Open source · beta · local-first

AI writes the code.
AgentDiff decides if it ships.

When APIs break, dependencies change, or agents generate code — AgentDiff detects affected call sites, proves the patch in an isolated clean room, and delivers a verified PR with cryptographic evidence.

See how it works View on GitHub

git clone https://github.com/kam6l/agentdiff.git && cd agentdiff && uv tool install .

Deterministic verification · Real-state observation · Zero false claims

REAL-TIME VERIFICATION RUN · E45C0D69

agentdiff / verification capsule recorded

TRIGGER openai 0.28 → 1.0 migration

CHANGERESOURCEPOLICY

!.envdeny

!pyproject.tomlreview

✓src/llm.pyallow

BLAST RADIUS

72/100

HIGH · PR BLOCKED

3 call sites · 1 unexpected mutation · 1 protected inspect proof capsule →

Click "Detected" and "Verified" to switch between initial risk evaluation and clean-room proof.

AST-based API scanning Deterministic policy 0–100 blast radius Clean-room proof Conflict-safe recovery Migration certificates

WORKS ACROSS YOUR STACK

Python 3.12 · 3.13 · 3.14 TypeScript / Node ESLint AST Rust Beta GitHub Actions CI/CD GitLab CI Worktree runner Pre-commit Local hooks

01 30-Second Product Tour

From API change
to trusted PR.

What happens when an upstream dependency introduces a breaking change? AgentDiff automates the entire trust pipeline without human guesswork.

openai 0.28 → 1.0 (ChatCompletion)

src/llm.py:42 · 3 call sites

72/100

HIGH IMPACT

AST transform: 3 files · 0 hallucinated

V0 syntax ✓ · V1 types ✓ · V2 tests ✓

VERIFIED BY AGENTDIFF sha256:e45c0d69...

CLI v0.4.0

$ agentdiff scan --provider openai

Scanning repository AST for upstream provider deprecations...

MATCH openai 0.28 → 1.0 (ChatCompletion removal)

src/llm/client.py:42 → openai.ChatCompletion.create()

src/agents/planner.py:118 → openai.ChatCompletion.create()

src/agents/eval.py:87 → openai.Embedding.create()

Found 3 affected files · 7 call sites · Blast radius: 72/100 (HIGH)

$ agentdiff verify --clean-room --isolated

Replaying AST patch in isolated worktree [/tmp/agentdiff-wt-7f8a]...

V0 SYNTAX Passed (3/3 files parse cleanly)

V1 TYPES Passed (mypy + pyright: 0 type errors)

V2 TARGETED Passed (18/18 affected tests green)

V3 REPO SUITE Passed (316/316 unit + integration tests green)

Verification SUCCESS: Clean-room proof verified · 0 regressions

$ agentdiff cert inspect run_e45c0d69

Cryptographic Migration Certificate:

{
  "certificate_id": "cert_9f4a12b8",
  "provider": "openai",
  "change": "0.28 → 1.0",
  "verification_level": "V3",
  "proof_digest": "sha256:e45c0d69a41e9b28b7e21a4f5c9d8e7a",
  "rollback_cmd": "agentdiff rollback run_e45c0d69 --safe-only",
  "signature_verified": true
}

02 Detect

An API changed.
Who's affected?

AgentDiff scans Python AST to pinpoint every third-party API call across your codebase. Not regex or grep. Provenance-tracked, SDK-version aware, zero false positives.

LEGACY CALL SITEOPENAI 0.28

# Deprecated pattern in src/llm.py
response = openai.ChatCompletion.create(
model="gpt-4",
messages=[{"role": "user", "content": prompt}]
)

AST-TRANSFORMED FIXOPENAI 1.0+

# Verified AST migration
client = openai.OpenAI()
response = client.chat.completions.create(
model="gpt-4",
messages=[{"role": "user", "content": prompt}]
)

$ agentdiff api scan --root . && agentdiff api check --root . --fail-on high

03 Understand Impact

Blast radius,
not guesswork.

