01
Prioritize the right advisory
Mendr reads advisories, lockfiles, reachability, KEV, EPSS, and repo context so the inbox reflects what deserves attention first.
Reachable + KEV moves up
Verified dependency remediation
Dependency alerts in. Verified fix PRs out.
One pull request per package — breaking changes handled, transitive pins cleared, proven against your CI before it asks for a minute of review. Your team gets its afternoons back, and you only pay when a fix goes green.
Read-only first scanYour CI is the gateOnly green fixes bill
package.json · "axios": "0.21.1"untouched since 2021
Advisory historyOpen
May 2021CVE-2019-10742DoS via unbounded body1
Nov 2021CVE-2020-28168SSRF proxy bypass2
Aug 2022CVE-2021-3749ReDoS in header parsing3
Jan 2024GHSA-wf5p-g6vw-rhxxSSRF via redirectcritical4
mendr[bot] · today
0openfix(deps): upgrade axios to 1.7.4
One pull request clears all four — source edits for the 1.x major included.
✓ CI green · review required
Dependabot
4 PRs · 4 reviews · 4 CI runs
Mendr
1 PR · ✓ CI green
Advisory intelligence
- OSV Scanner
- GitHub Advisories
- Dependabot
- CISA KEV
- EPSS
Mendr vs Dependabot
Where Dependabot stops, Mendr finishes.
Dependabot tells you a dependency is vulnerable and bumps a version number. Mendr does the rest of the job.
Capability
Dependabot
Mendr
Pull requests
One per advisory — an inbox of noise
One per fix — every CVE in a package, handled once
Breaking changes
Left for you to fix by hand
Resolved inside the pull request
Source code edits
Never — it only edits version numbers
Made when the upgrade requires them
Deep / transitive CVEs
Often can't update to a non-vulnerable version
Upgrades the parent dependency that pins it
Prioritization
Raw CVSS severity
KEV, EPSS and reachability on top of severity
Verification
None — the PR may not even build
Checked against your CI before it's marked ready
Transitive remediation
Fixes the vulnerable path, not just the first package.
The vulnerable node is often several levels down. Mendr traces the path, upgrades the parent that pins it, and carries the fix into a reviewable pull request.
your-app
Application root — nothing here changes.
glob 7.1.0 → 8.0.0
Direct parent upgraded. Mendr rewrote the call sites glob 8 breaks.
minimatch 3.0.4 → 3.1.2
Transitive vulnerable dependency cleared by the parent upgrade.
✓ 2 source edits
✓ CI green
✓ review-only PR
Verification
Mendr never marks its own work green.
Every candidate fix is checked twice before it reaches you. First an advisory scan of the base and the candidate proves the CVE is actually gone — and that nothing new arrived. Then your own CI and branch protections take over. A fix that can't prove itself never asks for your time, and never counts against your plan.
✓ advisory gone — base vs candidate
✓ your CI is the gate
✗ failed attempts — free
How it works
Start with the inbox. Move toward reviewable fixes.
Mendr works with the security inbox you already have: prioritize real exposure, map the dependency change, and give reviewers the context to decide what ships.
02
Prepare the fix path
It works out which package needs to move to clear the vulnerable node, including parent dependencies and the source edits a major upgrade may require.
Upgrade path + required edits
03
Hand off a reviewable PR
Each fix is packaged with the advisory, diff, risk, and CI context so your existing branch rules and reviewers stay in charge.
Review required · CI context
Prioritization
Fix what's actually exploitable first.
Mendr weighs exploit activity, reachability, advisory source, and upgrade risk so the queue reflects what actually matters.
#PackageVerdict
01Fix now
lodash@4.17.20
CVSS 6.5 · Mediumreachable + KEVEPSS 71%
02Queued
axios@0.21.1
CVSS 9.1 · CriticalreachableEPSS 18%
03Deferred
moment@2.29.1
CVSS 9.8 · Criticalnot reachableEPSS 2%
Integrations
Connect the systems already in the remediation path.
Mendr sits between the places where dependency risk shows up, where fixes are reviewed, and where teams coordinate follow-up.
GitHub
Code and pull requests
Install the GitHub App, choose repositories, and let Mendr read alerts, open fix branches, and follow your existing checks.
repos · alerts · PRs · checks
Slack
Team notifications
Connect a workspace and choose a channel so scan results, fix status, and follow-up can land where the team already watches.
workspace · channel · test message
Jira
Security backlog
Link findings to Jira work and configure ticket policy by repo, so dependency cleanup can stay visible in the planning system.
site · project · issue links
AI providers
Repair assistance
Keep provider settings in the app for cases where a dependency upgrade needs source edits instead of only a version bump.
configured by workspace
Security
Repository access stays scoped and auditable.
Scoped permissions, disposable checkouts, branch protections, and audit trails keep the automation constrained.
Your CI is the gate
Mendr watches your existing checks and branch protections. It never marks its own work green.
Least privilege by default
The GitHub App reads metadata, alerts, and checks; write access is limited to fix branches and pull requests.
Disposable repair environments
Temporary checkouts are used only for scans and fixes, then deleted when the job ends.
Audited and encrypted
Material actions are audit logged, and stored credentials are encrypted at rest.
Pricing
You pay for green checkmarks, not compute.
Deterministic version bumps stay unlimited on every plan. The only thing metered is a verified AI repair — a pull request that opened and passed your CI. Failed attempts never count.
Free
$0forever
Connect GitHub- 5 repos · unlimited users
- Weekly + on-demand scans
- Unlimited deterministic PRs
- 15 verified AI repairs first month, then 3 / mo
- Bring your own OpenAI key
Pro · Beta
$49/ mo
Start Pro beta- 50 repos · unlimited users
- Daily + webhook rescans
- 100 verified AI repairs / mo
- Slack · Jira · SLA · reports
- Low-risk auto-merge (beta)
Verified AI repair PRs37 / 100
Failed repair attemptsfree · not counted
Deterministic version bumps∞ unlimited
Only landed fixes count. A repair PR meters once it opens and passes your CI.
No overages. Free queues extra fixes behind an upgrade — nothing is ever silently billed.
FAQ
Questions, answered.
The short version: Mendr behaves like a careful teammate with a narrow GitHub App, not a bot with a merge button.
What does “verified” actually mean?
Two independent checks. Mendr scans the base and the candidate to prove the advisory is gone and nothing new arrived, then your own CI must pass on the pull request. Mendr never marks its own work green — and only verified AI repairs count toward your plan.
Does Mendr merge code on its own?
Mendr opens every fix as a pull request and can auto-merge the ones that pass your CI, based on rules you set. You decide how much autonomy to hand over.
Can it fix vulnerabilities deep in my dependency tree?
Yes. Mendr traces the dependency path, finds the parent constraining the vulnerable package, and upgrades that parent to clear the advisory.
Why does Mendr open fewer pull requests than Dependabot?
Dependabot opens one PR per advisory. Mendr groups every advisory affecting a single package into the one update a developer would actually make.
Can Mendr handle breaking changes?
Yes. When a security upgrade requires code changes, Mendr makes those edits in the pull request and proves the result against your CI.
What permissions does the GitHub App need?
The minimum needed to do the job: read repository metadata, alerts, and check results, plus write access to branches and pull requests for fixes.
Two minutes, read-only
See the exact PRs Mendr would open in your repos.
Connect a repo read-only. In about two minutes you'll see your real backlog ranked by exploitability — and the fixes Mendr is ready to open.