PROVIDER SIGNAL
Stripe
Compatibility change
API CHANGE INTELLIGENCE → REVIEWABLE CODE
Your APIs change.
Your code shouldn’t break.
Catch the change. Trace the impact.
Turn upstream surprises into validated Draft PRs.
Stripe + OpenAISupported patterns. Real safeguards.
PROVIDER SIGNAL
OpenAI
SDK migration
shimpilotCHANGE → CONTEXT
− plan: priceId+ price: priceIdAFTER VALIDATIONA Draft PR.
A Draft PR.
Not a leap of faith.
AN ILLUSTRATION OF THE SIGNAL-TO-PATCH WORKFLOW
Scoped GitHub App accessDeterministic safety gatesDraft PRs, never auto-mergeYour team stays in control
THE MOVING TARGET
Your code is stable.
The world around it
isn’t.
A perfectly good integration can become tomorrow’s incident. Without a single commit from your team.
UPSTREAMAPI evolvesYour code waitsDOWNSTREAM
Changelogs don’t know your codebase. Dependency alerts don’t write your migration. Shimpilot connects the change to the work that needs doing.
Close the gap between “something changed”
and “here’s the patch.”
SIGNAL → PATCH
One change.
A clear path
forward.
Not another feed to watch.
A workflow you can inspect.
human.review = required
Under the hoodDETECT
Listen upstream.
Curated compatibility rules and official releases surface meaningful provider changes.
provider.change.detectedUNDERSTAND
Turn noise into context.
Normalize, classify, and deduplicate each change before it enters your workflow.
change.normalizedTRACE
Find your point of impact.
Map dependencies and supported call sites back to repositories and source files.
dependency.matchedREASON
Apply your boundaries.
Evaluate risk and organization policy. Require approval where you need it.
policy.evaluatedMIGRATE
Propose a coherent patch.
Send relevant findings together for a focused, whole-file migration proposal.
migration.generatedVALIDATE
Make the patch earn its place.
Check syntax, diff limits, and targeted re-scans. Failed required gates block the PR.
validation.requiredOPEN PR
Put the decision in your hands.
After validation and source-integrity checks, open a Draft GitHub PR. Never auto-merge.
human.review.requiredYOUR EXTERNAL WORLD
Built for the APIs
you build on.
Provider-specific intelligence.
Not one generic rule pretending
to understand everything.
Stripe
Payments. Subscriptions. Compatibility.
JAVASCRIPT / TYPESCRIPTOpenAI
AI applications. SDK evolution. Migrations.
NODE.JS / PYTHONTHE HORIZON
Clerk
Supabase
Twilio
AWSMore of your stack.
One direction.
Roadmap providers, not live integrations. No release dates promised.
Coverage is limited to implemented rules and recognized usage patterns. Support does not imply every endpoint or SDK version is covered.
CONTEXT IS THE PRODUCT
Less investigating.
More understanding.
From a provider announcement
to a specific line in your repository.
Find the code behind the change.
Dependency and call-site mapping connects upstream changes to the places that matter.
application /↳ src / billing /↳ subscriptions.ts AFFECTED↳ checkout.ts
ILLUSTRATIVE REPOSITORY MAPMake risk explicit.
Severity, confidence, and migration policy inform what gets queued and what needs approval.
ASSESS → APPLY POLICY → PROCEED
Small diffs. Clear boundaries.
Focused generation with diff limits, source-integrity checks, and a targeted re-scan. An unresolved finding blocks the PR.
if (!validated)
return BLOCKED;Your repository.
Your final call.
Review a Draft PR in GitHub. Keep the tools, checks, and judgment your team already trusts.
NEVER AUTO-MERGEDA SHORTER DISTANCE
Don’t just get notified.
Get to the work.
Shimpilot brings the handoffs together.
It doesn’t remove your judgment.
THE MANUAL HANDOFF
Read the changelog → hunt for usage → assess the risk → write a patch → check it → ask for review.
WITH SHIMPILOTA traceable path from
A traceable path from
provider signal to Draft PR.
Inspect the findings. Understand the proposal. Decide what ships.
TAKE A CLOSER LOOK
From “what changed?”
to “show me the diff.”
Explore a migration example.
