by Sentinel and transmits it to the server. It adds a server-side verification layer on top of Sentinel, which operates solely on the client side.

It enables the configuration of Play Integrity for Android and App Attest for iOS. The encrypted payload transmitted to your server includes the token data from your defined configurations, along with the client-side security report generated by Sentinel.

For detailed information, please refer to the documentation.

implementation("co.rexiox:sentinel-attest:{version}")
implementation("co.rexiox:sentinel-crypto:{version}")

SentinelAttest.configure {
    provider = attestProvider

    publicKey = "RSA_PUBLIC_KEY"

    nonce {
        // Retrieves a backend-generated nonce to uniquely bind and validate the attestation request.
        apiService.getSecureNonce()
    
        // Client-side nonce generation (not recommended, less secure than server-provided nonce)
        // generateSecureNonce()
    }
    
    callbacks {
        verify { encryptedAttestation ->
            // Receives the encrypted attestation payload and forwards it to the backend for verification.
            // apiService.verifyAttestation(body = encryptedAttestation)
        }

        onError { error ->
            
            print()
        }

        onComplete {
            
        }
    }
}

sentinelAttest.execute(report = sentinel.inspect())

Sentinel Monitor

Sentinel Monitor is a monitoring infrastructure that tracks application-layer vulnerabilities and suspicious activities in real-time and reports these threats.

https://github.com/user-attachments/assets/00502b7b-5955-4fef-b00b-ccaa57311790

implementation("co.rexiox:sentinel-monitor:{version}")

SentinelMonitor.start(
    appId = sentinel.config.appId.orEmpty(),
    appIntegrity = sentinel.config.appIntegrity.orEmpty(),
    threshold = sentinel.config.threshold
)

Samples

Risk Scoring

Sentinel employs a weighted risk assessment instead of a basic summation approach

Groups threats by category
Takes the highest severity per category
Produces a realistic risk score

This approach prevents artificial risk inflation and provides a more accurate security assessment.

Benchmark

Detailed benchmark reports are available at the following link: Benchmark Report

License

Related libraries

Surfaced from shared tags and platforms — no rankings paid for.

klibnotion★ 58

BoDClient library for interacting with the Notion API, offering coroutine-based, blocking, and future-based flavors. Facilitates OAuth support, pagination, content creation with DSL, and configurable logging/proxy settings.Shared: sdk, logging, kotlin-coroutines

konnection★ 170

TM-AppsLibrary emits network connection status, offers immediate connection state checks, IP info retrieval, and network state observation. Supports customizable instance creation and includes default IP resolvers.Shared: sdk, kotlin-coroutines, apple

blurhash★ 93

vanniktechFacilitates encoding and decoding of blur hashes in applications, addressing inconsistencies in existing implementations. Offers a unified API and sample apps for various platforms, ensuring consistent image processing.Shared: sdk, kotlin-multiplatform-sample, apple

TextToSpeechKt★ 57

Marc-JBCross-platform text-to-speech library enabling speech synthesis with coroutine support. Features include volume, pitch, and rate adjustments, with Compose integration for enhanced functionality.Shared: sdk, kotlin-coroutines, apple

KMM-BLE-Library★ 40

nordicsemiUnifies Bluetooth Low Energy API for Android and iOS, offering a common interface. Includes an example app showcasing functionality with Compose Multiplatform and native iOS classes.Shared: sdk, kotlin-multiplatform-sample, apple

kmp-live-activity★ 39

software-mansion-labsLive Activity API to start, update, and end Live Activities from shared code, with manager abstraction, example app, and comprehensive API documentation.Shared: sdk, kotlin-multiplatform-sample, apple

Root/Jailbreak	✅	- Su Binary - Suspicious Mount - App Installed - Su Command	✅	- Sandbox - Suspicious Symlinks - App Installed - URL Schemes
Tamper	✅	- Package Name Changed - Signature Mismatch	✅	- Bundle Id Changed - Provisioning Hash Mismatch
Hooking	✅	- Framework Detected	✅	- Framework Detected - Inline Hook Detected
Environment	✅	- Emulator Detected	✅	- Simulator Detected
Debugger	✅	- Debugger Attached - Debuggable - Test Keys	✅	- Debugger Attached
Location	✅	- Mock Setting Enabled - Mock App Installed - isMocked()	-