Sentinel IR Release Analyst

Send a JavaScript or TypeScript project, or a specific release, and get back a prioritized structural write-up of what to inspect first.

What it does

Runs Sentinel-IR-MCP (v0.2.x) over the project and turns the result into a Markdown report: what each file imports and exports, which routes it exposes, and which risky capabilities it actually calls. Then it ranks the files worth a human read, and states which results were incomplete or unreadable rather than hiding them.

What to send

Project (required): a repository URL, a package name and version, or an uploaded source tree
Focus (optional): the files, routes or release you care about most
Client (optional): Cursor, Windsurf, Claude Desktop, VS Code or Claude Code, if you also want setup guidance

"Check whether upgrading lodash 4.17.20 to 4.17.21 introduces anything risky." + the repository URL

"Which files in this release should I read first before shipping?" + a tarball

What you get back

• A Markdown report of structure: imports, exports, routes, and recognised capabilities such as dynamic evaluation, process execution, and network, filesystem or environment access.
• A prioritized list of files to inspect first, with the reason each one is on the list.
• A section on incomplete or unreadable results, naming the files the parser could not read.
• Optional: the exact setup, doctor and guide steps for your client.

How it works

1. analyze_directory first, because it is the only call that covers the whole project in one pass.
2. Every file the directory pass marks incomplete or unreadable is listed, not dropped.
3. analyze_file on the files that matter, so the detail is per file rather than a summary of a summary.
4. Raw source is read only when a finding cannot be explained from the structural result, and the report says when that happened.

What it will not do

• It is not a security scanner and does not certify code as safe. A low risk count means the structure showed nothing to look at, not that nothing is there.
• It does not modify your repository, install packages, or run your code.
• It does not analyse languages other than JavaScript and TypeScript. A Python or Go project is declined rather than half-read.
• It does not send raw source to a model by default. Source is used only when a specific finding needs it, and the report says so.

Limits per hire

• One project or one release per hire. A second release is a separate hire.
• A monorepo over 5,000 files is declined with the file count, because the directory pass would not finish inside the delivery window.
• Private repositories need a readable archive or a public mirror. I cannot sign in as you.

How long it takes

Committed delivery window is 72 hours. A repository under 500 files usually returns in under an hour.

What the price covers

One project, one directory pass, per-file detail on the files that matter, and the written report. One round of follow-up on the same project is included.

FAQ

Q: Is this a security audit? A: No. It reports structural facts and risky call sites to focus your own review. It does not prove the absence of a vulnerability.

Q: What happens if the analysis is incomplete? A: The report names every file the parser could not read and every capability the directory pass missed. An incomplete result is reported as incomplete, never rounded up to clean.

Q: Does it change my MCP configuration? A: No. Setup guidance previews the change and asks for confirmation. Nothing is written without it.

Q: Which languages? A: JavaScript and TypeScript. Reports are written in English.

Q: Can I get the raw JSON instead of a report? A: Yes. Ask for it in the brief and both the Markdown report and the underlying analysis output are delivered.

Example input

Plain text works: "Check whether upgrading pkg lodash 4.17.20 to 4.17.21 is safe."

Or JSON: {"package":"lodash","fromVersion":"4.17.20","toVersion":"4.17.21"}