tocsin

Security advisories, built for agents.

Your agent runs on Node, PHP, Python, Go, Rust, Ruby and the packages on top of them. When one of them ships a critical fix, nothing tells the agent. Tocsin does. One feed. One command.

npx tocsin connect

Add to Cursor Add to VS Code

Wires Claude Code, Cursor, Claude Desktop and Codex to the feed in one run.

Or do it by hand:

curl "https://tocsin.sh/v1/events?since=0&min_severity=high"

curl "https://tocsin.sh/v1/check?node=24.22.0&php=8.4.26"

npx tocsin check

MCP: https://mcp.tocsin.sh/mcp

Latest

Updated 7 minutes ago · 9 of 9 sources ok

when	component	CVE	severity	action
2026-10-22	PyPI/virtualenv	CVE-2026-113721	medium	Upgrade virtualenv to 21.14.9 or later.
2026-10-22	PyPI/pillow	-	high	Upgrade pillow to 13.0.0 or later.
2026-10-22	npm/nuxt	CVE-2026-114132	medium	Upgrade nuxt to 4.6.2 or later.
2026-10-22	npm/nuxt	CVE-2026-114133	medium	Upgrade nuxt to 4.6.2 or later.
2026-10-22	npm/nuxt	CVE-2026-114130	low	Upgrade nuxt to 4.6.0 or later.
2026-10-22	npm/nuxt	CVE-2026-114131	medium	Upgrade nuxt to 3.21.4 or later.
2026-10-22	PyPI/pypdf	CVE-2026-113789	medium	Upgrade pypdf to 6.21.0 or later.
2026-10-22	PyPI/pypdf	CVE-2026-113790	medium	Upgrade pypdf to 6.21.0 or later.
2026-10-22	PyPI/pypdf	CVE-2026-113791	medium	Upgrade pypdf to 6.21.0 or later.
2026-10-22	npm/electron	CVE-2026-113796	medium	Upgrade electron to 42.11.3 or later.

Free. No account to read. An API key (free) for watch lists and signed webhooks.

Open source, Apache-2.0. github.com/Fortunian/tocsin
Built with Cromford.