Use pwn.watch with your AI
Every incident is plain static data. Give your agent the instructions below and it will watch pwn.watch on a schedule, check whether new incidents affect your stack, and only ping you when one does.
One prompt to set up monitoring
Polls /changes.json at most hourly with ETag conditional requests, compares against the last update it saw, reads each changed incident, checks your lockfiles and services against the fixed versions, and alerts you only on relevant changes.
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
Endpoints
Changes (JSON)
Every timeline update on Patch now incidents, newest first. The best thing to poll.
https://pwn.watch/changes.jsonIncidents (JSON)
Every incident in every category, with category, severity, patch status, CVEs and links to the full record.
https://pwn.watch/incidents.jsonRSS feed
Patch now incidents as RSS (also /feed.json), for feed readers, Slack/Discord RSS apps and agents.
https://pwn.watch/feed.xmlllms.txt
A plain-text map of the site and its endpoints for LLMs.
https://pwn.watch/llms.txt
Per incident: https://pwn.watch/i/<slug>.json (full record + a Markdown agentBrief). All endpoints send CORS *, cache for 60s, and support ETag / If-None-Match (304 when unchanged).
Feeds by category
The main feeds only carry Patch now: bugs in software you might run. Breaches, attacks on companies and supply chain incidents have their own feeds, and /all/… has everything.
- Patch now761A bug in software you might run. Update to a fixed versionrssjsonchangesllms.txt
- Breaches & attacks145Something happened to a company or service. Nothing for you to patch (rotate secrets if you are a customer)rssjsonchangesllms.txt
- Supply chain45Malicious packages, hijacked releases or compromised certificates. Check your dependencies and trust storesrssjsonchangesllms.txt
- All categories951Every categoryrssjsonchangesllms.txt
Per-tag feeds
Only want alerts for what you run? Every stack with incidents has its own JSON (incidents + changes) and RSS feed. So does every tag (vendors like Railway or Cisco, attack types like supply-chain): https://pwn.watch/t/<tag>.json and /t/<tag>/feed.xml. Each stack and tag also has its own llms.txt (status, days without incident, incidents newest first, feed links): /t/<tag>/llms.txt.
WebMCP (in-browser agents)
Browsers and extensions that support WebMCP (navigator.modelContext) get these read-only tools on every pwn.watch page, no setup:
- list_live_incidents live incidents, newest first
- get_incident full record by slug
- search_incidents by product, CVE or keyword
- list_changes_since updates after a date
Desktop agents (Claude Desktop, Cursor, any MCP client): add a fetch server and point it at the endpoints above.
{
"mcpServers": {
"fetch": { "command": "uvx", "args": ["mcp-server-fetch"] }
}
}Copy instructions on every page
Every list and incident page has a Copy brief for your AI button with a preview of the exact text. It copies a Markdown brief (what's affected, fixed versions, commands to check your machine, how to patch or mitigate, secrets to rotate, advisory links) that you can paste straight into Cursor, Claude Code or any coding agent.