CLI reference

mendapi — Dependabot, but for every API you depend on.

Your code never leaves your machine: scan, review, and fix run locally
with no network code (mechanically enforced by the test suite).

Usage: mendapi <command> [options]

Commands:
  sync     Fetch the latest API change feed from provider release channels (network)
  scan     Scan a repo for usage impacted by upstream API breaking changes
  review   Review medium-confidence findings (LLM semantic pass, deterministic apply)
  fix      Preview or apply deterministic migration fixes (dry-run by default)
  llmfix   Draft fixes for LLM-assisted changes with your own LLM (explicit opt-in, --list works offline)
  deps     Inventory which provider API surfaces this repo uses (evidence-backed, local only)
  revalidate Audit migration packs for staleness against newer upstream changes (local only)
  pr       Turn a fix into a reviewable git branch + PR-ready description (local by default)
  mcp      Run a Model Context Protocol server on stdio (tools: scan, fix, deps, revalidate, changes; local only)

Run `mendapi <command> --help` (or with no args) for command options.
Run `mendapi --version` to print the installed version.

Usage: mendapi sync

Fetches the latest API change feed from provider release channels
(GitHub Releases feeds of official SDK repos) into the local change
database. This is the only mendapi command that makes network calls,
and it only runs when you invoke it without --help.

Exit codes: 0 when every feed was fetched, or when some feeds failed
but others succeeded (a "sync incomplete:" line on stderr names the
providers left stale — a later scan is blind to exactly those).
1 when every feed failed and the database was not updated.

Usage: mendapi scan [--repo <path>] [--provider <name>] [--change-id <id>] [--out <file.json>] [--json] [--quiet] [--include-prereleases]

Usage: mendapi review <impact.json> --pending
       mendapi review <impact.json> --verdicts <verdicts.json> [--out reviewed.json] [--dry-run]
       mendapi review <impact.json> --llm [--out reviewed.json] [--dry-run] [--max N]  (BYO LLM; requires MENDAPI_LLM_* config)

Usage: mendapi fix --repo <path> (--migration <name> | --from-report <impact.json>) [--apply] [--run-checks] [--out-dir <dir>] [--ack-stale] [--db <path>] [--json]
       mendapi fix --from-report <impact.json> [--repo <path>] [--apply] [--run-checks] [--out-dir <dir>] [--db <path>] [--json]
Available migrations: openai-v3-to-v4, stripe-v7-to-v8, aws-sdk-v2-to-v3-s3, stripe-node-v22-httpclient-interface, stripe-us-bank-preferred-settlement-speed-removal, stripe-terminal-tipping-bgn-removal, stripe-payment-record-card-details-removal, stripe-payment-record-boleto-tax-id-null-guard, stripe-legacy-card-iin-removal, cloudflare-kv-legacy-routes, shopify-customer-account-draftorder-price, shopify-customer-last-incomplete-checkout, shopify-marketing-engagement-cumulative, hubspot-blogposts-api-move, shopify-order-fulfillment-not-required, twilio-verify-attempts-summary-servicesid, twilio-messaging-brand-registration-a2p-casing, twilio-linkshortening-messagingservicesids-removal, paypal-server-sdk-v1-controller-renames, paypal-server-sdk-v2-options-object, paypal-orders-v2-swish-pix-payment-source-removal, paypal-vault-v3-wallet-profile-fields-removal, paypal-vault-v3-apple-pay-card-fields-removal, paypal-vault-v3-information-link-error-field-removal, paypal-billing-subscriptions-v1-subscriber-address-removal, paypal-billing-subscriptions-v1-shipping-address-trim, paypal-billing-subscriptions-v1-subscriber-pii-removal, paypal-partner-referrals-v2-office-bearers-removal, paypal-partner-referrals-v2-contact-detail-trim, paypal-invoicing-v2-error-link-method-enum-shrink, paypal-invoicing-v2-send-202-body-unwrap, plaid-node-v43-v44-breaking-renames, vercel-web-analytics-dhe-cipher-suite-removal, vercel-project-extended-max-duration-removal, vercel-project-public-source-removal, vercel-store-agent-skill-url-to-agent-skills, vercel-vcr-image-id-or-digest-rename, vercel-integration-resource-edge-config-read-move, vercel-edge-config-to-global-config-path-rename, cloudflare-secrets-store-and-ai-security-path-renames, cloudflare-typescript-v7-deterministic-renames, cloudflare-typescript-v7-named-path-params, cloudflare-account-roles-to-permission-groups, cloudflare-workers-ai-model-slug-renames, firebase-ai-vertexai-to-agent-platform-backend, slack-cli-hooks-file-move, slack-sdk-v8-errors

Usage: mendapi llmfix --from-report <impact.json> [--repo <path>] [--max <n>] [--out-dir <dir>] [--list]
Requires MENDAPI_LLM_* config (BYO compute; see the BYO LLM docs at https://mendapi.com/docs/byo-llm.html). Emits DRAFT patches only; never modifies the repo.

Usage: mendapi deps [--repo <path>] [--json] [--out <file.json>] [--match]

Usage: mendapi revalidate [--json] [--db <path>]

Usage: mendapi pr --repo <git-repo> (--migration <name> | --from-report <impact.json>) [--out-dir <dir>] [--run-checks] [--push]