Preparing your next view.
May we use optional analytics to understand visits and improve Shimpilot? The product works without them. Cookie policy
PROVIDER-AGNOSTIC API & SDK COMPATIBILITY
Discover the APIs, SDKs and packages your code depends on—without a fixed vendor list. Trace real repository impact, prepare a minimal migration when evidence permits, and see what passed—or still needs review—before you merge.
Public scan: no login. Free plan: no card.
APIS / UNIVERSAL CORE
Connect statically discoverable API calls and available schema changes to repository evidence. No scan is running in this illustration.
BEFORE YOU CONNECT ANYTHING
Try the real workflow before granting access.
You choose the repositories on the GitHub installation screen.
Real scanning. No signup. No production credentials.
Manual review and policy-gated automation stay distinct.
Manage or revoke the installed App through GitHub.
TRY BEFORE YOU CONNECT
Run Shimpilot against an intentionally outdated public application. Inspect the source and live findings before granting access to a real repository.
Known migration scenarios, safe controls, no production credentials, and inspectable CI.
Run the real scanner, inspect file-and-line evidence, then compare it with the public source.
THE MOVING TARGET
02 / HOW SHIMPILOT WORKS
One evidence-backed lifecycle, from a discovered dependency to a Draft PR or an explicit next step for human review.
01 / DETECT
Discover repository dependencies and monitor relevant changes from reliable upstream sources. A new release alone does not establish impact; missing source coverage stays visible.
HISTORICAL SDK MIGRATION EXAMPLE
OpenAI Node SDK migration guide
createEmbeddingbecomesembeddings.create02 / UNDERSTAND
Map changes to actual SDK usage, wrappers, services, jobs, frontend consumers and tests. Keep confirmed direct impact separate from indirect paths and uncertain service relationships.
src/services/openai.tsExample call sitesrc/jobs/index.tsContext · needs inspectiontests/embedding.test.tsContext · needs inspection03 / FIX
Use authoritative guidance to prepare the smallest safe migration on a dedicated branch. Insufficient or conflicting evidence means analysis and human review, not guessed edits.
− client.createEmbedding(input)
+ client.embeddings.create(input)Review arguments, response assumptions and application behavior.
Not generated for your repository04 / PROVE
Run applicable repository checks, including typecheck, build and tests where configured. Show passed, failed and unavailable checks; provider-specific verification is optional.
Illustrative check categories. No checks have run here.
05 / DRAFT PULL REQUEST
Inspect the diff, sources, checks and human-review evidence. A saved review receipt does not replace validation or grant merge eligibility.
FOLLOW THE CHANGE THROUGH YOUR CODE
“An SDK method was removed” is only the start. Inspect your exact files, direct usage, indirect paths, confidence and linked tests—and see where the evidence still needs human review.
Select a file. Inspect the relationship. Keep certainty explicit.
03 / PROVENANCE, NOT PROMISES
A proposed change should come with an explanation you can follow.
OFFICIAL SOURCE
A historical SDK guide documents the interface migration.
OpenAI Node SDK migration guideREPOSITORY EVIDENCE
A matched symbol at a specific call site. Dependency context stays separate.
Example: src/services/openai.tsPROPOSED ACTION
Update the directly matched interface. Flag response assumptions for review.
createEmbedding → embeddings.createGENERATED ≠ VALIDATED
Record what actually happened. Keep uncertainty visible. Let the evidence decide the next step.
Illustrative check categories. No checks have run here.
YOUR REPOSITORY. YOUR AUTHORITY.
The evidence stays the same. The authority changes. Neither mode turns a generated patch into a safety guarantee.
Generic SDK migrations require explicit approval and human review, and currently cover source-backed request-field renames in eligible public npm repositories. Payment, webhook, data, model and cloud changes retain their review gates. Missing or conflicting evidence stops automation; a review receipt cannot replace a failed check.
05 / TRUST HAS AN ARCHITECTURE
Understand access, processing, verification and review before connecting sensitive code.
GITHUB BOUNDARY
Only repositories you select. Short-lived installation tokens, not a full-account OAuth token.
EXECUTION BOUNDARY
Dependency inventory and supported symbol analysis build repository-specific evidence.
