Skip to content
AI Sec Watch

Integrations

Building with LangChain, OpenAI, LlamaIndex, or another AI framework? Pull AI Sec Watch into the tools you already use. Start with one of three tasks: run Stack Check in CI, add the MCP server to a coding agent, or call the REST API.

Everything below is free and needs no account, except webhooks, which need an API key.

Try the API in your browserFull API referenceTools repository on GitHub

1.Run Stack Check in CI

Easy · one workflow file

Save the workflow below under .github/workflows and Stack Check runs on each pull request and push. The Action checks the lockfiles in the repository root, or a manifest when its lockfile is absent, and the files input names other paths. It writes the report to the job summary and fails the step when it finds an advisory at or above the severity you set. The upload step sends the findings to the repository's code scanning alerts as SARIF.

  • Reads manifests, lockfiles and CycloneDX or SPDX JSON SBOMs
  • fail-on takes critical, high, medium, low or none (default high)
  • Set the cyclonedx input to a path to also write a CycloneDX 1.6 AI-BOM
  • Files are processed in memory and not stored
YAML
name: Stack Check
on: [pull_request, push]
permissions:
  contents: read
  security-events: write
jobs:
  stack-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: jackluucoding/aisecwatch-tools@v0
        with:
          fail-on: high
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: stack-check.sarif

Get the Action and the command-line tool from the tools repository

2.Add the MCP server to a coding agent

Easy · 1 min · one config line

Add AI Sec Watch as an MCP server in Claude Code, Cursor, or Claude Desktop, and your coding agent can check dependencies and look things up for you inside the editor. The check_stack tool runs Stack Check on the dependency files the agent reads, and check_llm_exposure looks up one package in the Exposure Registry. Ask it, for example, "any critical prompt-injection issues in LangChain this month?"

  • Claude Code, Cursor, Claude Desktop
  • Tools: check_stack, check_llm_exposure, search_issues, get_issue, scan_stack, latest_digest
  • Ask in natural language
  • No API key required
JSON
// Add to your mcp.json / .claude.json / Cursor config
{
  "mcpServers": {
    "aisecwatch": {
      "type": "http",
      "url": "https://aisecwatch.com/api/mcp"
    }
  }
}

// Then ask your agent:
//   "Run Stack Check on package-lock.json and list the fixed versions"
//   "Since which release does pypi:langchain-community declare an LLM dependency?"
//   "Scan my stack (langchain and llama-index) for critical issues"
//   "What's the latest daily AI security digest?"

See what tools your agent gets

3.Call the REST API

Medium · 10 min · HTTP calls

Send dependency files or a CycloneDX or SPDX JSON SBOM to Stack Check and get the report as JSON, as Markdown or as a CycloneDX 1.6 AI-BOM. The same API looks up packages in the Exposure Registry and lists issues with filters and pagination. None of these calls needs a key, and CORS is open, so the API also works from a browser.

  • Stack Check processes files in memory and does not store them
  • Filter issues by severity, type, vendor, package, topic, date
  • 60 requests/minute per IP, and 10 per minute for Stack Check
  • CORS enabled, so it works in a browser
Shell
# Stack Check: send dependency files and get the report as JSON
curl -X POST "https://aisecwatch.com/api/v1/check" \
  -H "Content-Type: application/json" \
  -d '{
    "files": [
      { "filename": "requirements.txt", "content": "langchain==0.1.0\n" }
    ]
  }'

# Add ?format=markdown for a Markdown report
# or ?format=cyclonedx for a CycloneDX 1.6 AI-BOM

# Look up one package in the Exposure Registry
curl "https://aisecwatch.com/api/v1/packages/pypi/langchain"

# Fetch recent critical AI security issues
curl "https://aisecwatch.com/api/v1/issues?severity=critical&limit=10" \
  -H "Accept: application/json"

# Filter by package, vendor or topic
curl "https://aisecwatch.com/api/v1/issues?package=langchain"
curl "https://aisecwatch.com/api/v1/issues?vendor=OpenAI"
curl "https://aisecwatch.com/api/v1/issues?topic=mcp"

# Look up one advisory by CVE or GHSA identifier
curl "https://aisecwatch.com/api/v1/advisories/CVE-2026-1234"

Try endpoints in your browser

Other integrations

Ordered from the least to the most setup.

Follow an RSS feed

Easy · 2 min · no code

Add a feed URL to any RSS reader, such as Feedly, NetNewsWire, or Slack's RSS app. Follow everything, or only the vendor or package your project uses. Stack Check gives one feed address for all the packages of a project.

  • Works in any RSS reader
  • Follow only what your project depends on
  • Also works with Zapier, n8n, IFTTT
FeedURL
All issues/feed.xml
Security/feed/security
Research/feed/research
News/feed/news
Policy/feed/policy
Vendor: OpenAI/feed/vendor/OpenAI
Vendor: LangChain/feed/vendor/LangChain
Package: langchain/feed/package/langchain
Several packages in one feed/feed/stack?p=pypi:langchain,npm:@modelcontextprotocol/sdk

Add a badge to your README

Easy · 30 sec · copy-paste

Paste one line of Markdown into your README to show how many advisories from the last 90 days name your main dependency. The badge updates automatically every 5 minutes and comes in three variants: by vendor, by package, or by specific CVE.

