Architecture Overview

Overview

Sentari uses a lightweight agent-server architecture. A single-binary Go agent runs on each device, discovers software across every ecosystem, and reports to a central FastAPI server over mTLS. A React dashboard provides fleet-wide visibility.

Agent

• Language: Go 1.23, compiled as a static binary (CGO_ENABLED=0)
• Size: ~15 MB, zero runtime dependencies
• Scanning: Reads package metadata files directly — never invokes pip, conda, or poetry
• Offline queue: SQLite cache stores scans when the server is unreachable
• Communication: Outbound HTTPS only, mTLS with certificates from the internal CA

Server

• Framework: Python 3.12, FastAPI, SQLAlchemy 2.0
• Database: TimescaleDB (PostgreSQL 16) for time-series scan data
• Background tasks: Celery + Redis for CVE correlation, SBOM generation
• Auth: JWT + session cookies, RBAC, LDAP/OIDC, TOTP/2FA
• Internal CA: Issues mTLS certificates to agents during enrollment

Dashboard

• Framework: React 18, TypeScript, Vite
• Served by: FastAPI as static files — no separate deployment needed
• Real-time: TanStack Query for automatic data refresh

Security Model

Key security properties:

• Zero telemetry: No data ever leaves your infrastructure
• mTLS everywhere: Mutual TLS on all agent-server communication
• Outbound-only: Agents initiate connections; server never connects to agents
• Immutable audit logs: Append-only with SHA-256 hash chain
• No binary invocation: Agent reads metadata files, never executes package managers