PROVIDER BOUNDARY
Migration planning and generation use configured Groq and Anthropic services. Source handling is explicit, not a no-code-leaves claim.
VALIDATION BOUNDARY
Each check records an outcome. Required failures block advancement; unavailable checks stay unavailable.
HUMAN BOUNDARY
Draft PRs expose the proposed change. Human-review receipts stay bound to their evidence revision and never override merge gates.
INTERACTIVE / ILLUSTRATIVE ONLY
This explorer runs no checks, modifies no code and creates no PR.
Compatibility signal
For an OpenAI Node v3 → v4 migration, createEmbedding becomes embeddings.create. Dependency and response handling changes may also be required.
PROVIDER-AGNOSTIC BY DESIGN
A universal core discovers and analyzes dependencies beyond a fixed provider list. Verified Provider Packs add deeper reviewed behavior where available. Coverage depends on sources, usages and check setup.
UNIVERSAL CORE
Keep known and unknown packages useful without a custom integration for every vendor.
VERIFIED PROVIDER PACKS
Optional reviewed provider rules and checks enhance the same core lifecycle.
CONNECT A REPOSITORY. DISCOVER THE STACK.
Inventory records installed versions and distinguishes actual usage from merely installed packages. Unknown packages stay visible. Reliable sources enable monitoring; weak evidence stays limited.
MANIFESTS + LOCKFILES → DEPENDENCY INVENTORY → USAGE + SOURCE EVIDENCE
DEEPER INTELLIGENCE THROUGH CURRENT PACKS
These five packs extend the core. They are not the complete list of discoverable dependencies.
VERIFIED PROVIDER PACK / 01
Node.js / PythonDEEPER CAPABILITIES
Reviewed SDK migration rules; optional model evaluations with an approved dataset and budget.
LIMITATIONS
Model evaluations need explicit setup and do not certify every model or application. API compatibility alone does not prove output quality or latency.
ECOSYSTEM EXAMPLES / NO DEEP PACK CLAIMED
Twilio
Firebase
Clerk
GeminiLogos are examples, not a support allowlist. Generic package analysis depends on the SDK ecosystem and available evidence. Exact HTTP endpoint attribution, private-network access and migration for every language are not available.
07 / CONTINUITY IS THE DIFFERENCE
Dependency bots flag versions. Release feeds surface changes. General AI helps when you bring the problem and context.
Continuously connects upstream changes to your repository, the blast radius, a minimal migration and recorded verification.
Generic support is evidence-dependent; deep pack coverage is rule-specific. No tool can turn an unavailable check into proof of safe application behavior.
ASK SHIMPILOT
Explore recorded repository health, findings, impact paths and verification in your authenticated workspace.
Ask Shimpilot uses authorized, recorded evidence and references. It identifies missing data rather than inventing passing checks or current provider state.
It is a conversational view of Shimpilot’s engineering intelligence. Generic inventory and every historical scan detail are not yet available through chat.
Open Ask Shimpilot08 / VERIFIABILITY IS THE PROOF
Inspect the source, real scan results, workflow and repository-access boundaries.
FREE EARLY ACCESS BETA
No automatic subscription or charge. Paid plans appear only when beta enrollment is confirmed full or closed.
Beta availability could not be confirmed. Enrollment is temporarily unavailable. We’re checking again automatically; no spot count is assumed.
Check beta accessExisting beta participants retain their recorded free access. A status outage does not end beta or create a paid subscription.
10 / QUESTIONS WORTH ASKING
Repository access deserves a considered answer.
Up to 50 authenticated user accounts can enroll for free during beta, without a credit card. Resource limits and verification gates apply. Once all spots fill or enrollment closes, original plans return for new users. Admitted participants keep their beta grant unless explicitly revoked; they are never automatically charged. This is not a lifetime-free offer.
Shimpilot is the safety layer between your codebase and the third-party systems it depends on. Connect GitHub to discover dependencies, inspect source-backed changes and repository impact, and prepare evidence-backed migrations where safe. The universal core works beyond a fixed provider list; optional Verified Provider Packs add deeper rules and checks.
Shimpilot discovers dependencies from manifests, lockfiles and static usage, resolves trusted upstream sources where available, and compares releases, contracts and SDK definitions. Repository scans and change monitoring use saved schedules and bounded work. Source evidence and installed versions determine relevance; missing reliable sources are shown as limited information, not complete monitoring coverage.
