Source-backed intelligence for your stack
intel monitors the sources that publish first, records exactly what changed, and asks a narrow agent chain whether it matters to your versions. Every judgement keeps its evidence.
Priority brief / INT-1042
Installed
3.4.1
Fixed
3.4.3
Exposure
Public
Assessment
The installed release is in the affected range and the service is internet-facing. Upgrade before the next deployment window.
Evidence trail
Vendor advisory · OSV record · local version context
Inside the product
Collect security observations, focus monitoring missions, enrich findings, and route prioritized alerts to operators.
Editorial method / 01
Most “AI monitoring” puts the model at the front and lets it choose what to look at. That makes monitoring probabilistic, which is the one thing an alerting system cannot be. intel does it the other way round.
Mission
what you care about
Source
where it is published
Observation
what changed
Verdict
whether it matters
Alert
who hears about it
Polling every source every minute costs the same as polling hourly, because collection issues conditional GETs and nothing else. The model runs on deltas, so a quiet week is a cheap week — not a week of paying to be told nothing happened.
A collector either fetched or errored, and an error is recorded and retried with backoff. Nothing decides what is worth looking at, so nothing can decide wrongly. Deduplication is a unique index, not an application-level guess.
It reads a single changed item against your stated objective and answers a typed schema. That is a job a cheap, fast model does reliably — and one you can audit afterwards, because every step’s prompt and output is stored.
Evidence desk / 02
Every collector issues conditional requests and stores a cursor, so a poll that finds nothing costs one 304. Deduplication is a unique index on (org, source, external_id) — a database guarantee, not a race between two concurrent polls.
github_releases
Watches releases.atom for any repository. No token required.
github_advisories
The GHSA database, filtered to the ecosystems and packages you run.
github_dependabot
Your own repositories’ open alerts. Needs a PAT with security_events.
osv
Open Source Vulnerabilities, queried per ecosystem and package.
nvd
The NIST corpus, walked by last-modified window so a backlog is worked through rather than skipped.
cisa_kev
Known Exploited Vulnerabilities. Inclusion means exploited in the wild now, not merely scored highly — the best signal per request in the tree.
feed
RSS 2.0, RSS 1.0 and Atom. Categories become labels, so alert routes can match on them.
hackernews
Via Algolia, one request per poll. Score and comment count are kept out of the hash, so a story does not re-alert as it climbs.
webdiff
Any URL, narrowed by CSS selector, with optional JavaScript rendering for pages that need it.
Monitoring room / 03
Try the shipped three-step shape with browser-local sample data. Change the minimum severity and the deciding gate stays visible; no request leaves this page.
Advisory triage
Interactive sample · runs locally
Resolving the first advisory
Sequence paused
STEP 01
Add the affected range, fixed release and local version before judgement begins.
Package
edge-proxy
Installed
3.4.1
Fixed in
3.4.3
The installed release is in the affected range and the service is internet-facing.
Processing
Pending: context is being resolved before either gate can run.
In a real run, every step stores its prompt and typed output. This demo illustrates the gate order with fixed sample inputs; it does not run a model or create an alert.
Dispatch desk / 04
A muted monitoring system is worth less than none, because it also carries the belief that you are covered. Every control here exists to keep the signal-to-noise high enough that the alerts stay worth reading.
Each route carries a minimum severity. Critical goes to your phone; medium goes to a daily digest; low is recorded and never interrupts anyone.
Per route, in your timezone. Anything that arrives inside the window is held rather than dropped, so nothing is lost to a night you chose not to be woken.
The same CVE from NVD, OSV and a vendor feed is one alert with a dedup key, not three. A repeat inside the cooldown is a recorded suppression you can see, not silence.
A send time with minute granularity per route. The hour-windowed dedup key makes a double tick a suppression rather than a duplicate notification.
A failed delivery is retried on a sweep, so a transient ntfy or SMTP outage is not permanent silence for every alert that landed during it.
ntfy for push, SMTP for email, and a signed webhook for anything else. A route can use more than one.
Model Context Protocol
intel serves an MCP endpoint, so an agent in your editor can query what you are watching without you opening a dashboard. Thirty-five tools, each gated by the scope on the API key you mint — a read-only key cannot create a mission, and a key without alert:send cannot make your phone buzz.
intel
{
"mcp": {
"intel": {
"type": "remote",
"url": "https://app.intel.amsterdam-technologies.com/api/mcp",
"headers": {
"Authorization": "Bearer itl_…"
}
}
}
}Bring your own key
Add a Claude subscription token or a Gemini API key in Settings. Chains run against your account, so nothing here marks up your inference or caps it at a tier boundary.
Credentials are encrypted with AES-256-GCM under a key held only in the process environment, so a database copy is not enough to read them. They are masked on every read and never returned to a browser.
Because the model only ever sees changed items, your inference bill tracks how much your watch list actually moves — not how many sources you added or how often they are polled.
Pricing
No source caps, no mission caps, no per-seat pricing. The plan buys the platform; model usage is billed to your own provider account, so this number does not move with how much you watch.
For teams who need to know before the advisory does
€5/month
For teams who need to know before the advisory does — save with annual billing
€48/year
Prices in EUR, VAT handled at checkout. Cancel any time — your observations, verdicts and alert history stay readable after a subscription ends.
How deterministic collection and narrow LLM judgement make monitoring cost track the change rate rather than the poll rate.
Point it at your stack, write one objective, and let it stay quiet until something actually matters.