# majenayu/cyber-sentinel architecture

> Architecture diagram of the GitHub repository majenayu/cyber-sentinel, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/majenayu/cyber-sentinel
- Repository: https://github.com/majenayu/cyber-sentinel

## Overview

CyberSentinel is a cybersecurity operations dashboard offered as web and mobile apps, backed by an Express API. Operators use the dashboard and specialist pages for AI chat, security lookups, reconnaissance, and intrusion monitoring; the API also supports a knowledge vault, saved references, and research automation. The excerpts verify app-to-router setup, push subscription calls, and the research pipeline; most feature-route internals and mobile API wiring were not sampled, so those connections are left out.

Main entry points: [`artifacts/api-server/src/lib/researcher.ts`](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/researcher.ts) (Research pipeline), [`artifacts/api-server/src/routes/index.ts`](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/index.ts) (API router), [`artifacts/api-server/src/routes/research.ts`](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/research.ts) (Research controls), [`artifacts/cyber-sentinel/src/App.tsx`](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/App.tsx) (Web dashboard)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_clients["Operator clients"]
  node_web["Web dashboard<br/>[App.tsx]"]
  node_mobile["Mobile app<br/>[_layout.tsx]"]
  node_security_pages["Security tools"]
  node_intrusion_page["Intrusion map<br/>[Intrusions.tsx]"]
  node_push_hook["Push notifications"]
end

subgraph group_api["API services"]
  node_api_app["API application<br/>[app.ts]"]
  node_api_router["API router<br/>[index.ts]"]
  node_chat_route["AI chat<br/>[chat.ts]"]
  node_intrusion_route["Intrusion logging<br/>[intrusion.ts]"]
  node_security_routes["Security lookups"]
  node_push_route["Push API<br/>[push.ts]"]
  node_ai["AI providers<br/>[multi-ai.ts]"]
  node_push_service["Web push service<br/>[push.ts]"]
end

subgraph group_research["Research and knowledge"]
  node_research_route["Research controls<br/>[research.ts]"]
  node_researcher["Research pipeline<br/>[researcher.ts]"]
end

subgraph group_state["Persistent state"]
  node_db_client["Database connection<br/>[mongodb.ts]"]
  node_models["Domain models"]
  node_research_log["Research logs<br/>[ResearchLog.ts]"]
  node_knowledge["Knowledge entries<br/>[Knowledge.ts]"]
  node_tools["Tool catalog<br/>[Tool.ts]"]
  node_commands["Saved commands<br/>[Command.ts]"]
  node_push_subs["Push subscriptions"]
end

node_operator(("Operator"))
node_groq["Groq"]
node_mistral["Mistral"]
node_web_sources["Security sources"]
node_mongo[("MongoDB")]

node_operator -->|"uses"| node_web
node_operator -->|"uses"| node_mobile
node_web -->|"navigates"| node_security_pages
node_web -->|"navigates"| node_intrusion_page
node_web -->|"API requests"| node_api_app
node_api_app -->|"dispatches"| node_api_router
node_api_router --> node_chat_route
node_api_router --> node_intrusion_route
node_api_router --> node_security_routes
node_api_router --> node_push_route
node_chat_route -->|"requests answers"| node_ai
node_ai -->|"queries"| node_groq
node_ai -.->|"optionally queries"| node_mistral
node_push_hook -->|"fetches key, saves subscription"| node_push_route
node_push_hook -->|"requests test"| node_push_route
node_push_route --> node_push_service
node_push_service -->|"reads subscriptions"| node_push_subs
node_research_route -->|"runs research"| node_researcher
node_research_route -->|"records run"| node_research_log
node_research_route -->|"counts entries"| node_knowledge
node_researcher -->|"scrapes"| node_web_sources
node_researcher -->|"requests analysis"| node_ai
node_researcher -->|"connects"| node_db_client
node_researcher -->|"creates entries"| node_knowledge
node_researcher -->|"creates references"| node_tools
node_researcher -->|"creates commands"| node_commands
node_researcher -->|"notifies progress to caller"| node_research_log
node_db_client -->|"connects"| node_mongo
node_research_route -->|"connects"| node_db_client
node_intrusion_route -->|"uses storage"| node_db_client
node_models -->|"persisted in"| node_mongo

