Get started

Introduction

Arachne finds vulnerable dependencies in your repositories, proves a fix in a sandbox, and opens the pull request only after a person approves it.

What is Arachne?#

Arachne is a dependency-vulnerability remediation service. You connect a GitHub repository; Arachne reads its manifests, matches every declared dependency against its advisory database (OSV and GitHub advisories, enriched with CISA KEV and EPSS), and for each fixable finding it can run a fix job: pick the lowest safe version, patch the manifest and lockfile, then prove the change in a sandbox with five verification gates. A verified fix waits for a human. Only after you approve it does Arachne push a branch and open the pull request, with the evidence in the PR body.

You can drive it from the web app, or from your own AI assistant through the Arachne MCP server: your model reasons and talks to you; Arachne supplies advisory data, scans and metered actions.

Who it is for#

• Maintainers and small teams who get advisory alerts faster than they can triage them and want a reviewed, tested upgrade PR instead of another alert.
• People who work inside an AI assistant (Claude Code, Claude Desktop, Cursor, VS Code) and want to ask "is anything I own affected by this CVE?" and get an answer grounded in real data.
• Security-minded reviewers who want to see why a version was chosen and what was tested before merging.

The loop: connect → scan → fix → PR#

flowchart TB
  C["Connect a repo"] --> S["Scan manifests"]
  S --> F["Fix job in a sandbox"]
  F --> G{"5 gates pass?"}
  G -- "no" --> X["failed or unverifiable: no PR, use returned"]
  G -- "yes: verified" --> A{"You approve?"}
  A -- "reject" --> R["rejected: use returned"]
  A -- "approve" --> P["PR opened: 1 use"]

A fix only becomes a pull request after it is verified and a person approves it.

1. ConnectAdd a repository by its owner/name. It becomes a project in your organisation.
2. ScanArachne clones the repo, reads the declared dependencies and lists the findings, most urgent first (KEV, then EPSS).
3. Fix"Fix this" queues a sandboxed fix job. It resolves a safe version, patches, and runs the five gates.
4. ReviewYou read the plan, the gate results and the diff, then approve or reject.
5. PROn approval, Arachne pushes a remediation/… branch and opens the pull request. That is the one moment a use is counted.

What Arachne does not do#

• It does not merge anything. It opens a pull request; merging is yours.
• It does not open a PR without a human approval, from the web app or from MCP. pr_open fails unless someone approved the job.
• It does not scan your first-party code for bugs (no SAST). It looks at declared dependencies against published advisories.
• It does not run an LLM of its own against your code in production today: the fixer model is configured as a mock, so live fixes are deterministic, dependency-only changes.
• It does not forward your MCP token anywhere, and the sandbox that runs your build never sees a cloud or GitHub credential.

Plans and the free tier#

Everyone starts on Hatchling, the free plan: 3 uses per person per calendar month (UTC), up to 3 connected repositories and 1 seat. 1 PR = 1 use: submitting a fix job reserves a use, and the use is only consumed when the pull request is opened. A job that fails, ends without a fix, or is rejected gives its use back. The allowance resets at 00:00 UTC on the first day of each month.

Where to go next#