FAQ
How is this different from Dependabot?
Dependabot tells you a new SDK version exists. mendapi tells you which upstream API behaviour changes — SDK or raw HTTP — actually hit your code, at file-and-line precision, and previews the fix. Version bumps are the messenger; breaking changes are the message.
Does my code get uploaded anywhere?
No. scan / review / fix / deps run with zero network code (mechanically enforced by our test suite). Optional hosted reporting is metadata-only, whitelist-constructed, secrets-redacted, and requires an explicit flag. Read the security model.
Do I need an LLM to use mendapi?
No. Detection, scanning and deterministic migration packs are fully rule-based. LLM features are optional, opt-in, and run on your key or local endpoint — see BYO LLM.
How do you keep false positives down?
Findings are evidence-gated: high confidence requires a changed symbol matched at an identifier boundary in your files. SDK releases only implicate repos that import that SDK; monorepo sub-packages you do not use are filtered. Gold fixture repos assert both what must be flagged and what must stay silent, on every engine change.
What happens when an upstream API changes again after a pack was written?
Packs record the upstream state they assume. mendapi revalidate compares each pack against newer changes in the database and marks stale packs needs-revalidation; mendapi fix refuses to apply a stale pack without an explicit --ack-stale. Rules are never allowed to rot silently.
Will mendapi open pull requests automatically?
Not without you. mendapi pr builds the branch, commit, and PR description locally; pushing requires an explicit --push. A wrong PR costs more trust than ten accurate alerts — automation stays on a leash.
What does it cost?
The CLI is free to run locally. Hosted monitoring, fix PRs and team features follow the pricing page — numbers there are pre-release hypotheses and may change before launch.
Which languages are supported?
JavaScript and TypeScript codebases today (Node.js ecosystem SDKs plus raw HTTP calls to provider APIs). The change database itself is language-agnostic; more scanners are on the roadmap.