Built on Nebius Token Factory + NVIDIA Nemotron
Mention the bot and Rivet works out which package is vulnerable itself: it reads the advisory, researches the breaking changes, plans the fix, and iterates in a Token Factory Sandbox until your tests pass. At most one draft PR, or an honest no.
Comment it on any GitHub issue. No package to install.
Draft PR per issue
No PR spam, no broken builds
Edits your tests
Tests must pass — they stay the frozen oracle
Typical run cost
This run: $0.1196 in 1m 46s
Invented versions
Advisories and fixed versions come from OSV.dev
Four triggers, one engine
Every path below runs the same pipeline: OSV detection, Tavily research, a Token Factory Sandbox, and Nemotron. Only the trigger changes.
Mention
@rivetbot upgrade pyjwt, or just @rivetbot and it works out the package itself.
Label
Add the rivet label to an issue. Same effect as a bare mention.
Check first
@rivetbot check replies with a report and starts no run.
Automatic
A Dependabot alert starts a run on its own, with no comment at all.
| Package | Installed | Fixed in | Severity |
|---|---|---|---|
| python-dotenv | 1.0.0 | 1.2.1 | high |
| requests | 2.25.0 | 2.32.4 | medium |
| flask | 1.1.2 | 3.0.3 | low |
Reply with @rivetbot upgrade <package> to start one.
Each checked box opens its own draft PR — never more than one per package per run.
Architectural pipeline
Rivet does not touch your repo directly. Every phase runs against one sandbox checkpoint, with up to three retries before it gives up and says why.
Cross-references your lockfile against OSV.dev and the GitHub Advisory Database. Nothing is flagged without a real advisory ID and a fixed version.
Tavily Search finds the vendor changelog and migration notes; Tavily Extract reads the pages, so the fix follows real docs instead of a guess.
A Token Factory Sandbox checkpoints your repo, installs the bumped dependency (sandboxes keep network access for installs), and runs your test suite until it is green or the attempt gives up.
Nemotron Lightning writes the fix inside the sandbox loop; Nemotron Super reviews only the winning diff and checks it actually resolves the advisory before a PR opens.
Stuck after a retry, the sandbox restores the checkpoint and tries again — up to three attempts per issue.
The Mill
Every stage, attempt, sandbox operation and model call is a row while the run happens — not a log dump after the fact. This is a static mock of the real run detail page, not a screenshot.
Stages
Checkpoint
baseline: 20 passed
Detect
OSV.dev: 6 advisories
Research
2 Tavily calls
Plan
Nemotron Super
Attempt 1
18 failed → 20 passed
Re-audit + review
clean, approved
5 steps this attempt · 18 sandbox operations total
Model calls · 7
Sandbox ops · 18
Sources · 2 Tavily calls
Empirical comparison
Standard bump bots change one line in your lockfile and leave the breaking changes to you. Rivet reads the migration guide and fixes your code until the real test suite is green.
Blind bump to the manifest, no verification of dependent API breaks. The regression research becomes your afternoon.
CI failed after the bump
18 tests failed: test_create_and_list and 17 others, mostly AttributeError on renamed exceptions and a str that used to be bytes.
Pre-flight reproduction, changelog research, and a sandbox loop that edits until the suite is green. Yields one pass-verified draft PR, or none.
Sandbox attested: 20/20 tests passing
Re-audit clean, draft PR opened. Merge stays yours.
On the issue
Verified commits
Every commit on the branch is signed as rivetbot[bot], not your name.
A draft PR
The advisory, the tests that now pass, the sources Rivet read, and the cost — in the PR body.
A check run
“Rivet upgrade” links back to the live run in the dashboard, from the PR itself.
Reactions for progress
An eyes reaction while working, a rocket when a PR opens, a confused face when there's no safe upgrade.
Compute economics
Real cost from the pyjwt upgrade run on this page. No token markups or hidden fees — Token Factory list prices, billed per call.
| Subsystem / operation | Detail | Cost (USD) |
|---|---|---|
| Nemotron Super | plan + review, 2 calls | $0.0098 |
| Nemotron Lightning | fix loop, 4 calls | $0.0017 |
| Token Factory Sandboxes | 16 runs: checkpoint, bumps, tests, re-audit | $0.1081 |
| Tavily | 1 Search + 1 Extract, free tier | $0.00 (free tier) |
| Total run cost | 1m 46s wall time | $0.1196 |
Connect your GitHub repository in less than sixty seconds. Comment @rivetbot upgrade on one advisory or breaking version bump, and read the verified sandbox log.
Powered by NVIDIA Nemotron, Nebius Token Factory, Token Factory Sandboxes, and Tavily.