Akesis reads the findings your scanners raise, re-scores them for your code and turns the fixes into pull requests. It merges on its own only as far as you allow, and records every decision it makes.
Now onboarding design partners.
Reports of the same flaw (same package, same CVE) merge into one finding with every source kept, then leave as a fix on GitHub, GitLab or Bitbucket. Dependabot, Snyk, Strix and any scanner that writes SARIF today; Wiz and Inspector next.
CVSS is where a finding starts. Exploit likelihood (EPSS), CISA’s known-exploited list, whether your code imports the vulnerable package, and exploits confirmed against your own application move it up or down, with the reasons written out.
Akesis takes the fix PRs Dependabot, Snyk and Renovate open, and opens its own when none exists: the smallest version change, with the lockfile rebuilt in your CI. Every fix is checked against the package’s published checksum. Passing tests are never presented as proof.
The backlog shows what was fixed in the last 30 days, how much Akesis fixed on its own and the median time to fix. Progress you can show, not claim.
Every decision, merge, sign-in and policy change is chained by hash. Export it and verify it without us.
Each repository has its own ceiling. Raising it needs a reason and is recorded; lowering it never asks.
Explains the fix on the pull request. Changes nothing.
Where every new repository starts.
Opens a draft for a person to finish.
Available without a test suite.
Opens a pull request ready for review. A person merges.
A test suite Akesis can run against.
Merges when every gate passes: green CI, verified provenance, inside the paths you allowed.
A verified test suite, a rule you wrote and a stated reason.
In the United States (AWS us-east-2), in one database where each organisation is kept separate by the database itself. AI requests for EU organisations run on Amazon Bedrock in the EU. EU data storage is coming soon; tell us if you need it.
Dependabot, Snyk, Strix (AI penetration testing) and any scanner that writes SARIF, such as Trivy, Grype, OSV-Scanner, CodeQL, Semgrep and Checkov. It adopts fix pull requests from Dependabot, Snyk and Renovate. Wiz and Amazon Inspector come next.
For any CVE on a finding, Akesis shows the vendor’s own fix: the Microsoft KB update, the Red Hat, Ubuntu or Debian package version, the PAN-OS release, the Cisco security advisory for the affected product family, and CISA’s required action. Cisco’s fixed release depends on each device’s version, so Akesis links to Cisco’s fixed-software guidance rather than guessing. It doesn’t install patches on your machines.
Yes. Findings that can’t become a pull request can open Jira issues, by hand or automatically, and Akesis closes them when the scanner confirms the fix. Slack gets alerts and a daily digest through a webhook you create.
Only in a repository you have set to T3, and only for registry fixes that pass every gate. New repositories start at suggest-only, and an emergency stop is always one click away.
Not to rank or fix dependency alerts. AI writes optional plain-English risk narratives from the finding’s details, never your source code. Requests run on Amazon Bedrock in your region and are not used for training.
On GitHub, an app installed on the repositories you choose; on GitLab and Bitbucket, a group or workspace access token you create. It reads alerts, code and CI results, and opens and merges pull requests. Nothing else.
Single sign-on through your identity provider over OIDC: Okta, Microsoft Entra ID or Google Workspace.
Yes. Every action is in an audit log you can filter, export and verify independently of Akesis.
Yes. Akesis is a read-only MCP server: connect it to Claude, sign in with your Akesis account, and ask about your backlog, a finding or a fix in plain language.
We’re working with a small group of design partners. Bring your scanners, your repositories and your questions.
Book a call