  • Vendor, package, and CVE badges
  • Works anywhere Markdown works
  • Auto-refreshes every 5 minutes
Markdown
![LangChain criticals](https://aisecwatch.com/api/badge/vendor/LangChain/critical.svg)
![langchain package](https://aisecwatch.com/api/badge/package/langchain/any.svg)
![CVE-2026-1234](https://aisecwatch.com/api/badge/cve/CVE-2026-1234.svg)

Download the raw dataset

Easy · 1 min · direct download

Download the full dataset in CSV, JSON, or JSONL for analysis in Excel, pandas, R, or a notebook. It includes 48 structured fields per issue and is licensed CC-BY-4.0 for research use.

  • 48 fields per issue
  • CSV, JSON, JSONL
  • CC-BY-4.0 licensed
Shell
# Export issues as CSV
curl "https://aisecwatch.com/api/issues/export?format=csv" \
  -o aisecwatch-export.csv

Browse the dataset page

Look up packages and vendors by name

Medium · 5 min · one API call

Send a list of package names and vendor names in one call and get back every matching issue plus a severity count. Use it when you have names and no dependency file. The lookup matches names, not versions. To check the versions a project pins, run Stack Check.

  • One request covers many packages/vendors
  • Filter by minimum severity and date
  • Matches names, not versions
Shell
# Look up issues that name these packages and vendors
curl -X POST "https://aisecwatch.com/api/v1/scan" \
  -H "Content-Type: application/json" \
  -d '{
    "packages": ["langchain", "llama-index"],
    "vendors": ["OpenAI", "Anthropic"],
    "severityMin": "high"
  }'

# Response includes matching issues + a severity histogram:
#   { "meta": { "bySeverity": { "critical": 3, "high": 42, ... } } }

View scan API reference

Webhooks

Advanced · 30 min · server required

Register a webhook URL and we'll POST new issues to it as they arrive. You need a public server to receive the POST and an API key to register. Each payload is signed so you can verify it came from us.

  • Signed payloads (HMAC-SHA256)
  • Filter by severity, type, vendor, LLM-specific
  • Turned off after 10 failed deliveries in a row
Shell
# Register a webhook (requires WEBHOOK_API_KEY)
curl -X POST "https://aisecwatch.com/api/v1/webhooks" \
  -H "Authorization: Bearer YOUR_WEBHOOK_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-server.com/webhook",
    "filters": { "severity": "critical", "llmSpecific": true }
  }'

# We POST new issues to your URL with a signed header:
#   X-Webhook-Signature: sha256=a1b2c3d4e5...

View webhook setup guide

Post to Slack

Advanced · 30 min · needs serverless function

To get alerts in your team's Slack channel, bridge the webhook above to a Slack Incoming Webhook with a small Cloudflare Worker or any serverless function. Adjust the formatting in the template below.

  • Rich formatting with emoji severity
  • Filter by severity to keep the channel clean
  • Works on Cloudflare Workers, Vercel, Netlify
JavaScript
// Cloudflare Worker: AI Sec Watch -> Slack bridge
export default {
  async fetch(request) {
    // One delivery carries every new record that matches the webhook's filters.
    const payload = await request.json();
    for (const issue of payload.issues) {
      const severity = issue.severity.toUpperCase();
      const emoji =
        severity === "CRITICAL" ? ":rotating_light:" :
        severity === "HIGH" ? ":warning:" : ":information_source:";

      await fetch(SLACK_WEBHOOK_URL, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          blocks: [
            {
              type: "section",
              text: {
                type: "mrkdwn",
                text: `${emoji} *${severity}*: <${issue.sourceUrl}|${issue.title}>`,
              },
            },
          ],
        }),
      });
    }

    return new Response("OK", { status: 200 });
  },
};

Post to Discord

Advanced · 30 min · needs serverless function

For Discord, a small serverless function forwards our webhook payload to a Discord Incoming Webhook with color-coded embeds, following the same pattern as Slack.

  • Color-coded embeds by severity
  • Filter before the channel gets noisy
  • Any serverless runtime works
JavaScript
// Cloudflare Worker: AI Sec Watch -> Discord bridge
export default {
  async fetch(request) {
    // One delivery carries every new record that matches the webhook's filters.
    const payload = await request.json();
    const colors = {
      critical: 0xff0000, high: 0xff8c00, medium: 0xffd700,
      low: 0x00bfff, info: 0x808080,
    };

    for (const issue of payload.issues) {
      await fetch(DISCORD_WEBHOOK_URL, {
        method: "POST",
        headers: { "Content-Type": "application/json" },
        body: JSON.stringify({
          embeds: [{
            title: issue.title,
            url: issue.sourceUrl,
            color: colors[issue.severity] || 0x808080,
            fields: [
              { name: "Severity", value: issue.severity, inline: true },
              { name: "Type", value: issue.issueType, inline: true },
            ],
          }],
        }),
      });
    }

    return new Response("OK", { status: 200 });
  },
};

STIX 2.1 feed for threat intelligence platforms

Advanced · varies · depends on your platform

If your organization runs a threat intelligence platform such as MISP, OpenCTI, or ThreatConnect, it can ingest issues as a STIX 2.1 bundle, the standard format those tools read. Teams without such a platform do not need this feed.

  • STIX 2.1 compliant
  • Tested with MISP, OpenCTI, ThreatConnect
  • Filter by severity and date range
Shell
# Fetch a STIX 2.1 bundle of issues published since a date
curl "https://aisecwatch.com/api/v1/issues/stix?since=2026-10-01" \
  -H "Accept: application/json"

View STIX endpoint reference