Inspect any dependency before you trust it.

This playground demos Sentinel 1.1.0 remote verify for npm, GitHub, PyPI, crates.io, Go modules, and Docker images. It downloads and statically analyzes; it never executes installers. Full install gates live in the CLI and MCP.

v1.1.0/download-only/verdict in seconds/target never executes

sentinel@playground: ~/verifyread-only

Static analysis only. Targets are downloaded, read, and discarded; nothing executes.
Try: verify npm lodash · verify pip tomli · verify cargo serde · verify docker hello-world · help

examples:

Why this is safe to run

The serverless function imports a single entry point: verify(). The capabilities that touch your shell, your filesystem, or untrusted archives are never wired in. What you can reach is the whole attack surface.

verify · npm / github / pip / uv / cargo / go / dockerBounded download, identity check, then static analysisreachable

installWould spawn package managers — use CLI/MCP locallynever imported

local · skill · scan_directoryWould read the server filesystemexcluded

scan_archiveZip-bomb surfaceexcluded