Hobby includes daily or weekly scans. Repo Guard and Incident Concierge also offer scans every 5 or 12 hours and GitHub push/PR triggers. Saving a schedule queues the first scan immediately. Monthly plan allowances still apply.
Repository health is calculated from the current scan findings for that repository so the dashboard can show whether supported breaking usage is present and how serious the current state is. It is a Shimpilot compatibility signal, not a claim that the entire application or every dependency is healthy.
Yes, when you choose Automatic mode and the migration is eligible. Shimpilot generates migrations on dedicated branches, validates them, opens the GitHub pull request, watches required CI, and can run a bounded repair loop before guarded merge. Manual mode performs the generation and validation too, but stops at the validated Draft PR for your team to review and merge.
Manual mode never merges for you: the validated Draft PR waits for your team in GitHub, and the merge webhook triggers post-merge verification after your team merges it. Automatic mode can merge only a low-risk rule explicitly classified for unattended merge after validation, required GitHub CI checks, plan entitlement, and merge protections all pass. Stripe payment and Supabase data-access changes require a human merge. In both modes, Shimpilot verifies the default branch before marking the migration COMPLETED.
Patches pass through AST validation, diff limits, protected-file checks, source integrity checks, a safe TypeScript compiler validation, and a targeted re-scan. Dependency installation runs with lifecycle scripts disabled and Shimpilot credentials stripped. Repository-defined test scripts only run in an isolated execution environment; unavailable checks are reported as not run, never as passed. Required validation failures block the PR.
The universal core retains unfamiliar packages and can discover versions, resolve authoritative sources, normalize changes and trace usage without a custom provider integration. Depth depends on ecosystem and evidence. Stripe, OpenAI, Supabase, Anthropic and AWS have packs with reviewed provider-specific rules; optional payment probes, webhook fixture checks or model evaluations are available only where implemented and configured. Pack availability is not a passing verification result. Exact HTTP endpoint attribution and migrations for every language are not available.
Yes. Tenant-scoped custom definitions can associate packages, API domains and explicitly trusted sources with your repositories. Public HTTPS sources use bounded, SSRF-protected fetching. Private or internal sources use uploaded documents or schemas; Shimpilot does not claim private-network connectivity or authenticated private-registry access. Missing sources remain visible as limited information.
Ask about recorded repository health, findings, impact paths, migration status and verification results. Answers use authorized records and references and identify missing evidence. The chat workspace does not yet expose the generic dependency inventory or arbitrary scan history, and it cannot infer live provider state or checks that did not run.
Yes, via a scoped GitHub App installation — never a full-account OAuth token. Access is limited to the repositories you explicitly select, and Shimpilot clones each repository into a unique temporary worker directory that is deleted after the job.
Yes. Manual mode prepares an eligible migration, verifies it, opens a Draft PR and waits for your GitHub merge. Generic migrations are limited to explicitly approved, source-backed request-field renames in eligible public npm dependencies and require human review. Incident Concierge can merge eligible pack rules after required checks pass. Payment, webhook, Supabase, Anthropic and AWS changes retain human-review requirements. All paths require post-merge verification before completion.
Yes. Run the public Shimpilot sandbox scan without signing in or granting repository access. Its source and intentionally outdated fixtures are public on GitHub. The separate interactive explorer is illustrative and takes no repository action.
No. The sandbox contains static, disposable test code and requires no Stripe, OpenAI, Supabase, or Anthropic credentials, production data, or payment method.
The migration is blocked and no Draft PR is created. Shimpilot records which required gate failed; checks that were skipped or not configured are never represented as passes.
Yes. Hobby is free and requires no card. You can also run the public sandbox scan without an account.
Email support@shimpilot.com for product help.
Repository clones are temporary and cleaned up after worker jobs, including failures. Relevant source content is sent to the configured AI provider when generating migration proposals. Review the security documentation and subprocessors before connecting sensitive repositories; do not commit credentials to source code.
YOUR NEXT STEP
Let Shimpilot watch the dependencies behind your code. Start with one repository, inspect the evidence, and keep control of the next step.
Public scan: no signup. Free plan: no card.