When to use mendapi
mendapi sits at the intersection of four tool categories — dependency updaters, spec diff tools, changelog trackers, and codemod frameworks — without being any one of them. This page is an honest map of when to reach for which.
The one-line answer
Use mendapi when the question is “which upstream API behaviour changes actually hit my code, and what is the fix?” Use the tools below when your question is a different one.
Tool-by-tool comparison
Dependabot / Renovate (dependency updaters)
Their question: is a newer version of this package available? They open version-bump PRs and surface the changelog, but they do not read your code — whether the bump breaks you is left to your test suite.
mendapi's question: which of the behaviour changes inside that bump (or in the raw HTTP API, with no SDK involved at all) touch symbols your repo demonstrably uses — at file-and-line precision, with a previewable fix. The two are complementary: keep Dependabot for version hygiene, add mendapi for impact and repair.
Stay with Dependabot alone if your API dependencies are all thin SDKs you upgrade eagerly and your integration test coverage is strong enough to catch behavioural breaks.
oasdiff / openapi-diff (spec diff tools)
Their question: what changed between two OpenAPI documents? They are excellent at producing a machine-readable diff — if you own both spec versions and want a CI gate on your own API, they are the right tool, directly.
mendapi's question starts where a diff ends: it maintains the change history for 20 upstream providers (53,543 recorded changes, 1,512 breaking) so you do not have to collect vendor specs yourself, joins each breaking change against your codebase, and ships 42 deterministic migration packs that rewrite affected call sites. A diff is an input; a repaired repo is the output.
Use a spec diff tool directly if you are the API producer gating your own releases, not a consumer of someone else's.
Changelog aggregators & API status trackers
Their question: what did vendors announce? They forward prose changelogs to your inbox. Two structural limits: they only know what the vendor wrote down (mendapi's spec-diff pipeline records breaking changes that never appear in any prose changelog), and they cannot tell you whether an announcement affects your code — every subscriber gets the same alert.
mendapi's answer is scoped to your repo: findings are evidence-gated on file:line usage, so a change to an endpoint you never call produces silence, not noise.
Use an aggregator if you want broad organisational awareness of vendor news rather than per-repo impact.
jscodeshift / ast-grep / OpenRewrite (codemod frameworks)
Their question: given a transform you wrote, apply it across a codebase. They are general-purpose rewrite engines — powerful, but the transform, the trigger, and the validation are all on you.
mendapi's migration packs bundle the trigger (a recorded upstream change), the transform (a deterministic, gold-tested rewrite), and the guardrails (staleness detection via revalidate, dry-run diffs by default, idempotent re-runs) into one unit. When a pack does not cover your case, BYO LLM drafts are the escape hatch — previewed, never auto-applied.
Use a codemod framework directly if you are doing a one-off internal refactor with no upstream-API trigger.
Decision table
Your question Reach for ------------------------------------------------- ------------------ Is a newer SDK version out? Dependabot / Renovate What changed between two specs I own? oasdiff What did vendors announce this week? changelog aggregator Apply my own custom transform everywhere jscodeshift / ast-grep Which upstream API changes break MY code, mendapi and what is the fix?
What mendapi is deliberately not
- Not an API gateway or runtime proxy — it never sits in your request path.
- Not a monitoring/uptime product — it tracks contract changes, not availability.
- Not an auto-merge bot — fixes are dry-run diffs by default; applying and pushing each require an explicit flag. A wrong PR costs more trust than ten accurate alerts.
See the security model for what never leaves your machine, and the FAQ for the short version of everything above.