BLUETEAM.NEWS
Menu

// open source · self-hosted · MIT

Threat reporting, sources, and daily briefings.

Collect and score public threat reports, compare retained source passages, and prepare an AI-generated assessment for your next shift.

Run locally Read a sample Briefing
Wire with collected public threat reports and source context
Wire · Collected public reporting. Desktop view.
Requirements
Node.js + npm
Briefing generation
Anthropic or OpenAI API key
App telemetry
None

// from source to decision

Inspect the reporting behind each signal.

  1. 01

    Prioritize the report.

    Filter Wire by tier, urgency, KEV, or unread state. Inspect score components and watch-profile matches; local exposure remains unknown.

  2. 02

    Compare what the source says.

    Read retained passages, source dates, and changes between observations without losing the selected signal.

  3. 03

    Generate and review a Briefing.

    Use your selected provider to draft judgments, proposed actions, owners, and decision windows. Check the cited reporting before acting.

Source evidence from collected public reporting, with retained passages and observation times
Source evidence · A closer look behind a signal. View full size.

Wire filters do not select generation inputs. Evidence and generation guide.

// the publication

Read, review, and print the assessment.

One Briefing. Two formats. Review on screen and carry the same assessment into print.

The September 6 live Briefing overview with assessments, response windows, and source context

Briefing

Start with the compact Overview, then open the complete response, qualifications, and citations. Inspect Full report.

The September 6 live assessment in the locally rendered Print Edition

Print Edition

Read the same saved assessment, rendered locally for paper or PDF.

Analyst review remains required. Checks cover structure, citations, and supported CVE, CVSS, version, and KEV claim forms; they do not verify every narrative claim. Each new Briefing retains its generation inputs for review.

Read the fictional sample or download its Print Edition PDF. Both use authored sources, systems, and events.

About these screenshots

Captured September 6, 2026. Wire and source evidence show collected public reporting. Briefing, Print, and Wall show the editorially corrected edition 2, with its review status preserved. These captures illustrate the interface, not a current security assessment; the fictional sample is separate.

// the operations floor

Keep the room informed.

One complete topic at a time, with response ownership, source context, and edition timing. Wall follows your light or dark theme.

The Wall presenting the September 6 live Briefing, with a lead assessment and supporting priorities
The Wall · Shift assessment. View full size.

// quick start

Start the local server.

Requirements: Node 22.19+, 24, or 26 + npm · Anthropic or OpenAI API key for Briefing generation.

git clone https://github.com/ryanshrier/blueteam.git blueteam
cd blueteam
npm install
npm start

Open http://127.0.0.1:3000. Wall and Wire work without a key. In Settings, choose Anthropic or OpenAI, save the provider's API key, and verify it. Choose an OpenAI model in Settings. It uses the Responses API and requires an OpenAI API key. Automatic generation is off until enabled. Configuration guide.

// local trust boundary

Local storage. Defined outbound requests.

BlueTeam.News sends no product telemetry or analytics, and it requires no BlueTeam.News account, license check, or runtime CDN. The default bind is 127.0.0.1.

SQLite data, Markdown Briefings, and a gitignored Settings file stay local. They are not encrypted by the application; protect the host and backups.

On the host
operational data · Briefings · Settings
Configured sources
feeds · article pages · KEV · NVD · EPSS
Anthropic or OpenAI API
key verification and Briefing generation
Configured webhook
selected alert or Briefing fields, if enabled

Key verification and Briefing generation use billable requests to your selected provider. Generation sends selected source evidence and configured organization context. Outbound collection requests identify BlueTeam.News through a configurable User-Agent.

// source and documentation

Run BlueTeam.News locally.

Clone the repository, start the server, and store the evidence on a host you control.

Quick start View the source