click node_web "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/App.tsx"
click node_mobile "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel-mobile/app/(tabs)/_layout.tsx"
click node_security_pages "https://github.com/majenayu/cyber-sentinel/tree/main/artifacts/cyber-sentinel/src/pages"
click node_intrusion_page "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/pages/Intrusions.tsx"
click node_push_hook "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/hooks/usePushNotifications.ts"
click node_api_app "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/app.ts"
click node_api_router "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/index.ts"
click node_chat_route "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/chat.ts"
click node_intrusion_route "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/intrusion.ts"
click node_security_routes "https://github.com/majenayu/cyber-sentinel/tree/main/artifacts/api-server/src/routes"
click node_push_route "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/push.ts"
click node_ai "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/multi-ai.ts"
click node_push_service "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/push.ts"
click node_research_route "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/research.ts"
click node_researcher "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/researcher.ts"
click node_db_client "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/mongodb.ts"
click node_models "https://github.com/majenayu/cyber-sentinel/tree/main/artifacts/api-server/src/lib/models"
click node_research_log "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/ResearchLog.ts"
click node_knowledge "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/Knowledge.ts"
click node_tools "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/Tool.ts"
click node_commands "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/Command.ts"
click node_push_subs "https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/PushSubscription.ts"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_web,node_mobile,node_security_pages,node_intrusion_page,node_push_hook toneBlue
class node_api_app,node_api_router,node_chat_route,node_intrusion_route,node_security_routes,node_push_route,node_ai,node_push_service,node_mongo toneAmber
class node_research_route,node_researcher toneMint
class node_db_client,node_models,node_research_log,node_knowledge,node_tools,node_commands,node_push_subs toneRose
class node_operator,node_groq,node_mistral,node_web_sources toneIndigo
```

## Components

### Operator clients

- [Web dashboard](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/App.tsx): `artifacts/cyber-sentinel/src/App.tsx`
- [Mobile app](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel-mobile/app/(tabs)/_layout.tsx): `artifacts/cyber-sentinel-mobile/app/(tabs)/_layout.tsx`
- [Security tools](https://github.com/majenayu/cyber-sentinel/tree/main/artifacts/cyber-sentinel/src/pages): `artifacts/cyber-sentinel/src/pages`
- [Intrusion map](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/pages/Intrusions.tsx): `artifacts/cyber-sentinel/src/pages/Intrusions.tsx`
- [Push notifications](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/cyber-sentinel/src/hooks/usePushNotifications.ts): `artifacts/cyber-sentinel/src/hooks/usePushNotifications.ts`

### API services

- [API application](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/app.ts): `artifacts/api-server/src/app.ts`
- [API router](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/index.ts): `artifacts/api-server/src/routes/index.ts`
- [AI chat](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/chat.ts): `artifacts/api-server/src/routes/chat.ts`
- [Intrusion logging](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/intrusion.ts): `artifacts/api-server/src/routes/intrusion.ts`
- [Security lookups](https://github.com/majenayu/cyber-sentinel/tree/main/artifacts/api-server/src/routes): `artifacts/api-server/src/routes`
- [Push API](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/push.ts): `artifacts/api-server/src/routes/push.ts`
- [AI providers](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/multi-ai.ts): `artifacts/api-server/src/lib/multi-ai.ts`
- [Web push service](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/push.ts): `artifacts/api-server/src/lib/push.ts`

### Research and knowledge

- [Research controls](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/routes/research.ts): `artifacts/api-server/src/routes/research.ts`
- [Research pipeline](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/researcher.ts): `artifacts/api-server/src/lib/researcher.ts`

### Persistent state

- [Database connection](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/mongodb.ts): `artifacts/api-server/src/lib/mongodb.ts`
- [Domain models](https://github.com/majenayu/cyber-sentinel/tree/main/artifacts/api-server/src/lib/models): `artifacts/api-server/src/lib/models`
- [Research logs](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/ResearchLog.ts): `artifacts/api-server/src/lib/models/ResearchLog.ts`
- [Knowledge entries](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/Knowledge.ts): `artifacts/api-server/src/lib/models/Knowledge.ts`
- [Tool catalog](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/Tool.ts): `artifacts/api-server/src/lib/models/Tool.ts`
- [Saved commands](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/Command.ts): `artifacts/api-server/src/lib/models/Command.ts`
- [Push subscriptions](https://github.com/majenayu/cyber-sentinel/blob/main/artifacts/api-server/src/lib/models/PushSubscription.ts): `artifacts/api-server/src/lib/models/PushSubscription.ts`

### Other components

- **Operator**
- **Groq**
- **Mistral**
- **Security sources**
- **MongoDB**

## Connections

- Operator → Web dashboard: uses
- Operator → Mobile app: uses
- Web dashboard → Security tools: navigates
- Web dashboard → Intrusion map: navigates
- Web dashboard → API application: API requests
- API application → API router: dispatches
- API router → AI chat
- API router → Intrusion logging
- API router → Security lookups
- API router → Push API
- AI chat → AI providers: requests answers
- AI providers → Groq: queries
- AI providers → Mistral: optionally queries
- Push notifications → Push API: fetches key, saves subscription
- Push notifications → Push API: requests test
- Push API → Web push service
- Web push service → Push subscriptions: reads subscriptions
- Research controls → Research pipeline: runs research
- Research controls → Research logs: records run
- Research controls → Knowledge entries: counts entries
- Research pipeline → Security sources: scrapes
- Research pipeline → AI providers: requests analysis
- Research pipeline → Database connection: connects
- Research pipeline → Knowledge entries: creates entries
- Research pipeline → Tool catalog: creates references
- Research pipeline → Saved commands: creates commands
- Research pipeline → Research logs: notifies progress to caller
- Database connection → MongoDB: connects
- Research controls → Database connection: connects
- Intrusion logging → Database connection: uses storage
- Domain models → MongoDB: persisted in