AgentDiff computes an explainable 0–100 score from real filesystem observations, dependency changes, and policy outcomes. Every point is accounted for—no opaque model confidence scores.

Explore the blast-radius scoring model

denied mutation (.env)45 dependency file (pyproject.toml)35 created resources01

blast radius81 CRITICAL · PR PROMOTION BLOCKED UNTIL RESOLVED

04 Generate Changes

Deterministic transforms.
Agent fallback.

Known migrations use deterministic AST transforms with 100% precision. Complex migrations fall back to a supervised coding agent. Either way: the patch is untrusted until AgentDiff proves it.

DETERMINISTIC AST Transforms

Provider-extensible transforms for known breaking changes. Zero hallucination risk, exact AST syntax trees.

SUPERVISED Agent Fallback

Coding agents handle arbitrary multi-file refactoring, but output is sandboxed and treated as unproven input.

POLICY CORE Untrusted by Default

Regardless of source, no code reaches your repository without passing the deterministic verification engine.

src/llm/client.py · AST Migration Diff AST Transform · 0 Hallucinations

- # Legacy OpenAI 0.28 call site
- response = openai.ChatCompletion.create(
-     model="gpt-4",
-     messages=[{"role": "user", "content": prompt}],
-     temperature=0.7,
- )
- text = response["choices"][0]["message"]["content"]
+ # Migrated OpenAI 1.0 (Deterministic AST transform)
+ client = OpenAI()
+ response = client.chat.completions.create(
+     model="gpt-4",
+     messages=[{"role": "user", "content": prompt}],
+     temperature=0.7,
+ )
+ text = response.choices[0].message.content

05 Verify Safely

Clean-room proof.
No shortcuts.

Every generated patch is replayed in an isolated worktree. Tests, types, and linters run in a clean environment, completely detached from the generation process. If tests fail, the bounded repair loop steps in.

V0 · SYNTAX AST Validity

Parses without errors across all modified files.

V1 · TYPES Static Analysis

Type checks and imports verified in clean room.

V2 · TARGETED Impact Tests

Targeted test suite for affected call sites passes.

V3 · FULL Repo Suite

Entire repository test suite passes cleanly.

$ agentdiff prove <run-id> && agentdiff promote <run-id>Clean-room proof → conflict-safe promotion

06 Deliver PR

One PR.
Full evidence.

The verified patch is promoted to a pull request with an attached Migration Certificate detailing the upstream change, affected files, test results, proof digest, and rollback command.

Migration Certificate · openai 0.28 → 1.0 verified

Triggeropenai SDK 0.28 → 1.0 (ChatCompletion removal)

Affected files3 files · 7 call sites detected via AST

Migration methodDeterministic AST transform (zero hallucinations)

Blast radius12/100 · LOW (safe for automated promotion)

VerificationV3 Passed (42/42 targeted + full suite green)

Proof digestsha256:e45c0d69a41e9b28...

Rollbackagentdiff rollback <id> --safe-only

07 Differentiation

Not another coding agent.
The trust layer.

Coding agents generate code. Dependabot bumps versions. Neither scores blast radius, verifies changes in clean rooms, or attaches cryptographic proof. AgentDiff is the verifier between generation and deployment.

CapabilityCopilot / CursorDependabotAgentDiff

Blast radius scoring——0–100 deterministic score

Policy enforcement—Basic branch rulesallow / review / deny per path

Clean-room proof—CI pass/fail onlyReplay in isolated worktree

Selective rollbackUndo all changesRevert whole PRConflict-safe per-file recovery

Independent verificationSelf-reporting model—External verification engine

Migration certificates——Machine-readable audit capsules

08 Under The Hood

Trust engine
architecture.

Built on deterministic foundations: no-follow filesystem scanning, tamper-evident SHA-256 digests, warm isolated workspaces, and safe promotion.

PROOF ENGINE Clean-Room Replay

Every patch is replayed in a fresh, isolated worktree. Syntax, types, and test suites run from scratch with zero leakage from the agent environment.

