AI Sentinel — Botpress Security Scanner

Enterprise-grade adversarial testing platform for Botpress AI agents. Detects prompt injections, jailbreaks, and data exfiltration via automated red-team scanning.

Live Demo

• UI & API: https://botpress-connector.jollypond-6ba85ff1.centralindia.azurecontainerapps.io
• Deployed at: 2026-06-15T13:20:00Z
• Auth: No authentication — all endpoints and UI are fully open for evaluation. See EVALUATOR.md for cURL/Python API examples.

---

Architecture

┌─────────────────────────────────────────────┐
│  Gunicorn + Uvicorn  (port 8000)            │
│  ├── FastAPI API  (/api/v1/*)               │
│  └── React SPA   (/)                        │
└─────────────────────────────────────────────┘
         │
┌─────────────────────────────────────────────┐
│  SQLite  (/data/botpress_connector.db)      │
│  Encrypted at rest  (Fernet AES-GCM)        │
└─────────────────────────────────────────────┘

---

Quick Start (Local Dev)

Prerequisites

• Python 3.11+
• Node.js 18+
• Git

1. Clone and install

git clone <repo-url>
cd botpress-connector

# Backend
cd backend
pip install -e ".[dev]"

# Frontend
cd ../frontend
npm install

2. Set environment variables

cp .env.example backend/.env
# Edit backend/.env — fill in FERNET_KEY (see below)

Generate a Fernet key:

python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"

3. Run (two terminals)

# Terminal 1 — Backend
cd backend
uvicorn app.main:app --reload --port 8000

# Terminal 2 — Frontend
cd frontend
npm run dev

• Frontend: http://localhost:5173
• API docs: http://localhost:8000/docs

---

Docker (Production-like Local)

# Copy and fill .env
cp .env.example .env
echo "FERNET_KEY=$(python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")" >> .env

# Build and run
docker compose up --build

# Access at http://localhost:8000

---

Deploy to Azure Container Apps

Prerequisites

az login
az extension add --name containerapp
az extension add --name acr

1. Create Azure resources

RG=botpress-rg
LOCATION=eastus
ACR=botpressacr$RANDOM
ENV=botpress-env
STORAGE_ACCOUNT=botpressstorage$RANDOM

# Resource group
az group create --name $RG --location $LOCATION

# Container Registry
az acr create --resource-group $RG --name $ACR --sku Basic --admin-enabled true

# Log Analytics (required for Container Apps environment)
az monitor log-analytics workspace create \
  --resource-group $RG \
  --workspace-name botpress-logs

WORKSPACE_ID=$(az monitor log-analytics workspace show \
  --resource-group $RG \
  --workspace-name botpress-logs \
  --query customerId -o tsv)

WORKSPACE_KEY=$(az monitor log-analytics workspace get-shared-keys \
  --resource-group $RG \
  --workspace-name botpress-logs \
  --query primarySharedKey -o tsv)

# Container Apps Environment
az containerapp env create \
  --name $ENV \
  --resource-group $RG \
  --location $LOCATION \
  --logs-workspace-id $WORKSPACE_ID \
  --logs-workspace-key $WORKSPACE_KEY

2. Create Azure File Share (persistent SQLite volume)

az storage account create \
  --name $STORAGE_ACCOUNT \
  --resource-group $RG \
  --location $LOCATION \
  --sku Standard_LRS

STORAGE_KEY=$(az storage account keys list \
  --resource-group $RG \
  --account-name $STORAGE_ACCOUNT \
  --query "[0].value" -o tsv)

az storage share create \
  --name botpress-data \
  --account-name $STORAGE_ACCOUNT

# Link storage to Container Apps environment
az containerapp env storage set \
  --name $ENV \
  --resource-group $RG \
  --storage-name botpress-storage \
  --azure-file-account-name $STORAGE_ACCOUNT \
  --azure-file-account-key $STORAGE_KEY \
  --azure-file-share-name botpress-data \
  --access-mode ReadWrite

3. Build and push image

# Login to ACR
az acr login --name $ACR
ACR_SERVER=$(az acr show --name $ACR --query loginServer -o tsv)

# Build and push
docker build -t $ACR_SERVER/botpress-connector:latest .
docker push $ACR_SERVER/botpress-connector:latest

4. Generate Fernet key and store as secret

FERNET_KEY=$(python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())")

5. Deploy

Fill in azure/containerapp.yaml placeholders, then:

az containerapp create \
  --resource-group $RG \
  --environment $ENV \
  --yaml azure/containerapp.yaml \
  --registry-server $ACR_SERVER \
  --registry-username $(az acr credential show --name $ACR --query username -o tsv) \
  --registry-password $(az acr credential show --name $ACR --query "passwords[0].value" -o tsv)

6. Get URL

az containerapp show \
  --name botpress-connector \
  --resource-group $RG \
  --query "properties.configuration.ingress.fqdn" -o tsv

---

Environment Variables

Variable	Required	Default	Description
FERNET_KEY	✅ Yes	—	AES-GCM key for encrypting secrets at rest
DATABASE_URL	No	sqlite+aiosqlite:////data/botpress_connector.db	Database connection string
ENVIRONMENT	No	development	development or production
CORS_ORIGINS	No	localhost origins	JSON array of allowed origins
LOG_LEVEL	No	INFO	DEBUG, INFO, WARNING, ERROR
WORKERS	No	2	Number of Gunicorn workers
PORT	No	8000	Server port
BOT_REPLY_TIMEOUT_SEC	No	60	Max wait for bot response
POLL_INTERVAL_SEC	No	2	Polling interval for bot replies

---

Testing

cd backend

# All tests (115 tests)
pytest -v

# With coverage
pytest --cov=app --cov-report=term-missing

# Unit only
pytest tests/test_client.py tests/test_scanner.py tests/test_errors.py tests/test_database.py -v

---

API Reference

See EVALUATOR.md for full cURL examples and the deployment guide.

• GET /health — Liveness probe
• GET /ready — Readiness probe
• GET /api/v1/resources — List all bots
• POST /api/v1/resources — Register a bot
• GET /api/v1/resources/{id} — Get bot details
• DELETE /api/v1/resources/{id} — Remove a bot
• POST /api/v1/resources/{id}/validate — Test connectivity
• POST /api/v1/resources/{id}/scan — Run adversarial scan
• GET /api/v1/resources/{id}/scans — Scan history
• GET /api/v1/resources/{id}/telemetry — Security metrics
• GET /api/v1/sample-prompts — Get preset attack prompts