SentryLink

T&F's real-time security event router. SentryLink ingests security and runtime alerts from Strix, Main-Bridge-AI, and the T&F Build Agent, applies severity-based policy routing, and dispatches to GitHub Issues and Slack — removing manual triage from the security pipeline.

Built for T&F Investments & Holdings LLC.

---

What it does

SentryLink sits between your automated security tooling and your team's attention. Instead of every scanner shouting into its own channel, alerts flow through one webhook, get normalized, checked against policy, and routed by severity.

Strix / Main-Bridge-AI / Build Agent
              ↓
   POST /master-hub/runtime-alert
              ↓
      Normalize Event (Code)
              ↓
   Main-Bridge-AI Policy Check
              ↓
       Severity Router (Switch)
              ↓
   Build Agent Triage Summary
              ↓
       ┌──────┴──────┐
   GitHub Issue   Slack Alert
              ↓
     Respond to Webhook

Architecture

SentryLink is an n8n workflow (workflows/master-hub/runtime-alert-router.json) that acts as the controlled front door for security events across the T&F ecosystem:

• n8n — workflow router and orchestration layer
• Main-Bridge-AI — policy enforcement gateway (API key checks, severity policy, audit logging)
• Strix — autonomous security scanner, source of most alerts
• T&F Build Agent — generates human-readable triage summaries before routing
• GitHub / Slack — downstream notification and tracking targets

Severity routing

Severity	GitHub Issue	Slack Alert	Notes
critical	✅	✅ (#t-and-f-security-critical)	Immediate visibility, no delay
high	✅	—	Tracked, no interrupt
medium	✅	—	Tracked, no interrupt
low	✅ (backlog label)	—	Deprioritized but not dropped
info	—	—	Logged only via Main-Bridge-AI audit trail

Event schema

All inbound events are validated against security/events/master-hub-alert.schema.json. Minimum required fields:

{
  "source": "strix",
  "severity": "high",
  "title": "SSRF found in webhook handler",
  "repo": "youngslim4985-sketch/front-desk-ai",
  "sha": "a1b2c3d",
  "description": "Optional detail for the issue body"
}

severity must be one of critical | high | medium | low | info. repo must be owner/repo format.

Setup

1. Import workflows/master-hub/runtime-alert-router.json into your n8n instance.
2. Configure credentials in n8n:
   • Main-Bridge-AI API key (header auth)
   • GitHub PAT or GitHub App (scoped to the repos SentryLink should file issues against)
   • Slack bot token with chat:write on #t-and-f-security-critical
3. Point Strix, Main-Bridge-AI, and Build Agent webhooks at:

   POST https://<your-n8n-host>/webhook/master-hub/runtime-alert
   

4. Validate the schema file is deployed alongside the workflow so malformed events are rejected before they reach the Switch node.

Design notes

• Main-Bridge-AI stays in the loop even though n8n does the routing — this preserves the "guardrail service" pattern (audit logs, allowed-repo list, severity policy) rather than letting n8n call GitHub/Slack unchecked.
• No silent drops. Every severity tier has a defined action, including info, which is explicitly logged rather than ignored.
• Repo-scoped GitHub issue creation relies on an n8n-stored credential, not on any AI agent having live push/write access — keeping write actions auditable and outside the LLM's direct reach.

Roadmap

• github-push skill manifest for T&F Build Agent (in progress)
• Strix intake schema (security/events/strix-intake.schema.json)
• Deploy-approval human-in-the-loop step for critical findings tied to production repos

Run and deploy your AI Studio app

This contains everything you need to run your app locally.

View your app in AI Studio: https://ai.studio/apps/06bf49f0-70fe-4467-829e-04b68077e121

Run Locally

Prerequisites: Node.js

1. Install dependencies: npm install
2. Set the GEMINI_API_KEY in .env.local to your Gemini API key
3. Run the app: npm run dev