// for agents
Use pwn.watch with your AI
Every incident is plain static data. Give your agent the instructions below and it will watch pwn.watch on a schedule, check whether new incidents affect your stack, and only ping you when one does.
One prompt to set up monitoring
Polls /changes.json at most hourly with ETag conditional requests, compares against the last update it saw, reads each changed incident, checks your lockfiles and services against the fixed versions, and alerts you only on relevant changes.
## endpoints
Changes (JSON)
Every timeline update across all incidents, newest first. The best thing to poll.
https://pwn.watch/changes.jsonIncidents (JSON)
All incidents with severity, patch status, CVEs and links to the full record.
https://pwn.watch/incidents.jsonRSS feed
The same updates as RSS, for feed readers, Slack/Discord RSS apps and agents.
https://pwn.watch/feed.xmlllms.txt
A plain-text map of the site and its endpoints for LLMs.
https://pwn.watch/llms.txt
Per incident: https://pwn.watch/i/<slug>.json (full record + a Markdown agentBrief). All endpoints send CORS *, cache for 60s, and support ETag / If-None-Match (304 when unchanged).
WebMCP (in-browser agents)
Browsers and extensions that support WebMCP (navigator.modelContext) get these read-only tools on every pwn.watch page, no setup:
- list_live_incidents live incidents, newest first
- get_incident full record by slug
- search_incidents by product, CVE or keyword
- list_changes_since updates after a date
Desktop agents (Claude Desktop, Cursor, any MCP client): add a fetch server and point it at the endpoints above.
{
"mcpServers": {
"fetch": { "command": "uvx", "args": ["mcp-server-fetch"] }
}
}Copy instructions on every page
Every list and incident page has a copy instructions for agent button. It copies a Markdown brief (what's affected, fixed versions, commands to check your machine, how to patch or mitigate, secrets to rotate, advisory links) that you can paste straight into Cursor, Claude Code or any coding agent.
