This is a submission for the Hacktoberfest Open-Source AI Challenge Week 2: Side Hustle
What I Built
Title: Sentinel: Know Your AI Tools Before They Know Too Much About You
Sentinel is a small app for freelancers and small teams who have started using AI tools without really checking what those tools do with their data.
Why I Built It
AI is being used in companies to simplify tasks and help, but sometimes, it obtains access to sensitive information it is not supposed to see, which might result in security issues.
Big companies have governance teams and expensive software for this. Small firms and freelancers usually have neither, and are more potent to meet those security issues. Sensitive data can be used by AI without people knowing, and that is why I built Sentinel.
How It Works
Sentinel registers every AI tool you use, who owns it, what kind of data it touches, how risky it is, and whether it's approved. Then there's a shadow check. You paste in a list of tool names or website domains from your expense records or network logs, and Sentinel shows you the ones that aren't in your register yet. For each one, it suggests an alternative and drafts a short one-page policy you can read, instead of long, tedious ones.
A backup plan is included in Sentinel: Each AI feature has a main engine and a fallback. If the cloud model is busy or unreachable, the app switches over, keeps working, and writes the switch to a log so you can always what happens without interruption.
The register: Add a tool, give it an owner, mark what data it touches, and set a risk level. Everything stays in your browser, so it's still there after a reload, and it's still there the next time you open the app.
The shadow check: Paste a list like chatgpt.com, notion.so, mystery-ai.io. Sentinel cleans each name, removes the "www." and the path, and compares what's left with your register. Only the unmatched names appear. This part is plain matching, with no AI involved, so the same input always gives the same answer.
The AI comes in afterwards to help. It suggests alternatives and writes the draft text.
The backup: Each AI feature has a primary engine and a fallback, and the chain goes: cloud Gemma 4, then a second Gemma 4 model, then built-in templates. Each attempt is logged with the engine that answered and how long it took. There's a "simulate outage" button, so you can test the switch yourself without unplugging your Wi-Fi.
The chain goes: cloud Gemma 4, then a second Gemma 4 model, then built-in templates. Each attempt is logged with the engine that answered and how long it took. There's a "simulate outage" button, so you can test the switch without unplugging your Wi-Fi.
The Models
You pick the engine in Settings. There are three choices.
-
Cloud, Gemma 4. It uses
gemma-4-31b-it, withgemma-4-26b-a4b-itas the fallback, through Google's Gemini API. It needs internet. - On-device, Gemma 2 2B. It runs in your browser with WebLLM and needs a WebGPU-capable browser and a one-time download of about [size] MB.
- Templates.: It consists in rule-based suggestions and policy text. They always work, online or offline.
Offline Mode
The functionalities that work without internet are:
- The register: adding, editing, deleting, and keeping your tools after a reload
- The shadow check
- Template suggestions and policy drafts
- The outage simulation, including the switch to templates
But these ones need internet:
- Suggestions from Gemma 4
- The first download of the app itself
- Error reports to Sentry, which are sent once the connection is back
What It Doesn't Do
- The policy drafts are for review. They are not legal advice, just a summary and synthesis of the overall policy of the used AI tools.
- The register is only as accurate as what you enter, so a wrong risk level stays wrong until you change it.
How I Built It
I used Antigravity IDE Agent for this project.
Sentinel is written in Vite, React, and TypeScript, styled with Tailwind. Dexie stores everything in IndexedDB, and vite-plugin-pwa provides the service worker, so the app loads offline after the first visit. Mastra runs the engine chain, one step at a time, and Sentry records errors and outages.
Your Google API key goes in Settings and stays in your browser. It isn't built into the app. In consequence, Sentinel is meant for your own computer or your team's shared one, and cannot be accessed through another device.
Why Does Open Innovation Matter?
I'm building this from Antananarivo, Madagascar, where money is scarce and billings weight a lot on our daily activities. Enterprise governance tools are priced for companies with budgets, billing setups, and procurement teams. Plenty of local freelancers and small firms have none of that, and a card that works in some places doesn't always work here.
Gemma is open-weight. That means the fallback can run on your own device with no subscription, and the model can be swapped without rebuilding the app.
The offline path matters for the same reason. If a client's contract is on your laptop, you shouldn't need a cloud account just to check where its data has been sent.
My Agent Session
I need you to build Sentinel, a small web app that helps small companies and freelancers keep track of the AI tools they use, identify shadow usage, manage permissions, control spending, and prepare for AI service outages. Offline use is the priority.
I planned and built Sentinel with an offline-first architecture using React 19, TypeScript, Tailwind CSS, and Dexie (IndexedDB).
Key implementations:
1. AI Tool Register with CRUD and strictly manual human approval.
2. Deterministic Shadow AI Check normalizing inputs and matching tools without external AI.
3. Multi-tier AI Fallback: Cloud Gemma 4 (8s timeout) -> On-Device WebLLM Gemma 2 2B -> Deterministic Offline Templates.
4. Outage Simulation Controller with 3-tier cycle and Dexie logging.
5. Permission Checker auditing OAuth scopes against a fixed risk table.
6. Spending Forecaster calculating 3-month linear trends labeled 'simple trend, not a model'.
7. Tinker fine-tuning dataset export and 20-case held-out benchmark (100% accuracy).
Test Suite: 25/25 tests passing.
Production Build: Clean PWA build with service worker precaching.
My struggles
I didn't find any good idea, for a long time. It took me lots of researches through the Internet to find security problems I could solve.
I used Cursor at the first time, but my free tier has been used up very quickly, so I had to start all over again with Antigravity, with the same prompt.
What I Learned
It was the first time I used Sentry, so it was a whole discovery for me, about how it worked through my project, its features and its potential.
I took consciousness of the importance of security, confidentiality and carefulness when using AI tools. If we don't read policies, official documents and description before using a tool, we might overlook crucial conditions and use scopes of the concerned tools.
I also learned to sharpen my problem-solving skills, through the Cursor quota uses and the open-weight models that didn't work on my device.
Prize Categories
- Best Use of Gemma: Gemma 4 is the main engine for suggestions and drafts, with a Gemma 2 2B option on device.
- Best Use of Sentry: errors and outages are recorded by Sentry, and the outage log is visible in the app.
- Best Use of Mastra: Mastra runs the engine chain.
Top comments (0)