Fix · SCA Auto-fix

Vulnerable dependencies, fixed. Automatically, deterministically.

Heeler computes the safest upgrade, proves it builds in a sandbox and in your CI, and opens a merge-ready pull request. No human in the loop until review.

Book a demo See how it works

Why not just use an LLM? ↓

Automated workflow · 24/7 · no human in the loop

Remediate Pillow 9.0.0 (Python image library)

Autotriage

Urgent · fix now

Tier 1 · Production

Function reachable

Runtime library reachable

Internet accessible

Chaining: reaches PII datastore

Exploit threat: Confirmed

Mitigated: No

Deterministic fix

Upgrade to 12.3.0 · handed to agent

Calculated, not LLM reasoned

Breaking changes identified

Dependency graph compatible

Clears every open CVE

Optimal version, not newest

No new CVEs

Package age enforced

Agent validation

Merge-ready PR #519 created

Built in a sandbox with your toolchain

Your repo conventions applied: lockfiles, test command

First-party code updated for the upgrade

CI: 2 failures repaired · 47 green

Developer comment addressed

Cursor Bugbot feedback integrated

Every step auditable

✓ Developer merges · 21 CVEs remediated

How it works

Heeler calculates what to fix first and the exact upgrade, then proves it builds. Your CI signs off.

Decide what to fix first

Urgent, Plan or Defer, by real exposure
Re-scored as your environment changes
Sequencing, not skipping
Automated SLO management

Autotriage →

Deterministic fixes

Never trades one CVE for another
No upgrade that breaks your build
Least disruptive, not the newest
One PR clears the package’s CVEs

Proven by the fix agent

Never review a fix that won’t build
Builds the way your repo builds
Works behind private registries
Unproven fixes arrive as drafts

SAST Auto-fix →

Repair loop

Edits your code to clear failures
Developers comment; it revises
Takes feedback from review bots
Merge-ready when every check is green

Autotriage

Everything gets fixed. The most dangerous first.

A deterministic decision tree uses context from code to cloud to decide what is real risk. Consistent, auditable, and re-evaluated as your environment changes.

Business impact

Tier

Environment

Exploitable · all must hold

Function reachable

Runtime library reachable

Internet accessible

Not mitigated

Blast radius

Compromise

Chaining

Exploit threat

Actively exploited

Likely to be exploited

Urgent

Dangerous and exposed. Exploitable in your environment now.

Auto-fix now

Plan

Exploitable, but not under active attack today.

Scheduled

Defer

Unreachable, undeployed or mitigated. Low real-world risk.

Burned down on a clock

How Heeler Risk decides what to fix first →

The deterministic fix

The upgrade is calculated, not predicted.

Heeler calculates the optimal upgrade from your dependency graph and the code you actually call. Same finding, same answer, every run.

targetOptimal version, not the newest

verifiedClears every open CVE and adds no new ones

account_treeCompatible with your whole dependency graph

functionBreaking changes identified up front, in the functions and methods you call, so the fix agent knows exactly what to update

schedulePackage age policy enforced

account_treePicked by your context: graph, code, policy

Django 4.2.0 · 51 open CVEsYour repo: Python 3.11

Version

Change

CVEs cleared

CVEs left

Code to update

Age

Graph

4.2.30End of life

patch

none

check

5.1.7

major

2 calls

check

check_circle

5.2.17Selected

major

2 callsarrow_forwardfix agent

check

6.1.1

newest

2 calls

check

closeneeds Python 3.12

5.2.17 clears all 51 and fits your stackNewest isn’t optimal: graph analysis finds 6.1.1 needs a Python upgradeBreaking calls known up front, provided to the fix agent to resolve

The agent loop

The fix agent proves it in your build.

The fix agent, on the best model for each task, applies the calculated fix and keeps going until every check is green.

deployed_codeBuilds in a sandbox with your toolchain

ruleFollows your conventions: lockfiles, test command

codeUpdates your code for the upgrade

syncRepairs CI failures in a bounded loop

forumAddresses developer and review-bot feedback

receipt_longRecords every step, hands off when it can’t finish

psychology

It learns your reposMemories are read before every run and written back after, so each fix starts where the last one left off.

hubHeeler’s harness + the best model for each task

Agent executionDjango 4.2.0 → 5.2.17 · PR #519

Merge-ready

downloadLearn

Memories read

pytest test settingspoetry lock --no-updateprivate index

deployed_codeBuild

Sandbox: Python 3.11 · Poetry · private indexpassed

timezone.utcarrow_forwarddatetime.timezone.utc

Meta.index_togetherarrow_forwardMeta.indexes + migration

syncProve

PR #519 opened, then your CI

closeCI run 1 · 2 failedarrow_forwardbuildRepair commitarrow_forwardcheckCI run 2 · 47 green

forumReview

BugbotName the migrationDeveloperKeep the UTC import style

forum2 commentsarrow_forwardbuildRevision commitarrow_forwardcheckCI run 3 · 47 green

uploadRemember

Memory written

orders: Meta changes need a named migration

front_handCan’t finish cleanly? Hands off with a commentreceipt_longEvery step logged in Heeler

After the merge

Merge isn’t the finish line. Deployed is.

