A flaw in Next.js lands as a GitHub advisory, a vendor blog post, a line in a changelog. It reaches your feed days later, through someone who read it first. And the only question you have, does it affect me?, is left for you to work out.

Patchwire reads the primary sources every hour for modern JS, AI and web3 stacks, and answers that question for each advisory. Free, no account, no ads.

In five seconds, you know if something is burning.

Your agent writes the code now. It picks the packages, bumps the versions, ships the fix. So the agent is the first reader: an MCP server with five tools, package names in and fixes out, plus JSON Feed and RSS for everything, per sector and per stack.

The site is there so a human can see and check what the agent is told.

Patchwire belongs to the monowire family, so the logo started from the monowire wire. That was the trap: every early version looked like monowire with a different name.

Seven rounds. Thin monoline w's that vanished into the font. Loops, waves, a lightning bolt. What stayed is the name set in Instrument Sans, the monowire typeface, with only the w drawn with a flat pen: thick and thin strokes, sharp tips, and a second dip that plunges below the baseline, like a wire hanging between two hooks. Monowire climbs to a peak. Patchwire hangs.

The first directions were clever: alerts hanging at a depth that showed their severity, a probe with a reticle, graduated gauges. None of them felt right, so I deleted all four and started again from references I actually liked.

Deep black, monochrome, one red, and the data as the main object. No grain this time: that is monowire's. A security tool should feel like a control room, not an alarm. The red is spent on two things only, critical alerts and actions, and a contrast check added a darker grey so every line of text stays readable.

Patchwire keeps no data about you. Favorites and versions live in your browser. Drop a bun.lock or a package-lock.json and it is parsed on your machine, never sent anywhere. Matching happens in the browser or in your agent.

And the gauges are not allowed to lie: a sector turns red only when a critical or high issue has no fix on the release you run.

Each advisory is read once by Claude, which pulls out the conditions that make it exploitable, the exact source sentence each one comes from, and a confidence level. The source sentence always sits next to the conditions, so you can check every claim.

Critical advisories wait for a person. Until someone has checked them, the page shows the raw source summary and says so: Under review.

A wrong all-clear is worse than a late one.

A security product that leaks its own keys is a punchline. So there is no Anthropic API key for Patchwire at all. The hourly ingestion runs in GitHub Actions and proves who it is through workload identity federation, a short-lived token instead of a stored secret.

Everything fetched from a source is treated as hostile: validated before it is stored, never injected as HTML, and every link built from data is checked before it is rendered.

The feed is live and the agents can already ask it. Next, the alerts go out where people already look, on X, and the MCP server ships as a package you install in one line.