PHPackages                             nemesislabs/sentinel - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. nemesislabs/sentinel

ActiveLibrary[Security](/categories/security)

nemesislabs/sentinel
====================

Nemesis Shield — Sentinel SDK for PHP & Laravel. Positive-security runtime protection: learns your app's normal behavior and blocks off-baseline requests (auth bypass, path traversal, scanners, unusual methods). Fail-open, privacy-preserving. Works on Laravel 6+ / PHP 7.2+.

v0.1.0(today)00MITPHPPHP >=7.2

Since Jul 31Pushed todayCompare

[ Source](https://github.com/eobi/nemesis-shield-php)[ Packagist](https://packagist.org/packages/nemesislabs/sentinel)[ Docs](https://nemesislabs.xyz)[ RSS](/packages/nemesislabs-sentinel/feed)WikiDiscussions main Synced today

READMEChangelogDependenciesVersions (2)Used By (0)

Nemesis Shield — PHP
====================

[](#nemesis-shield--php)

Native PHP SDK for [Nemesis Shield](https://shield.nemesislabs.xyz). Learns your app's normal behavior; in **enforce mode BLOCKS off-baseline requests** (auth bypass, path traversal, scanners, unusual methods) before your app runs. PHP is stateless per-request, so the compiled policy is cached to a temp file with a short TTL and refreshed on demand. Positive-security, fail-open.

**Raw / any framework**

```
require "NemesisShield.php";
$token = getenv("NEMESIS_TOKEN");
if (NemesisShield::guard($token)) return;   // pre-dispatch block (enforce mode)
// ... your app ...
NemesisShield::observe($token);             // record after the response
```

**Laravel (Composer, 6+ / PHP 7.2+)** — zero-config via package auto-discovery:

```
composer require nemesislabs/sentinel
```

```
# .env
NEMESIS_TOKEN=nsk_your_app_token
```

`NemesisShieldServiceProvider` prepends the middleware to the global stack automatically — no `Kernel.php` edit. Full guide + manual (no-Composer) fallback + Namecheap/shared-hosting notes: [`examples/laravel/`](../examples/laravel/). (No Composer? drop `NemesisShield.php` + `NemesisShieldMiddleware.php` in and register the middleware yourself — see the example.)

**Symfony** — register it as a PSR-15 middleware / kernel subscriber wrapping `guard`/`observe`.

Observe (default) → learn & approve in the console → flip to **enforce** → off-baseline requests get `403 blocked_by_nemesis_shield`. Verified end-to-end (learn → enforce → attack) on raw PHP: legit passes (200); attacks blocked (403).

LLM Guard (OWASP LLM Top 10)
----------------------------

[](#llm-guard-owasp-llm-top-10)

The same HashLR ML classifier every Nemesis Shield SDK ships — catches obfuscated prompt injection signature rules miss, scored identically in every language.

```
require 'NemesisShieldLLM.php';

$v = NemesisShieldLLM::guardLLM($userPrompt, true); // enforce
if ($v['blocked']) {
    // refuse — $v['kind'], $v['score'], $v['owasp'] ("LLM01")
}

$score = NemesisShieldLLM::mlInjectionScore($userPrompt); // 0..1
```

Regex first, then ML. Blocks at ≥ 0.85 (high), flags at ≥ 0.45.

Full coverage & safe-unlock
-------------------------------

[](#full-coverage--safe-unlock)

**Mount it first / outermost** so *every* route is inspected (not just API routes — attackers hit any path):

```
if (NemesisShield::guard($token)) return;   // at the very top of the request, before routing

```

**What's inspected** (privacy-preserving): method + normalized route + **query-param structure** (names + kinds, never values) + auth flag + status. An off-baseline route, **param structure**, method, or auth state is blocked in enforce mode. Path-traversal segments normalize to `{traversal}`.

**Safe-unlock (break-glass):** the login/auth path is never blocked, so a still-learning baseline can't lock you out. Defaults: `/login /signin /sign-in /auth /oauth /session /wp-login.php /wp-admin`. Override:

```
export NEMESIS_SHIELD_BOOTSTRAP="/login,/admin,/healthz"
```

**Verify coverage** — in observe mode, hit a normal route, a param, and a scanner path, then confirm all three appear in the console (Activity / Behaviors):

```
curl -s "http://localhost:8080/" >/dev/null
curl -s "http://localhost:8080/search?q=shoes" >/dev/null
curl -s "http://localhost:8080/.env" >/dev/null   # shows up as an off-baseline behavior
```

###  Health Score

31

—

LowBetter than 65% of packages

Maintenance100

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community6

Small or concentrated contributor base

Maturity18

Early-stage or recently created project

 Bus Factor1

Top contributor holds 100% of commits — single point of failure

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Unknown

Total

1

Last Release

0d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/57612745dc23abac6e9a401af619ef38127e6d5e6a6b198fe2892c1f783aa651?d=identicon)[eobi](/maintainers/eobi)

---

Top Contributors

[![eobi](https://avatars.githubusercontent.com/u/9149655?v=4)](https://github.com/eobi "eobi (1 commits)")

---

Tags

laravelsecurityruntimeowaspwafappsecrasppositive-security

### Embed Badge

![Health badge](/badges/nemesislabs-sentinel/health.svg)

```
[![Health](https://phpackages.com/badges/nemesislabs-sentinel/health.svg)](https://phpackages.com/packages/nemesislabs-sentinel)
```

###  Alternatives

[akaunting/laravel-firewall

Web Application Firewall (WAF) package for Laravel

1.0k525.8k2](/packages/akaunting-laravel-firewall)[enlightn/laravel-security-checker

A Laravel package to scan your dependencies for known security vulnerabilities.

51179.0k](/packages/enlightn-laravel-security-checker)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)