Heeler correlates your running deployments back to source, so a fix closes only when the corrected code is seen running. No runtime agent, no tagging, no sign-off.

Active

The vulnerable code is running.

Fixed

The change merged. An assumption about production.

Deployed

The corrected code is seen running, everywhere it ran.

Four ways a fix starts

Start a fix from the app, a pull request, the CLI, your coding agent or a workflow.

In the app

PyYAML 5.3.1 → 6.0.1 · 3 repos · 4 CVEs

Fix Now

lodash 4.17.20 → 4.17.21 · 1 repo · 1 CVE

Fix Now

Fix Now, one or many

Launch the agent from any auto-fixable remediation, or select a batch. The scope shows before anything runs.

On the pull request

✗ Heeler · Dependency Guardrail

PR #612

requests 2.25.1 adds CVE-2023-32681

Apply suggestion

Fix it where it fired

A guardrail flags the change on a developer’s PR and Heeler offers the fix there. One click, and the check flips to passing.

CLI or your agent

$ heelercli fix 30581,30590

Scheduled

schedule_heeler_remediation

MCP

Fix from the CLI or MCP

Run heelercli fix with remediation IDs, or let your coding agent schedule the fix over MCP. Same agent, same validation.

Automatically

New remediation available

→

Fix with Heeler Agent

→

Ticket assigned

PR opened

Fixing as policy

A workflow turns fixing into policy. A new fixable finding appears, the agent fixes it, the PR lands ready to review.

Between runs

Every run learns. Every run is on the record.

Memories

Short, titled facts the agent keeps between runs, written by you and by the agent. A lockfile regenerated in CI, a test that needs an environment variable. It stops rediscovering your repos.

Agent Executions

Every run recorded: the plan it followed, the tools it called, the files it changed, and where the pull request stands.

Heeler vs. an LLM agent

Why not just use an LLM to fix it?

Pointing an LLM agent at a finding, or building your own harness around one, asks a model to find the fix, so the answer changes every run and every step costs tokens. Heeler gives you the best of both: it decides the fix deterministically from your context, then uses the latest models, the best one for each task, to validate it, repair CI and address review feedback.

The Heeler fix agent, on the best models

Every step recordeda full audit trail

CI repair loopuntil every check is green

Usage checkcall sites vs breaking changes

Sandboxyour real toolchain

Memoriesyour build, remembered

Model choicebest model per task

Calculated by Heeler

Fix calculationthe exact fix, no model

Autotriagereal exposure

Service modelwhat runs, who owns it

Reachabilityreachable code paths

Your context, from the Context Engine

Threat intelKEV, EPSS, malware

Ownershipteams, CODEOWNERS

Businesstiers 1 to 4

Cloudexposure, datastores

Runtimewhat is deployed

Coderepos, dependencies, APIs

Cost per step

data_arrayTokensscheduleDeveloper time

LLM agent alone

Asks a model to find the fix

Based on its training dataA different fix each runNot auditableMay not be the right fixRelies on one-off developer effort

Heeler Auto-fix

Calculates the fix, then proves it

Based on your environmentSame finding, same fixEvery step recordedAutomated end to endNo developer time until review

Pick the version

data_arrayTokensReads manifests, lockfiles, advisories and the web

checkNo costCalculated: most CVEs cleared, least disruptive

Map the dependency graph

data_arrayTokensSees a fraction of it, a file at a time

checkNo costAlready modeled, transitive included

Learn your build

data_arrayTokensRelearns it every session

checkNo costRemembered from past runs

Check for breaking changes

data_arrayTokensGuesses from what it read

checkNo costYour call sites checked against the upgrade

Start and steer it

scheduleDev timeA developer prompts, checks and reruns it

checkNo costRuns automatically, the same way for every team

Build and CI

scheduleDev timeFailures land on the developer

checkNo costSandbox build, CI repaired until green

Merge

scheduleDev timeA developer reviews and merges

Per fix

$7.16model API, the token cost

+ dev timeon top, not in the $7.16

$0of your tokens

+ reviewdev time at merge

Bars are illustrative. In the benchmark, an LLM agent alone ran 783 manifest reads, 849 greps and 1,985 web searches.

Estimate it for your team

Benchmarks from published third-party agent research. Model API cost is $7.16 per fix, the blended SCA and SAST average, on the lower-priced of two frontier models at public pricing as of July 31, 2026, with 20% cached input and 35% agent overhead, and excludes infrastructure and labor.

Also in Fix · SAST Auto-fix

Heeler fixes the code you write, too.

For code weaknesses, Heeler writes a concrete before-and-after fix, validates it through your CI and opens a merge-ready pull request.

See SAST Auto-fix →

PURPOSE-BUILT FOR THE AI SDLC

See it fix a real CVE in your repo.

Book a demo See pricing