Five products. One principle: only flag what's confirmable.

The map

Where each product sits

Pick by where the risk lives. The first three guard your app; Patrol is the internet-scale scanner pillar behind the in-the-wild disclosures; the CLI is the pre-release audit you run before you ship.

Product 1 · runtime guard · @lictor/sentinel (npm) · lictor-sentinel (pip)

A guard that rides along with every model call

Sentinel wraps your existing OpenAI or Anthropic client with a recursive Proxy, so it sees calls at any depth (client.chat.completions.create, client.messages.create, and nested helpers) without you rewriting a line of your own logic. Before a request leaves, it runs pre-flight checks on the input text. After the model answers, it runs post-flight checks on the output. Seven detectors total, the same seven in both the npm and pip builds, so a Node service and a Python worker behave identically.

Install is one line: you wrap() the client and keep using it as before. Apache 2.0, and no telemetry: nothing about your prompts or completions is sent anywhere.

Pre-flight detectors · run on the input

Post-flight detectors · run on the output

Install · one line, then nothing changes

# Node, npm
npm install @lictor/sentinel

// then wrap your client once
import OpenAI from "openai";
import { wrap } from "@lictor/sentinel";

const client = wrap(new OpenAI());
// use `client` exactly as before; pre/post-flight checks run on every call

# Python, pip
pip install lictor-sentinel

# then wrap your client once
from anthropic import Anthropic
from lictor_sentinel import wrap

client = wrap(Anthropic())
# use `client` exactly as before; same 7 detectors as the npm build

Want to see what each detector maps to in the standards? The prompt-injection, output-handling and exfiltration detectors line up with the OWASP Top 10 for LLM apps in the coverage map.

Product 2 · browser extension · Lictor Shield

Audit the site you're actually looking at

Shield runs 10 checks against a deployed site: the real thing on the real domain, not your source tree. It is observe-only: it reads what the browser already has and makes a small number of plain requests, single-lane at one request per second per host, always with credentials: omit so it never rides your logged-in session. The pattern-matching is done by a Rust core compiled to WASM, so the heavy scanning happens locally in the page, fast, with no server round-trip.

The 10 live checks

Shield holds itself to the same evidence bar as the audit. See the false positives we filter for why a bare 200 OK is never enough to call something exposed.

Product 3 · hosted dashboard · Lictor Guardian

The findings, gathered over time

Sentinel and Shield each tell you about a moment. Guardian is the place those moments add up. It's a hosted dashboard and incident timeline that aggregates findings over time, so you can see whether a problem is new, recurring, or finally resolved, and tell that story to the people who ask. Free as a 90-day preview.

Product 4 · continuous scanner pillar · Lictor Patrol

The engine behind the in-the-wild disclosures

Patrol is the internet-scale scanner pillar. It starts with passive recon (what's already public, gathered without touching the target) and adds a precision-gated active tier that confirms a narrow set of high-signal exposures. Every finding, passive or active, passes through a central verify gate before it is ever reported. Until a human confirms it, a finding is SUSPECTED, never asserted. Disclosure is ethical and observe-only: Patrol looks, it does not break in.

The precision-gated active tier

These are the exposures the active tier confirms: each one observable from the outside, none requiring an attack.

The verify gate exists for the same reason as the audit's guards. See how Patrol decides "reachable" is not "exploitable".

Product 5 · local audit · the CLI / skill suite

The pre-release audit, in your editor

Four slash commands, all 100% local: no token, no signup, no telemetry. They read your code and explain what they find in plain English. The headline command is the 48-check audit documented in full on the coverage page.

Usage

# run the full 48-check audit on the current project
/lictor-security-check

# confused by a finding? get it in plain English
/lictor-explain

# apply the fixes, one at a time, with your approval
/lictor-fix-it

# a key leaked? rotate it, provider by provider
/lictor-rotate

Full check list with OWASP / CWE mappings: the 48 checks →

Honest boundaries

One rule across all five

Every product only reports what it can confirm by reading code or observing what's already public, never by attacking a live system. Sentinel guards calls without touching your prompts' contents off-box; Shield stays single-lane and credential-less; Patrol holds findings at SUSPECTED until a human verifies them; the CLI runs entirely on your machine. A scanner that cries wolf is worse than none, so the same evidence bar runs through all of it. Here are the false positives we filter.

Open-source. Apache 2.0. No telemetry.

Read the code before you trust it, install only the pieces you need, and run the audit on your own machine. Start with the 48-check audit, or wrap your model client today.