How it works

From a vendor’s page to your inbox, step by step.

There is no magic in the middle. Each step is a rule you can read, and each result shows which rule produced it.

Setup

Getting started takes one sentence.

Your agent reads the repo

It lists the packages, services and infrastructure the code depends on. The platform never reads your repository; your agent already has access and keeps it.

The catalogue does the mapping

Over a hundred vendors are catalogued with their status pages, changelogs, release feeds and advisory sources. Package names and config files map to vendors; the agent proposes the list and you confirm it.

Sources start polling

Every automatic source is fetched every five minutes, once for the whole platform, and events fan out to every project that depends on the vendor.

Collect

What it reads.

Status pages

Hosted status pages and their incident feeds, including scheduled maintenance.

GitHub releases

Release notes as the maintainers wrote them.

RSS and Atom changelogs

Any feed a vendor publishes, including ones you add yourself.

OSV security advisories

Advisories by package and ecosystem, with no parsing guesswork.

Status APIs

Connectors for vendors whose status lives behind an API rather than a page.

Vendor email

Through a private inbound address per project, or through subscriptions the platform already holds.

Normalise

One shape for every event.

Whatever the source, an event has the same fields: the vendor’s title and summary, the source and its link, the publish time and the time we first saw it, the category, the vendor’s severity, the priority we assigned, the customer impact (unknown until someone says otherwise), and the provenance: how it was ingested, which parser version read it, and which earlier event it duplicates, if any.

Categories are incident, maintenance, release, breaking change, deprecation, security advisory, announcement, marketing and unknown. Marketing is dropped by default. Unknown is an honest label for mail the rules could not place; it goes to a review queue rather than pretending.

Fold

Updates attach to timelines. Only the first one can page you.

A status page incident has an id; an email thread has its headers; failing both, a near-identical subject from the same sender within three days counts as the same thing. Updates attach to the incident’s timeline and never alert again. When a vendor reopens an incident you had cleared, the timeline comes back; when they only post another update, it does not.

Events a new source back-fills from its history are stored and shown, but not delivered, so adding a vendor does not page the team about last month.

Classify and prioritise

Rules first. No model in the loop.

Classification, priority, deduplication and delivery all work without any AI, which keeps the product fast, cheap and explainable.

Priority from severity and category. An incident the vendor calls critical becomes urgent; a release is normal; a security advisory is high. The rule that decided is named on the event.

Trust from the sender. Email is classified only after we know who sent it. Unverified mail is capped at normal priority; risky mail is quarantined.

Your preferences applied. Per-dependency preferences and sender rules suppress what you said you do not want, and say so on the event.

Explained in sentences. Every event’s “why” page spells out the inputs, the verdicts and the routing. Your feedback (useful, irrelevant, duplicate, misclassified) is recorded next to it.

Route

Immediate, digest, or nothing.

Defaults you can replace. Urgent and high go out at once; the rest wait for the digest; marketing is dropped. Your own rules match on category, severity, priority, dependency, source and environment.

Quiet hours and pauses. Nothing immediate during your quiet window unless you allow critical incidents through; pause a project and nothing goes out at all while sources keep collecting.

Mutes and usage caps. A muted dependency goes digest-only. At a usage cap, events are still stored and only urgent upstream incidents are delivered.

Deliver

Email, signed webhooks, and a record of every attempt.

Email. Alerts and digests from the platform’s own domain, with the event’s source link and the reason it was sent.

Webhooks. A JSON body with the event, signed with HMAC-SHA256 under a per-destination secret shown once, with timestamp, event id and delivery id headers. Failures retry with backoff up to eight times.

Deliveries page. Every attempt with its status, response code and error, and a retry button.

Act

Then it is your call.

Incidents carry the vendor’s lifecycle and yours. You or your agent mark an incident investigating, affected or cleared, with a note that names the evidence. You can hand it to Jira, Linear, GitHub Issues or your Statuspage in one click, or copy the summary. Maintenance windows have their own tab so they never crowd the incidents. The Overview shows what needs you first.

What it never does

Some things are deliberately not features.

Never reads your repository. Your agent does, with the access it already has. The platform only ever receives the dependency list.

