Low Severity
Published: Nov 14, 2026
Self-hosted security advisory and dependency monitoring with inventory matching, evidence, and Slack or email alerts.
# Shielda Security Watch
Self-hosted security advisory monitoring for dependency inventories, with local evidence and Slack or email alerts. This experimental TypeScript bot compares advisories and news with your system inventory and records why each finding was routed.
**Alpha.** The package is `@shieldaai/security-watch`; prereleases use the `alpha` tag. See [coverage and security limits](SECURITY.md) before deploying it.
Try the [offline advisory preview](https://github.com/ShieldaAI/security-watch/blob/main/docs/offline-advisory-preview.md) to evaluate
matching against fictional inventory without network calls, model requests or
notifications.
For tool permissions and approvals, see
[Agent Guard](https://github.com/ShieldaAI/agent-guard). For model response
validation, see [SafeCall Node](https://github.com/GuardianMesh/llm-safecall-node)
or [SafeCall Python](https://github.com/GuardianMesh/llm-safecall). The
[package selection guide](https://github.com/ShieldaAI/agent-guard/blob/main/docs/package-guide.md)
explains how these separate projects fit together.
## Features
- YAML/JSON inventories, library lists across 12 ecosystems, and npm package-lock v2/v3 imports. Names alone are accepted; exact installed versions improve applicability checks.
- cve.now CVE updates and npm stack checks, plus The Hacker News security articles. Optional sources include OSV, GitHub, CISA KEV, official Node.js/Python/PHP feeds and other RSS/Atom feeds.
- Structured library checks without AI, with optional AI analysis to distinguish new vulnerabilities, updates to known vulnerabilities and general system news. Each finding records source severity, applicability and contextual priority separately.
- Separate alert thresholds for libraries, products and news, plus review digests and configurable overrides for potentially critical findings, known exploitation and malware.
- Slack incoming webhooks and SMTP email, backed by a SQLite delivery queue. Uncertain delivery is recorded fo