Medium Severity
Published: Nov 2, 2026
A daily vulnerability briefing for AI-agent-managed machines — deterministic matching against OSV + CISA KEV; the LLM only explains. MIT
# secbrief
**English** | [한국어](README.ko.md) | [中文](README.zh.md) | [日本語](README.ja.md)
**A daily vulnerability briefing for AI-agent-managed machines.**
You tell an AI agent "watch my machines for vulnerabilities." The agent installs
this. From then on, every few hours, a machine-generated briefing tells you what
changed and what needs you. The LLM never decides anything — it only explains.
```bash
git clone <this repo> && cd secbrief
python3 secbrief.py init # creates config.json
$EDITOR config.json # list your SSH hosts / python envs / brew formulas
python3 secbrief.py run --baseline # first run: builds the baseline, no alerts
python3 secbrief.py run # every 6h from cron/launchd; alerts on diffs
python3 secbrief.py doctor # is the scanner healthy? when did it last succeed?
```
Setup takes about 5 minutes. No API keys, no accounts, no agent framework.
## What it does
**Sources (free, official, no keys):**
- [OSV.dev](https://osv.dev) querybatch + advisory details — matches your real
installed versions (PyPI via purl, Ubuntu/Debian via `pkg:deb/<distro>/...`).
Distro advisories are the truth for system packages, so backported builds
(e.g. `1.1.0-2build2.1`) are judged correctly, not by upstream version math.
- [CISA KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) —
actively exploited ⇒ the finding escalates. An item you "accepted" earlier is
**auto-unaccepted** if its CVE later enters KEV.
- [formulae.brew.sh](https://formulae.brew.sh) — Homebrew has no CVE database,
so formula drift is reported as its own section (formula update lag), never as a fake CVE.
**Inventory (read-only, nothing is changed on your machines):**
- Python environments: `pip list` (any interpreters you list)
- Ubuntu/Debian hosts: `dpkg-query` over SSH (key-based)
- macOS Homebrew: `brew list --versions` for your watch list
**The briefing** (markdown, one file per run) sorts everything into four classes:
- `[Action Required]` — fix pub