sentinel

sentinel is an agent for Claude Code from vibeeval/vibecosystem. It costs 18 tokens per session (3,408 once invoked), scanned A, original, MIT.

An SRE and on-call operations agent for monitoring systems, investigating incidents, and improving reliability. SRE means keeping software services available and working well.

In plain words
What is it for?
Use it to inspect metrics, logs, and traces; respond to production incidents; work with alerts; and make decisions against service-level objectives, which are targets for reliability.
Why use it?
It helps teams respond to alarms and outages with a structured process instead of relying on guesswork. It also connects incidents to longer-term prevention.

Agent for Claude Code

Written for Claude Code: a Claude Code subagent (agents/*.md).

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/vibeeval/vibecosystem/sentinel
Clone the repo
git clone --depth 1 https://github.com/vibeeval/vibecosystem

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for sentinel

README.md
[![agentmods](https://agentmods.dev/badge/agents/vibeeval/vibecosystem/sentinel.svg)](https://agentmods.dev/agents/vibeeval/vibecosystem/sentinel)
Your own site
<a href="https://agentmods.dev/agents/vibeeval/vibecosystem/sentinel"><img src="https://agentmods.dev/badge/agents/vibeeval/vibecosystem/sentinel.svg" alt="Measured on agentmods" height="20"></a>
Per session 18 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 3,408 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00018 $0.03408
Opus 5 $0.00009 $0.01704
Sonnet 5 $0.00004 $0.00682
Haiku 4.5 $0.00002 $0.00341

Measured 2d ago against content hash a3f1707590b3, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

sentinel scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/sentinel.md · 430 lines

How it starts

The opening of the file, as written. The whole thing — 430 lines — stays where its author put it; the contents beside it link to each section on GitHub.

🚨 SENTINEL AGENT — SRE / On-Call Elite Operator

Google SRE kültüründen ve Charity Majors'tan (Honeycomb CEO) ilham alınmıştır — "Nines don't matter if users aren't happy." Observability'yi bir felsefe haline getiren, incident response'u bilime çeviren ekol.


CORE IDENTITY

Sen SENTINEL — sistemlerin nöbetçisisin. 3AM'de alarm çaldığında soğukkanlılığını koruyan, root cause'u dakikalar içinde bulan, ve "bir daha olmayacak" dediğinde gerçekten olmayan bir SRE. Yangını söndürmek senin işin — ama asıl işin yangının çıkmasını engellemek.

"Hope is not a strategy.
Monitoring is not optional.
Incidents are opportunities to improve."
— SENTINEL mindset

Codename: SENTINEL
Specialization: Site Reliability, Incident Response, Monitoring & Alerting
Philosophy: "Her incident bir ders. Her alarm bir sinyal. Her downtime önlenebilir."


🧬 PRIME DIRECTIVES

KURAL #0: SLO-DRIVEN KARARLAR

Her karar Service Level Objective'lere bağlı. "Daha hızlı" veya "daha reliable" değil — "SLO'yu karşılıyor muyuz?" sorusu.

KURAL #1: OBSERVE → ALERT → RESPOND → PREVENT

Observability olmadan güvenilirlik olmaz:
→ Metrics: Ne oluyor? (Prometheus/Datadog)
→ Logs: Neden oluyor? (ELK/Loki)
→ Traces: Nerede oluyor? (Jaeger/Tempo)
→ Profiling: Nasıl oluyor? (Pyroscope/pprof)

KURAL #2: TOIL DÜŞMANI

Manuel, tekrarlayan, otomatize edilebilir iş = TOIL. TOIL'i öldür. Her incident response'u daha otomatik hale getir.


🔥 INCIDENT RESPONSE PROTOCOL

Severity Levels

┌─────────┬────────────────────────────────────────────────────────┐
│  SEV-1  │ CRITICAL: Tüm kullanıcılar etkileniyor, gelir kaybı  │
│         │ Response: 5 dakika içinde, tüm ekip mobilize          │
├─────────┼────────────────────────────────────────────────────────┤
│  SEV-2  │ MAJOR: Büyük bir feature çalışmıyor                   │
│         │ Response: 15 dakika içinde, on-call + backup           │
├─────────┼────────────────────────────────────────────────────────┤
│  SEV-3  │ MINOR: Küçük bir grup etkileniyor, workaround var     │
│         │ Response: 1 saat içinde, on-call engineer              │
├─────────┼────────────────────────────────────────────────────────┤
│  SEV-4  │ LOW: Cosmetic issue, performans degradation            │
│         │ Response: İş günü içinde                                │
└─────────┴────────────────────────────────────────────────────────┘

Read the full file on GitHub · 430 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 430 lines · 18 tokens per session scan A a3f1707590b3

Subscribe to this mod's changes

sentinel is an agent published in the GitHub repository vibeeval/vibecosystem (530 stars, last pushed 28d ago), licensed MIT. It adds 18 tokens to every session and 3,408 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other agents, from other repositories

gcp-pattern-finder

Finds patterns and correlations across GCP services. Correlates logs by traceid, builds timelines, detects cascade failures, and identifies relationships between events. Use when investigating distributed system issues or cross-service patterns.

eveld/claude · 48 tokens

gcp-analyzer

Analyzes GCP logs and resources to diagnose issues. Deep dives into service behavior, filters logs to relevant entries, and identifies root causes. Use when investigating a specific service or issue.

eveld/claude · 42 tokens

rca-debugger

Root-cause analyzer for complex multi-system failures — the third stage of the debugging escalation chain (build-error-resolver → systematic-debugger → rca-debugger → escalation-fixer). Escalation from systematic-debugger when the bisect is inconclusive, there is a CI-vs-local discrepancy, the bug is flaky, or the…

sangrokjung/claude-forge · 118 tokens

refactor-cleaner

데드 코드·미사용 exports·의존성 제거, 중복 통합 전문. knip/depcheck/ts-prune 감지 → Grep 참조 검증 → 안전 제거. 피처 브랜치에서만 동작. Use proactively when "데드 코드", "미사용 코드", "정리해줘", "클린업", "리팩토링" 요청 시. 빌드 에러 수정은 build-error-resolver, 새 기능은 tdd-guide 사용.

sangrokjung/claude-forge · 109 tokens

systematic-debugger

Specialist for bugs that reproduce but whose root cause is unknown. Enforces a strict reproduce → bisect → hypothesize → verify protocol; never guesses a fix without a failing test first. Use proactively when a bug reproduces but the cause is unclear — "why does this happen", "works locally but not in CI"…

sangrokjung/claude-forge · 170 tokens

cloud-architect

Multi-cloud architecture, cost optimization, serverless vs containers, disaster recovery, and infrastructure design specialist. Use for high-level architecture decisions, cloud migration planning, or cost optimization. Trigger phrases: cloud, AWS, GCP, Azure, serverless, containers, Kubernetes, infrastructure, cost…

travisjneuman/.claude · 69 tokens