No account. No repository access.
MIGRATION EXPLORERILLUSTRATIVE · NOT A LIVE RUN
Compatibility signal
A legacy SDK call meets a new interface.
For an OpenAI Node v3 → v4 migration, createEmbedding becomes embeddings.create. Dependency and response handling changes may also be required.
TRUST HAS TO BE EARNED
AI writes.
Gates decide.
You approve.
Generation is only the beginning. Failed required checks stop a migration before GitHub PR creation.
Read the safety modelAccess with boundaries
A GitHub App scoped to repositories you select. Temporary clones are cleaned up after jobs.
A patch with constraints
Syntax validation, diff limits, suspicious-content checks, and source-integrity validation.
Re-scan, not reassurance
Targeted findings must be resolved. A bounded retry is not an endless permission to keep trying.
Honest about what ran
Repository tests and typechecks depend on configuration. Skipped checks are not passing checks.
CHOOSE YOUR COVERAGE
Start with visibility.
Build your guardrail.
Choose the plan that fits your workflow.
Review current terms at checkout.
Hobby
Get a first look at compatibility.
$0/ free
Try a public scan- Public repository scans
- Explore scan findings
- No automated Draft PRs
Repo Guard
Move from findings to proposals.
$49/ repo / month
Choose Repo Guard- Connected repository workflows
- Migration policy controls
- Validated Draft PR generation
Incident Concierge
Human help for one breaking change.
$299one-time
View plan details- One repository, one breaking change
- Human review and priority triage
- See checkout for service terms
What is Shimpilot?
Shimpilot is an API compatibility and migration platform. It continuously monitors the external APIs your applications depend on, maps how those APIs are used in your repositories, evaluates the risk of upstream changes, and opens reviewable GitHub pull requests to fix breakage before it reaches production.
How does Shimpilot detect API changes?
Shimpilot combines curated compatibility rules with scheduled checks of official provider releases. Detected changes are normalized and deduplicated before impact analysis. Coverage is limited to implemented rules, not every upstream change.
Does Shimpilot modify my code automatically?
Shimpilot can generate a migration patch automatically, but it only ever proposes changes as a Draft pull request on a new branch. It never writes directly to your default branch.
Does Shimpilot merge pull requests?
No. Shimpilot has no auto-merge capability anywhere in its automation policy — every organization policy option (from fully automatic drafting to requiring human approval) still ends at an open, reviewable Draft PR, never a merge.
How does Shimpilot validate migrations?
Patches pass through AST validation, diff limits, protected-file checks, source integrity checks, and a targeted re-scan. Repository typechecks and tests are disabled by default because package scripts can execute arbitrary code. They require an isolated execution environment; skipped checks are reported as not run, never as passed. Failed required gates block the PR.
Which API providers are supported?
The connected-repository pipeline supports implemented Stripe JavaScript/TypeScript patterns and OpenAI Node.js/Python patterns. Coverage is rule-specific, not universal. The public scanner remains Stripe-only. Clerk, Supabase, Twilio, and AWS are roadmap providers, not live integrations.
Does Shimpilot need access to my repositories?
Yes, via a scoped GitHub App installation — never a full-account OAuth token. Access is limited to the repositories you explicitly select, and Shimpilot clones each repository into a unique temporary worker directory that is deleted after the job.
Can I control automatic migration policies?
Yes. Each organization sets a migration policy — from requiring human approval on every migration, to auto-queuing only high-confidence or low-risk changes, to blocking automatic migration entirely. No policy ever enables auto-merge.
Is the sandbox connected to a real repository?
The interactive sandbox above is an illustrative example — it demonstrates the detect-to-PR workflow without touching a live repository or opening a real pull request. To see Shimpilot run for real, use the public scan at /scan/:owner/:repo against any public GitHub repository.
How is sensitive source code handled?
Repository clones are temporary and cleaned up after worker jobs, including failures. Relevant source content is sent to the configured AI provider when generating migration proposals. Review the security documentation and subprocessors before connecting sensitive repositories; do not commit credentials to source code.
UPSTREAM CHANGES. DOWNSTREAM CONFIDENCE.
Let APIs evolve.
Keep your code
moving.
Reviewable changes. Your final call.