PROVIDER SIGNAL
Stripe
Compatibility change
API CHANGE INTELLIGENCE → REVIEWABLE CODE
Your APIs change.
Your code shouldn’t break.
Shimpilot detects Stripe and OpenAI changes, traces the exact code they affect, proposes focused migrations, validates them, and opens Draft GitHub PRs.
No signup for the demo · No API keys · No production code· Never auto-merges
Start free. No card required. Read our security model →
Stripe + OpenAISupported patterns. Real safeguards.
PROVIDER SIGNAL
OpenAI
SDK migration
shimpilotCHANGE → CONTEXT
− plan: priceId+ price: priceIdAFTER VALIDATIONA Draft PR.
A Draft PR.
Not a leap of faith.
AN ILLUSTRATION OF THE SIGNAL-TO-PATCH WORKFLOW
Scoped GitHub App accessDeterministic safety gatesDraft PRs, never auto-mergeYour team stays in control
TRY BEFORE YOU CONNECT
Not ready to connect
your code?
Run Shimpilot against an intentionally outdated public application. Inspect the source and live findings before granting access to a real repository.
.github / workflows / ci.yml fixtures / stripe / fixtures / openai / SCENARIO_MATRIX.md
README.md
A production-isolated proof of work.
Known migration scenarios, safe controls, no production credentials, and inspectable CI.
REAL PUBLIC RUN
Don’t take our word for it.
Run the real scanner, inspect file-and-line evidence, then compare it with the public source.
- 01Inspect source
- 02Run scan
- 03Review evidence
- 04Fork if ready
THE MOVING TARGET
Your code is stable.
The world around it
isn’t.
A perfectly good integration can become tomorrow’s incident. Without a single commit from your team.
UPSTREAMAPI evolvesYour code waitsDOWNSTREAM
Changelogs don’t know your codebase. Dependency alerts don’t write your migration. Shimpilot connects the change to the work that needs doing.
Close the gap between “something changed”
and “here’s the patch.”
SIGNAL → PATCH
One change.
A clear path
forward.
Not another feed to watch.
A workflow you can inspect.
human.review = required
Under the hoodDETECT
Listen upstream.
Curated compatibility rules and official releases surface meaningful provider changes.
provider.change.detectedUNDERSTAND
Turn noise into context.
Normalize, classify, and deduplicate each change before it enters your workflow.
change.normalizedTRACE
Find your point of impact.
Map dependencies and supported call sites back to repositories and source files.
dependency.matchedREASON
Apply your boundaries.
Evaluate risk and organization policy. Require approval where you need it.
policy.evaluatedMIGRATE
Propose a coherent patch.
Send relevant findings together for a focused, whole-file migration proposal.
migration.generatedVALIDATE
Make the patch earn its place.
Check syntax, diff limits, and targeted re-scans. Failed required gates block the PR.
validation.requiredOPEN PR
Put the decision in your hands.
After validation and source-integrity checks, open a Draft GitHub PR. Never auto-merge.
human.review.requiredYOUR EXTERNAL WORLD
Built for the APIs
you build on.
Provider-specific intelligence.
Not one generic rule pretending
to understand everything.
Stripe
Payments. Subscriptions. Compatibility.
JAVASCRIPT / TYPESCRIPTOpenAI
AI applications. SDK evolution. Migrations.
NODE.JS / PYTHONTHE HORIZON
Clerk
Supabase
Twilio
AWSMore of your stack.
One direction.
Roadmap providers, not live integrations. No release dates promised.
Coverage is limited to implemented rules and recognized usage patterns. Support does not imply every endpoint or SDK version is covered.
CONTEXT IS THE PRODUCT
Less investigating.
More understanding.
From a provider announcement
to a specific line in your repository.
Find the code behind the change.
Dependency and call-site mapping connects upstream changes to the places that matter.
application /↳ src / billing /↳ subscriptions.ts AFFECTED↳ checkout.ts
ILLUSTRATIVE REPOSITORY MAPMake risk explicit.
Severity, confidence, and migration policy inform what gets queued and what needs approval.
ASSESS → APPLY POLICY → PROCEED
Small diffs. Clear boundaries.
Focused generation with diff limits, source-integrity checks, and a targeted re-scan. An unresolved finding blocks the PR.
if (!validated)
return BLOCKED;Your repository.
Your final call.
Review a Draft PR in GitHub. Keep the tools, checks, and judgment your team already trusts.
NEVER AUTO-MERGEDA SHORTER DISTANCE
Don’t just get notified.
Get to the work.
Shimpilot brings the handoffs together.
It doesn’t remove your judgment.
THE MANUAL HANDOFF
Read the changelog → hunt for usage → assess the risk → write a patch → check it → ask for review.
WITH SHIMPILOTA traceable path from
A traceable path from
provider signal to Draft PR.
Inspect the findings. Understand the proposal. Decide what ships.
INTERACTIVE EXPLAINER
See how a finding becomes
a reviewable proposal.
Explore a representative workflow without running a scan
or taking any repository action.
