Always on · CVE · Supply chain

Close the dependency backlog before it reaches your team.

Codicrest is an always-on AI agent that watches GitHub commits, CVE feeds and the npm, PyPI and Maven registries — then drafts the patch, runs it in an isolated sandbox against your own repo, and opens a ready-to-merge PR with the regression diff, tests and rollback notes attached.

Get early accessSee how it worksCompare to Dependabot

drop a line → codicrest@polsia.app

pull/codicrest/428 — commons-text 2.x → 3.0.3
Audited

chore(deps): pin commons-text to 3.0.3 + drop unsafe RandomStringUtils

Pre-vetted by sandbox · 4 of 4 tests pass

Regression diff clean412 / 412 tests passedResolves CVE-2025-31704
-@@ -3,6 +3,7 @@
-import org.apache.commons.text.RandomStringUtils;
+// patched by codicrest sandbox · safe shim
+import org.apache.commons.text.Strings;
class TokenScrubber {
-- String salt = RandomStringUtils.random(16);
++ String salt = Strings.random(16); // commons-text 3.x
}
main ← codicrest/patch-428Ready to merge

The problem

Your scanner queue is 80% noise. The 20% that matters keeps you up at night.

Log4Shell-style incidents hang around for months, not days. Today every CVE bump stops at the PR — the actual code change, the tests, the regression risk — all of that still lands on your team. Codicrest collapses the queue to a short list of pre-vetted fixes you can merge before standup.

Today

On your team

Thousands of scanner hits. A handful get fixed this quarter.

  • Scanner fires on every advisory, 80% are false positives.
  • Dependabot opens a bump PR — humans still triage and patch.
  • Audit trail lives in Slack threads and Jira tickets.

With Codicrest

Pre-vetted

A short list of ready-to-merge PRs lands in your inbox each morning.

  • Agent drafts the minimal code change, not just a version bump.
  • Each patch runs in an isolated sandbox against your own repo.
  • SBOM + CRA-friendly audit entry attached to every shipped fix.

What's inside

Three capabilities your scanner queue never had.

Codicrest isn't another dashboard — it's the loop your team has been hand-rolling after every CVE advisory. Each capability is a contract with how software gets patched in 2026.

24 / 7

Signal ingestion

Continuous monitoring.

Live npm, PyPI and Maven Central feeds. Public GitHub commits on every repository you depend on. NVD, GHSA and OSV advisories the minute they publish — ingested, deduplicated, scored.

npm · PyPI · MavenGitHub commitsCVE feedsPrivate registries
Isolated

Patch generation

Sandbox-tested patches.

For every qualifying signal Codicrest spins up an isolated runner, drafts the minimal source change, and runs your full test suite plus a regression diff — with your own repository as the fixture. Failures drop silently; no PR, no noise.

Minimal diffYour testsRegression check
CRA-ready

Compliance trail

Audit-ready logs.

Every shipped fix attaches an immutable, human-readable record — the SBOM delta, the model reasoning trace, the sandbox test results, the reviewer approval. CRA-aligned, machine-queryable, ready for the auditor and your insurer.

SBOM deltaCRA change logReasoning trace

How it works

One agent, three contracts with your stack.

Codicrest never touches your main branch directly. Every patch is generated, tested, and proposed — humans still approve the merge.

01

Continuous signal ingestion

Watch everything your stack depends on.

Public GitHub commits on the repositories you depend on. NVD, GHSA and OSV feeds the moment they publish. Live registry metadata for npm, PyPI and Maven Central — and your private registries, declared once.

GitHub commitsCVE feedsnpm · PyPI · MavenPrivate registries
02

Isolate, draft, regression-test

A sandbox per patch, your repo as the fixture.

For each qualifying signal Codicrest spins up an isolated runner, drafts the minimal source change, and runs your full test suite plus a regression diff. Patches that fail loud are dropped — no PR, no noise.

03

Vetted, auditable, merge-ready

A PR you can merge before standup — with the story behind it.

Every opened PR carries the triggering signal, the model reasoning trace, the sandbox test results, and the regression diff. Approvals route to whoever owns the affected code. Reject with a comment and Codicrest learns.

— attached to every PR

· triggering signal & severity

· patch diff & reasoning trace

· 412 / 412 tests · regression: clean

· SBOM delta · CRA audit entry

· rollback: revert +amp; redeploy pin

For your AppSec review

An audit trail your security team can actually re-construct.

Every shipped fix attaches an immutable, human-readable record — the kind your insurer, your auditor, and your regulator will accept without a follow-up ticket. SBOM deltas stay in lockstep with merged code; CRA entries stay machine-queryable.

signalgithub.com/commons-text/commons-text: breaking change v3advisoryCVE-2025-31704 · CVSS 7.5 · unsafe RandomStringUtilspatchdrops RandomStringUtils → Strings.random()reasoningmodel: claude-opus · 3 candidates · 1 selectedsandboxrunner eu-west-1 · 412 tests · regression: cleanmergespr #428 · reviewer @you · 2026-08-18 06:14 UTC

Frequently asked

The questions every engineering leader asks first.

Ready when you are

Start the morning with the alert already closed.

Codicrest is onboarding design partners this quarter. Drop your email — we'll send a 30-minute walkthrough on a stack you actually care about.

Re-read how it works

or email us directly → codicrest@polsia.app