EVIDENCE Durable Capsules

Captures before/after manifests, SHA-256 checksums, policy provenance, blast-radius components, and process identifiers in a versioned local capsule.

RECOVERY Selective Rollback

Targeted undo for review and deny mutations without blowing away allowed work. Human edits become conflicts and are safely preserved.

REPAIR LOOP Bounded Retries

When proof fails, the automatic repair loop retries the patch—strictly bounded to the initial task scope. No infinite agent loops.

POLICY ENGINE Deterministic Rules

Fine-grained path rules with explicit provenance. Every mutation is categorized with allow, review, or deny and audit trail.

WARM WORKSPACES Zero Cold Starts

Pre-warmed workspace snapshots enable sub-second clean-room verification runs without costly dependency reinstallations.

09 Honest Boundaries

Evidence, not
security theater.

The local runtime observes a subprocess. It does not pretend to be a kernel sandbox just because an AI agent executed the command.

Does capture no-follow filesystem state and versioned evidence
Does enforce command mutation policy before local process launch
Does not block network access in local observation mode
Does not claim causal ownership of machine-wide port changes

Read the full security trust model

10 Transparency

What works today.
What's coming next.

AgentDiff is in public beta. Here is an honest accounting of current production capabilities and our near-term roadmap.

AST-based API scanning Zero-false-positive call site detection (OpenAI & Stripe)
Dependency & SDK matching Catalog matching with version awareness
Blast radius scoring Deterministic 0–100 impact scoring
Clean-room verification Isolated worktree proof engine
Policy engine Allow / review / deny rules with provenance
Evidence capsules Tamper-evident manifests with SHA-256 hashes
Selective recovery Conflict-safe per-file rollback (--safe-only)
Zero-touch wrapper Automated agent execution via agentdiff wrap

Automated AST migrations Built-in transforms for major SDK transitions
Verified GitHub PRs Direct PR delivery with Migration Certificates
API Change Manifests Standardized machine-readable change format
Graduated proof ladder Verification levels V0 through V5
Expanded provider catalogs AWS SDK, Anthropic, LangChain, Twilio
Signed release artifacts PyPI Trusted Publishing with provenance
OpenTelemetry export Standardized evidence export to telemetry collectors

The coding agent is probabilistic. The verifier is deterministic.

AI generates.
AgentDiff verifies.

Start with the quickstart Explore the docs

AI writes the code.
AgentDiff decides if it ships.

From API change
to trusted PR.

API change detected

Affected code found

Blast radius computed

Migration generated

Clean-room proof

Trusted PR delivered

An API changed.
Who's affected?

Blast radius,
not guesswork.

Deterministic transforms.
Agent fallback.

Clean-room proof.
No shortcuts.

One PR.
Full evidence.

Not another coding agent.
The trust layer.

Trust engine
architecture.

Evidence, not
security theater.

What works today.
What's coming next.

AI generates.
AgentDiff verifies.

AI writes the code.AgentDiff decides if it ships.

From API changeto trusted PR.

API change detected

Affected code found

Blast radius computed

Migration generated

Clean-room proof

Trusted PR delivered

An API changed.Who's affected?

Blast radius,not guesswork.

Deterministic transforms.Agent fallback.

Clean-room proof.No shortcuts.

One PR.Full evidence.

Not another coding agent.The trust layer.

Trust enginearchitecture.

Evidence, notsecurity theater.

What works today.What's coming next.

AI generates.AgentDiff verifies.

AI writes the code.
AgentDiff decides if it ships.

From API change
to trusted PR.

An API changed.
Who's affected?

Blast radius,
not guesswork.

Deterministic transforms.
Agent fallback.

Clean-room proof.
No shortcuts.

One PR.
Full evidence.

Not another coding agent.
The trust layer.

Trust engine
architecture.

Evidence, not
security theater.

What works today.
What's coming next.

AI generates.
AgentDiff verifies.