notify

Suite glue — pipe jfind/v1 findings in, route to Slack / Teams / webhook / file / stdout

v1.0.0
NixOS x86_64

Quick start

Install via jcli (recommended)

jcli install notify

If you don't have jcli yet, install it first with curl -fsSL https://cli.johlem.net/tools/jcli/install.sh | bash.

Install directly

curl -fsSL https://cli.johlem.net/install.sh | bash -s -- notify

Ed25519 signature verification is mandatory by default; set ALLOW_UNVERIFIED=1 to explicitly opt out (not recommended).

Run it

notify --help                # subcommand catalogue + flags
notify --full                # extended help across every subcommand
notify --about               # machine-readable attribution (JSON)
notify --version             # version string

What it does

notify is the suite-glue dispatcher for the cli.johlem.net suite. Every finding-emitting tool (credsweep, urlrecon, phishprobe, specter, avwatch, socialscope, inciclass, roigen, tiberscope, cmdb, …) outputs jfind/v1 NDJSON; notify reads that stream from stdin or --input and routes each finding through every configured channel whose per-channel filter matches. Channel kinds: slack (incoming-webhook → branded attachment, severity-coloured), teams (Office365 MessageCard), webhook (generic POST/PUT JSON), file (append NDJSON), stdout. Mail delivery is intentionally deferred to mailforge — pipe yourself. Per-channel filters AND four dimensions: severity_min (info / low / medium / high / critical), categories (jfind category set), tools (producer set), frameworks (DORA / NIS2 / ISO 27001 / CSSF), mitre_techniques. Minimal `{{ key | upper }}` templating without a full template engine. Config in TOML at $XDG_CONFIG_HOME/cli-johlem/notify.toml (override via $NOTIFY_CONFIG). `notify config init` writes a fully-commented starter. Tool #2 in the 2026-06-23 productivity queue (after cmdb). 20 unit + 14 integration tests; zero compiler warnings.

Authorisation and warranty: use only in environments where you have explicit written authorisation. This tool is provided as-is with no warranty. Report vulnerabilities privately at security@johlem.net.

Release artefacts & provenance

Every signed release ships with checksum + signature sidecars plus a CycloneDX SBOM. Enterprise procurement can pin third-party components without unpacking the binary.