Never claims an incident affects you. Customer impact stays unknown until a person or a corroborating source says otherwise.

Never follows links in mail on its own. Except subscription confirmations, and only when you have allowed it and the mail was verified for the vendor’s own domain.

Never treats mail as instructions. Content that reads like instructions is flagged, and agents are told to summarise it, not act on it.

Never changes your systems. No deploys, no remediation, no config changes. It tells you; you decide.

Getting started takes one sentence.

Your agent reads the repo

It lists the packages, services and infrastructure the code depends on. The platform never reads your repository; your agent already has access and keeps it.

The catalogue does the mapping

Sources start polling

Every automatic source is fetched every five minutes, once for the whole platform, and events fan out to every project that depends on the vendor.

What it reads.

Status pages

Hosted status pages and their incident feeds, including scheduled maintenance.

GitHub releases

Release notes as the maintainers wrote them.

RSS and Atom changelogs

Any feed a vendor publishes, including ones you add yourself.

OSV security advisories

Advisories by package and ecosystem, with no parsing guesswork.

Status APIs

Connectors for vendors whose status lives behind an API rather than a page.

Vendor email

Through a private inbound address per project, or through subscriptions the platform already holds.

One shape for every event.

Updates attach to timelines. Only the first one can page you.

Events a new source back-fills from its history are stored and shown, but not delivered, so adding a vendor does not page the team about last month.

Rules first. No model in the loop.

Classification, priority, deduplication and delivery all work without any AI, which keeps the product fast, cheap and explainable.

Priority from severity and category. An incident the vendor calls critical becomes urgent; a release is normal; a security advisory is high. The rule that decided is named on the event.

Trust from the sender. Email is classified only after we know who sent it. Unverified mail is capped at normal priority; risky mail is quarantined.

Your preferences applied. Per-dependency preferences and sender rules suppress what you said you do not want, and say so on the event.

Explained in sentences. Every event’s “why” page spells out the inputs, the verdicts and the routing. Your feedback (useful, irrelevant, duplicate, misclassified) is recorded next to it.

Immediate, digest, or nothing.

Quiet hours and pauses. Nothing immediate during your quiet window unless you allow critical incidents through; pause a project and nothing goes out at all while sources keep collecting.

Mutes and usage caps. A muted dependency goes digest-only. At a usage cap, events are still stored and only urgent upstream incidents are delivered.

Email, signed webhooks, and a record of every attempt.

Email. Alerts and digests from the platform’s own domain, with the event’s source link and the reason it was sent.

Deliveries page. Every attempt with its status, response code and error, and a retry button.

Then it is your call.

Some things are deliberately not features.

Never reads your repository. Your agent does, with the access it already has. The platform only ever receives the dependency list.

Never claims an incident affects you. Customer impact stays unknown until a person or a corroborating source says otherwise.

Never follows links in mail on its own. Except subscription confirmations, and only when you have allowed it and the mail was verified for the vendor’s own domain.

Never treats mail as instructions. Content that reads like instructions is flagged, and agents are told to summarise it, not act on it.

Never changes your systems. No deploys, no remediation, no config changes. It tells you; you decide.

From a vendor’s page to your inbox, step by step.

Getting started takes one sentence.

Your agent reads the repo

The catalogue does the mapping

Sources start polling

What it reads.

Status pages

GitHub releases

RSS and Atom changelogs

OSV security advisories

Status APIs

Vendor email

One shape for every event.

Updates attach to timelines. Only the first one can page you.

Rules first. No model in the loop.

Immediate, digest, or nothing.

Email, signed webhooks, and a record of every attempt.

Then it is your call.

Some things are deliberately not features.

From a vendor’s page to your inbox, step by step.

Getting started takes one sentence.

Your agent reads the repo

The catalogue does the mapping

Sources start polling

What it reads.

Status pages

GitHub releases

RSS and Atom changelogs

OSV security advisories

Status APIs

Vendor email

One shape for every event.

Updates attach to timelines. Only the first one can page you.

Rules first. No model in the loop.

Immediate, digest, or nothing.

Email, signed webhooks, and a record of every attempt.

Then it is your call.

Some things are deliberately not features.

Ten minutes to the first event.