# stackalarm

> An agent skill and CLI that matches this week's security news to your project's stack and tells you what to patch first.

stackalarm is an agent skill and companion CLI by Yoan Bernabeu. Run `/stackalarm` in an agent such as Claude Code, Codex or Cursor, and it answers which of this week's security news affects the current repository, how urgent it is, and what to change. It is open source under the MIT license; the latest release listed is v0.7.0.

## What It Is

stackalarm splits the job into two parts. The skill acts as the analyst: it reads the project (manifests, lockfiles, Dockerfiles, CI, git remotes), runs the CLI, supplements it with a web search and ecosystem audits such as `composer audit`, `npm audit`, `pip-audit` and `govulncheck`, and decides what applies. The CLI acts as its eyes: it reads 181 sources first-hand, per the homepage, and does no project analysis itself.

The answer comes verdict first, then findings grouped by urgency (Act now, Prepare/plan, Good to know), plus a Checked / Not checked list. The skill offers to fix what lives in the repository, one change at a time and only after asking. It never pushes, deploys or touches a server.

## Sources and Signal Stages

Sources include project and vendor announcements, the GitHub Advisory Database, the NVD and EUVD CVE databases, CERTs from the US, Europe, Canada and Japan, CISA KEV, exploit databases and the security press. Each item is tagged with a stage: heads-up, release, advisory, alert or news. A source that cannot be read is always listed in the output. The CLI can also be used standalone, for example `stackalarm news --tag php --since 7d`.

## Scheduled Watch in CI

The agent can write a `.stackalarm.yaml` profile of tags, keywords, packages and stack. A GitHub Actions workflow or GitLab CI job then runs the CLI every four hours and opens an issue when a heads-up, alert or security release concerns the stack. On GitHub, with an `ANTHROPIC_API_KEY` secret, Claude triages the news first and opens an issue only when the project is concerned.

## Setup and Privacy

Install the skill with `npx skills add yoanbernabeu/stackalarm`; on first run it offers to install the CLI and runs nothing before you agree. The CLI can also be installed via Homebrew, an install script, a Windows zip, or `go install`. It works without keys; `GITHUB_TOKEN` and `NVD_API_KEY` are optional. The CLI sends only tags, keywords and package names to public databases, and the project states there is no telemetry.

## Features
- Agent skill invoked with /stackalarm
- Detects stack from manifests, lockfiles, Dockerfiles, CI and git remotes
- Verdict-first answers grouped by urgency
- Reads 181 security sources with five signal stages
- Combines CLI news with web search and ecosystem audits
- Offers repository fixes one change at a time after confirmation
- Standalone CLI news command with tag and time filters
- Scheduled watch every 4 hours in GitHub Actions or GitLab CI
- Optional Claude triage in GitHub Actions
- Reports unreadable sources and what was not checked
- No telemetry

## Integrations
Claude Code, Codex, Cursor, GitHub Actions, GitLab CI, GitHub Advisory Database, NVD, EUVD, CISA KEV, Homebrew, npm audit, composer audit, pip-audit, govulncheck

## Platforms
WINDOWS, MACOS, LINUX, API, CLI

## Pricing
Open Source

## Version
v0.7.0

## Links
- Website: https://stackalarm.dev
- Documentation: https://stackalarm.dev/docs/
- Repository: https://github.com/yoanbernabeu/stackalarm
- EveryDev.ai: https://www.everydev.ai/tools/stackalarm