A package can be published to npm and pulled into your CI five minutes later. That's the attack window Dependabot-style scanners miss.
Mendral's supply chain agent catches it at PR time. Typo-squatting, malware, suspicious post-install scripts, and packages under 72 hours old
Custom agents are now available in Mendral.
Build them in Slack: describe the task, iterate, turn it into an agent. Triggers: Schedule, GitHub Push/PR.
A customer is already running daily CI failure triage, weekly build time reports, and CVE impact analysis on dependabot PRs.
New post: how we evaluate our CI diagnosis agent in production.
36,564 investigations. 5.7M CI jobs. 14.4B log lines. 60 days.
No SWE-bench for CI. PR merge rate isn't accuracy. Confidence isn't calibrated. Two case studies of failures the agent caught itself.
Most CI dashboards are activity counters. Fixes merged. PRs reviewed. Numbers that look good and don't tell you much about what to do with them.
We just shipped a redesign that flips it.
Reactive panels for what's burning. Proactive panels for what's worth fixing before it
