Getting started

mendapi is Dependabot, but for every API you depend on: it watches upstream providers for breaking changes, scans your codebase locally for impact, and previews the fix as a reviewable diff. The scanner, fixer and review CLIs contain no network code — that is mechanically enforced by the test suite.

Requirements

• Node.js 22.13 or newer (uses the built-in node:sqlite — no npm installs, ever).
• A git repository you want to protect.

Quickstart

# 1. Fetch the latest API change feed
#    (the ONLY command that touches the network)
npx mendapi sync

# 2. Scan the current repo and save the report
#    (--out is what later steps read; without it the report
#     is only printed as a terminal summary)
npx mendapi scan --out impact.json

# 3. Preview fixes as a unified diff (dry-run: changes nothing)
npx mendapi fix --from-report impact.json

# 4. Turn a fix into a reviewable branch + PR description (local only)
npx mendapi pr --repo . --from-report impact.json

What a scan gives you

In under 30 seconds for repos up to ~2,000 files you get file-and-line impact: which upstream breaking changes actually touch symbols your code uses. That budget is measured, not aspirational: a 2,000-file repo is about where 30 seconds runs out. Large monorepos take proportionally longer. Every finding carries a confidence tier — high means a changed API symbol was matched at an identifier boundary in your files, not just a mention of the provider name.

The full pipeline

1. sync — pull provider release feeds and changelogs into a local SQLite database.
2. scan — match the change database against your repo. Output: impact.json.
3. review — optionally re-check medium-confidence findings (deterministic verdicts, or your own LLM with --llm).
4. fix — apply deterministic migration packs as dry-run diffs; --apply to write.
5. llmfix — draft patches for long-tail changes using your own LLM key (explicit opt-in, never applied automatically).
6. deps — inventory exactly which provider API surfaces your repo uses.
7. pr — package a fix into a git branch with a PR-ready description. Pushing requires an explicit --push.

Next: the CLI reference documents every command and flag, and the security model explains why your code never leaves your machine.