MIGRATION EXPLORERILLUSTRATIVE · NOT A LIVE RUN
Compatibility signal
A legacy SDK call meets a new interface.
For an OpenAI Node v3 → v4 migration, createEmbedding becomes embeddings.create. Dependency and response handling changes may also be required.
TRUST HAS TO BE EARNED
AI proposes.
Deterministic tooling decides.
You approve.
Generation is only the beginning. Failed required checks stop a migration before GitHub PR creation.
Read the safety modelAccess with boundaries
A GitHub App scoped to repositories you select. Temporary clones are cleaned up after jobs.
A patch with constraints
Syntax validation, diff limits, suspicious-content checks, and source-integrity validation.
Re-scan, not reassurance
Targeted findings must be resolved. A bounded retry is not an endless permission to keep trying.
Honest about what ran
Repository tests and typechecks depend on configuration. Skipped checks are not passing checks.
CHOOSE YOUR COVERAGE
Start with visibility.
Build your guardrail.
Choose the plan that fits your workflow.
Review current terms at checkout.
Hobby
Evaluate Shimpilot on your own repository — public or private.
$0/ free forever
Try a public scan- 1 public or private connected repository
- Unlimited manual scans
- 2 validated Draft PR codemods per month
- Stripe + OpenAI findings and API map
- Community support
Repo Guard
Continuous protection for a growing product team.
$29/ month
Choose Repo Guard- 5 public or private repositories
- Unlimited scans + scan on push, PR, and daily schedule
- 15 validated Draft PR codemods per month
- Migration policy controls
- Email and Slack alerts
- Standard support
Incident Concierge
Unlimited protection with human-assisted remediation and priority support.
$99/ month
Choose Incident Concierge- Everything in Repo Guard
- Unlimited repositories, scans, and migration runs
- Unlimited human-assisted incident support
- Engineer-assisted AST patches
- Priority migration review queue
- Priority support
What is Shimpilot?
Shimpilot is an API compatibility and migration platform. It continuously monitors the external APIs your applications depend on, maps how those APIs are used in your repositories, evaluates the risk of upstream changes, and opens reviewable GitHub pull requests to fix breakage before it reaches production.
How does Shimpilot detect API changes?
Shimpilot combines curated compatibility rules with scheduled checks of official provider releases. Detected changes are normalized and deduplicated before impact analysis. Coverage is limited to implemented rules, not every upstream change.
Does Shimpilot modify my code automatically?
Shimpilot can generate a migration patch automatically, but it only ever proposes changes as a Draft pull request on a new branch. It never writes directly to your default branch.
Does Shimpilot merge pull requests?
No. Shimpilot has no auto-merge capability anywhere in its automation policy — every organization policy option (from fully automatic drafting to requiring human approval) still ends at an open, reviewable Draft PR, never a merge.
How does Shimpilot validate migrations?
Patches pass through AST validation, diff limits, protected-file checks, source integrity checks, and a targeted re-scan. Repository typechecks and tests are disabled by default because package scripts can execute arbitrary code. They require an isolated execution environment; skipped checks are reported as not run, never as passed. Failed required gates block the PR.
Which API providers are supported?
Connected and public scans use the same core analysis for implemented Stripe JavaScript/TypeScript and OpenAI Node.js/Python patterns. Coverage is rule-specific, not universal. Clerk, Supabase, Twilio, and AWS are roadmap providers, not live integrations.
Does Shimpilot need access to my repositories?
Yes, via a scoped GitHub App installation — never a full-account OAuth token. Access is limited to the repositories you explicitly select, and Shimpilot clones each repository into a unique temporary worker directory that is deleted after the job.
Can I control automatic migration policies?
Yes. Each organization sets a migration policy — from requiring human approval on every migration, to auto-queuing only high-confidence or low-risk changes, to blocking automatic migration entirely. No policy ever enables auto-merge.
Can I try Shimpilot without connecting my repository?
Yes. Run the public Shimpilot sandbox scan without signing in or granting repository access. Its source and intentionally outdated fixtures are public on GitHub. The separate interactive explorer is illustrative and takes no repository action.
Does the sandbox require Stripe or OpenAI API keys?
No. The sandbox contains static, disposable test code and requires no Stripe key, OpenAI key, production data, or payment method.
What happens if validation fails?
The migration is blocked and no Draft PR is created. Shimpilot records which required gate failed; checks that were skipped or not configured are never represented as passes.
Can I start for free?
Yes. Hobby is free and requires no card. You can also run the public sandbox scan without an account.
How do I contact support?
Email support@shimpilot.com for product help. You can contact the founder at malshan@shimpilot.com.
How is sensitive source code handled?
Repository clones are temporary and cleaned up after worker jobs, including failures. Relevant source content is sent to the configured AI provider when generating migration proposals. Review the security documentation and subprocessors before connecting sensitive repositories; do not commit credentials to source code.
YOU HAVE SEEN THE WORKFLOW
Ready to trust it
with your repo?
Scoped GitHub App. Draft PRs only. Never auto-merges. Read the security model →