Sentinel-IaC — VS Code Extension

Built by KdG (Karel de Grote Hogeschool Antwerp) students as part of a lab project. Sentinel-IaC is an AI-powered security scanner and optimizer for Infrastructure as Code files, directly integrated into your VS Code editor.

What is Sentinel-IaC?

Sentinel-IaC helps developers and DevOps engineers catch security misconfigurations in their IaC files before they reach production. It scans Terraform, Kubernetes, Helm and other IaC formats, explains what's wrong, and automatically generates fixes — powered by AI and a local knowledge base.

Features

Security Scanning

• Scan your entire workspace or just the current file
• Supports .tf, .hcl, .yml, .yaml, .chart files
• Combines static analysis (Checkov) with AI analysis (Gemini / ChatGPT)
• Real-time progress with ETA during workspace scans
• Results cached by file content — no redundant re-scans

AI-Powered Fix Generation

• Generate fixes for individual issues or fix all issues in a file at once
• Three confidence tiers:
  • Verified (≥ 0.75) — fix matches a known secure pattern from the knowledge base
  • Suggested (≥ 0.55) — fix is directionally guided by a related example
  • AI-Generated (< 0.55) — fix is based on general AI knowledge
• Preview diffs before applying any change

Knowledge Base

• Manage your own vector database of security documentation and code examples
• Ingest .md, .txt, or .pdf files into two collections:
  • sentinel_documentation — best practices, guidelines, policies
  • iac_code_examples — verified secure code patterns
• The knowledge base improves fix quality via RAG (Retrieval-Augmented Generation)
• Supports local, remote, or GCP Cloud Run hosted Qdrant

Runtime Optimizer (GCP only)

• Connect to your GCP project and analyze live Kubernetes workloads
• Detects overprovisioned, underprovisioned, or unstable pods
• Shows CPU and memory utilization from Cloud Monitoring
• Apply resource adjustments (limits/requests) directly via kubectl

Requirements

The extension automatically downloads a sidecar binary on first launch — no Python or Docker installation needed.

Getting Started

1. Install the Extension

Install from the VS Code Marketplace or via the .vsix file:

Extensions → ⋯ → Install from VSIX...

2. Configure Your AI Provider

Click the gear icon in the Sentinel-IaC panel and:

1. Choose your AI provider: Gemini (default) or ChatGPT
2. Select a model
3. Enter your API key

Sentinel-IaC uses your own API key — no account or subscription with us is needed. You pay the AI provider directly based on your usage.

Important: Both Gemini and ChatGPT require a paid API plan. There is no free tier supported. Make sure your API key has an active billing account before running scans.

Your API key is never stored in plain text. It is saved exclusively in VS Code's built-in secret storage (SecretStorage) — an encrypted, OS-level credential store local to your machine. It is never sent anywhere except directly to the AI provider's API.

3. Run Your First Scan

• Open a workspace containing .tf, .yaml, or .hcl files
• Click Scan Workspace or Scan Current File in the Sentinel-IaC panel
• Review findings, expand issues, and click Generate Fix to get an AI-powered fix
• Preview the diff and click Apply to patch the file

AI Providers

Qdrant Vector Database

The knowledge base requires a Qdrant instance. Three deployment options:

Settings Reference

Architecture

VS Code Extension (TypeScript + React UI)
        │
        │ HTTP
        ▼
Sidecar (Python FastAPI — auto-downloaded)
        │
        ├── AI APIs (Gemini / ChatGPT)
        ├── Checkov (static analysis)
        └── Qdrant (vector database)

The sidecar runs locally on http://127.0.0.1:8000 and is started automatically when VS Code opens. It handles all AI calls, static analysis, and vector search so the extension itself stays lightweight.

Troubleshooting

Sidecar won't start

• Check the Sentinel-IaC Sidecar output channel (View → Output → Sentinel-IaC Sidecar) for error details
• Make sure port 8000 is not in use by another process

500 error when ingesting files

• Make sure your API key is configured in the settings (gear icon)
• The API key is required to generate embeddings during ingestion

Google login fails (Runtime Optimizer)

• Make sure gcloud CLI is installed: https://cloud.google.com/sdk/docs/install
• Run gcloud auth login manually in a terminal to verify it works

Scan returns no results

• Confirm your workspace contains supported file types (.tf, .hcl, .yaml, .yml, .chart)
• Files with fewer than 3 meaningful lines are skipped

About

Sentinel-IaC was built by students of Karel de Grote Hogeschool (KdG) as part of a lab assignment. The goal was to create a practical, developer-friendly tool that brings AI-assisted security scanning directly into the editor — without complex setup or cloud dependencies.

For issues or feedback, please contact the project team.