Your vendors changed. The fix is already open.

m82 Labs watches the APIs you depend on, finds the call sites that break, and opens a pull request carrying the evidence. You merge it.

Join the waitlist
Vendors you use
acme/payments · pull/318
Open3 files+12−9

Replace removed Charges.source with payment_method

Vendor Stripe removed Charges.source from POST /v1/charges. Confirmed against a spec snapshot, not a changelog. Takes effect in 67 days.

m82 labs[bot]opened 8 minutes ago
3 confirmed call sitesbilling/charges.py+2128 passed · 0 failed
Your repositories

The pipeline

Five steps, and the second one is the product.

Detection is not hard. Deciding whether something detected is true, and whether it reaches you, is the entire job.

01DetectEvery watched vendor's spec and changelog is polled and stored as a snapshot. A new snapshot is diffed against the last one, and the difference is what starts everything.
02ConfirmAn announcement is a claim. A spec snapshot or a probe of the live API decides whether the change actually happened — never the wording of a blog post.
03MatchCall sites are found across your repositories and checked against the version you are pinned to. If the change cannot reach your code, nothing else happens.
04FixAn agent edits files in a fresh clone. It holds no credentials, reaches no network, and its licence to edit is bounded by the one change it was sent for.
05Verifym82 Labs runs your tests, checks what was touched against what was allowed, and opens a pull request carrying all of it.

Spec snapshot diffvendor stripe

openapi.json2026-04-30 → 2026-05-28
209POST /v1/charges210 amount: integer211 currency: string—− source: string212+ payment_method: string213 description: string214 288GET /v1/charges/{id}—− source: string
2 removals · 1 addition

Claim, then artifactinvariant 13

untrusted — vendor changelog, 2026-05-12The source parameter on Charges is removed as of API version 2026-05-28.
observed in snapshot 2026-05-28
212− source: string
probe of the live API2026-05-29
→POST /v1/charges source=tok_test←400 Received unknown parameter: source
Confirmed by artifact — not by the announcement

Call sites and version basis3 repositories

acme/paymentsstripe==12.4.02 sites · applicable
billing/charges.py:84billing/refunds.py:31
acme/jobsstripe==12.4.01 site · applicable
jobs/sync.py:210
acme/legacystripe==8.1.0skipped · not affected
acme/docsno dependencyskipped · no call sites

The skip is shown rather than hidden. A repository that was checked and found safe is a result, not silence.

The edit1 of 3 sites

billing/charges.py+1 −1
80def charge_customer(token, amount):81 stripe.api_key = settings.key82 charge = stripe.Charge.create(83 amount=amount,84− source=token,84+ payment_method=token,85 currency="usd",86 )87 return charge.id
No credentials, no network, no git — files only

m82 Labs’s own test runinvariant 10

Baseline126 passed · 2 failed
After the fix128 passed · 0 failed
Edit radius — 3 files, all confirmed call sitesForbidden paths — workflows, .env and lockfiles untouchedPull request opened, carrying all of the above
astra/vendor-stripe/chg_8f2a1cacme/payments#318
  1. dispatched
  2. sites re-confirmed
  3. baseline
  4. agent finished
  5. tests run
  6. PR opened

Both runs are m82 Labs’s, executed after the agent exits — not the agent’s report of its own work.

What lands in your repo

A pull request that argues for itself.

github.com/acme/payments · pull/318opened by m82 labs[bot]
Open3 commits · 3 files · +12 −9

Replace removed Charges.source with payment_method

Why this PR exists

Vendor Stripe removed source from POST /v1/charges in API version 2026-05-28. Confirmed against a spec snapshot, not a changelog.

billing/charges.py1 of 3 files
@@ -81,7 +81,7 @@ def charge(customer, token):    return stripe.Charge.create(        amount=amount,        source=token,        payment_method=token,        currency="usd",    )
m82 Labs ran your tests — not the agent’s self-report
baseline126 passed2 failedafter128 passed0 failed
What the agent was unsure about — verbatim
agent output — not rewrittenjobs/sync.py:210 passes a token from a config value I could not resolve. The replacement is correct if that value is a payment method id. Worth a look.
  • One change, not a sweep

    The edit is bounded by the single vendor change it was dispatched for. Tidying the rest of the file on the way past would count as a failure, not a bonus.

  • An artifact decided this

    A vendor saying it removed something is a claim. What opens a pull request is the spec snapshot showing it gone.

  • Our run, not its word

    Your suite, before and after, executed by the runner — never the agent reporting on its own work.

  • The doubt survives review

    Reproduced exactly as the agent wrote it. This is the line a tool selling confidence would delete.

Boundaries

What m82 Labs will not do.

These are not settings. They are properties of how the system is built, and none of them has a flag that turns it off.

No auto-merge flag and no high-confidence bypass. Every fix waits for a person, every time, regardless of how certain it is.

Its only capability is editing files in a directory. Git, tokens, the network and the merge decision all sit outside the process doing the writing.

CI configuration, .env files and the git directory are off limits — and it is checked after the edit, not asked for politely before it.

A model can propose what a change is. Only an artifact decides whether it happened, and a judgement with nothing observed behind it opens nothing.

Merge gateevery step m82 Labs takes, and the one it does not01 / 04
  1. Change detected, and confirmed against an artifactm82 Labs
  2. Call sites re-confirmed in a fresh clonem82 Labs
  3. Fix written, and your tests run on itm82 Labs
  4. Pull request opened, carrying the evidencem82 Labs

m82 Labs’s reach ends here

Mergedno flag, no bypass, no exceptionyou
4 steps · m82 labs1 step · you
Agent processeverything the process writing the fix can reach02 / 04
  • edit files in /workspaceits only capability
  • GITHUB_TOKENnot in the environment
  • network egressno route out
  • gitoutside the process
  • the merge decisionoutside the system
1 capability4 denied
Path checkrun after the edit, not asked for before it03 / 04
  • src/payments/charge.pyallowed
  • tests/test_charge.pyallowed
  • .github/workflows/ci.ymlforbidden
  • .env.productionforbidden
run failed · edit discardedno pull request opened
Evidence gatea claim is not an observation04 / 04
claimVendor Stripe changelog — “source is removed”modelartifactSpec snapshot 3f9a1c2 — the field is absentobservedPull request opened
claimVendor blog post — “source may be removed soon”modelartifactNone.—Nothing opened
1 artifact · 1 opened0 artifacts · 1 declined

Vendors watched

Three, and we will say so.

Chosen to make detection correct rather than to make the list look long. None of the pipeline is written for a particular vendor, so coverage is a dial rather than a rewrite — and what turns it is precision, not demand.

  • vendor Stripeclean spec — teaches false positives
  • OpenAIhigh churn — model deprecations
  • Slackstale spec — forces the prose path
  • Coming soon

Pricing

Plans that scale with your team.

Start small and move up as your team and repositories grow. Upgrade, downgrade or cancel at any time.

  • Solo$39/month
    Repositories monitored
    2
    Pull requests per day
    1
    Concurrent runs
    1
    7-day trialJoin the waitlist
  • Pro$129/month
    Repositories monitored
    8
    Pull requests per day
    3
    Concurrent runs
    2
    Join the waitlist
  • Max$399/month
    Repositories monitored
    30
    Pull requests per day
    10
    Concurrent runs
    5
    Join the waitlist
Full comparison →