Swarm

Your codebase heals while you sleep. Swarm autonomously detects upstream API changes that break your software, then writes, tests, and opens a pull request with the fix in minutes.

Comment

Inspiration

During my first ever internship at a startup, I walked in pumped to build new features. Instead, a HUGE chunk of my time went to maintaining the 50+ APIs the company depended on. Users would report that something was broken, and almost every time the cause was the same: an API vendor had shipped a change, and nobody had read the changelog. The truth is, NOBODY reads the changelogs. ever! I don’t blame them. No human can keep up with dozens of vendors shipping changes every single day, constantly rereading changelogs over and over again just in case one of them breaks something. API maintenance is one of the most time-consuming, frustrating pain points in software engineering.

I'm not the only one who feels this. Harsha Gaddipati, a fellow Georgia Tech student, former AWS intern and Y Combinator alum, put it perfectly:

"Over the past year, I've worked with over 50 API vendors, mostly early-stage startups. One pattern is consistent: API communication is broken. Breaking changes ship with little warning. Useful features quietly launch and go unnoticed. Changelogs don't get read. Heck, when I worked at AWS, over 30% of our service downtime was due to external api/package changes going unnoticed. This friction made sense before agentic coding tools existed. However, now it doesn't."

He's completley right. Agentic coding tools like Claude Code, Devin and Greptile have proven that developers and enterprises are willing to give external tools access to their codebases, as long as those tools are acually valuable. Two years ago, that was unthinkable. Now it's standard practice. The infrastructure for automated code changes exists. What's missing is the layer that connects API vendors to the code that depends on them.

So I developed Swarm to automate this entire mess away. Solo founders can scale bigger and faster without ever worrying about an API breaking their product overnight, and small software companies no longer need huge engineering teams just to keep their dependencies alive, because a major chunk of that maintenance work just became automated.

What it does

Swarm is autonomous API maintenance, like Dependabot but for APIs, except it writes the fix, proves it works, and texts you. SWARM stands for its five stages:

  • Scan: parses your repo (Python AST) and maps every SDK import, API call site and pinned version.
  • Watch: maintains a knowledge base of 4,700+ real changelog entries, SDK releases and OpenAPI specs across popular api vendors (OpenAI, Anthropic, Stripe, Twilio, GitHub, Plaid, Notion, Resend), refreshed daily by a GitHub Actions job plus a 10-minute poller. 337 breaking changes are catalogued with structured details.
  • Analyze: matches breaking changes against your actual call sites, then an agent confirms whether your code is really affected and how badly.
  • Report: texts you over iMessage through Photon. "Heads up: OpenAI's SDK change broke your repo. Fixing it now." You can steer the fix in plain English, and Swarm asks for your OK before it opens a PR and again before it merges.
  • Mend: Factory's Droid agent writes the fix while every command it runs executes in an isolated Daytona sandbox. Then Swarm independently proves the fix: Droid's regression test must fail on the original code with the real vendor error, and the full test suite must pass on a fresh install of the fixed code. Only then does it offer a PR.

On real open-source repos broken by OpenAI's SDK 1.0 change, Swarm goes from connecting the repo to a tested, verified fix in under a minute. Companies take about 48 hours on average to fix a breaking API change, often because they don't notice until users complain. Once Swarm catches a break, it's almost 2,900x faster!

Demo repo Real break Swarm time RED (old code) GREEN (fixed)
agentflow openai.ChatCompletion removed 45 to 60 s fails with APIRemovedInV1 21/21 to 22/22 pass
davinci-functions openai.Completion removed + retired model 70 to 76 s fails with APIRemovedInV1 22/22 to 23/23 pass

How we built it

  • Factory Droid SDK (Python) is the Mend agent. It diagnoses the break, edits the code, writes a regression test and revises when Swarm's verification rejects an attempt.
  • Daytona runs every command the agent executes, in a fresh sandbox per fix that cold-starts in about 2 seconds from a prebuilt snapshot. By design, Droid has no shell: its only way to execute code is the sandbox, so agent-written code never touches the host. API keys and the GitHub token never enter the sandbox, and PRs are opened from the host.
  • Photon 2.0 (official Python client) powers the iMessage agent: alerts, two-way steering, standing instructions, and approval-gated PRs and merges, with safe handling of ambiguous replies ("hmm" or "wait" never triggers an action).
  • Claude (Anthropic API) classifies changelogs, writes analysis verdicts and runs the conversational agent.
  • Backend: Python, FastAPI, SQLite and Server-Sent Events. Frontend: a single HTML file where the live SWARM workflow graph is the interface. Every stage lights up in real time, and clicking any node shows the real evidence behind it.

Challenges we ran into

  • Making the proof honest. The demo repo's existing tests mocked the removed API, so they passed even on broken code. I rebuilt verification so Swarm runs the agent's new test against the original commit and requires it to fail with the real vendor error. If the test doesn't prove the break, Swarm rejects it and sends the agent back.
  • Sandbox networking. Daytona's network rules blocked the agent's API from inside the sandbox, so I redesigned the architecture so the sandbox is the agent's only way to execute anything. It turned into the strongest security property of the whole system.
  • Speed. Connect-to-fix started at about 2 minutes 15 seconds. Preparing the sandbox the moment a repo connects, giving the agent precise context, and finding why its first attempt kept failing brought it under a minute(a 120% increase in speed!!).
  • Conversational safety. A texting agent that can merge code needs to be careful. Every PR and merge requires a clear yes, and ambiguous replies get a clarifying question instead of an action.

Accomplishments that we're proud of

  • Everything is real end to end: real open-source repos, real vendor breaks, real sandboxes, real PRs and real iMessages.
  • Swarm found a second, hidden bug along the way: one repo silently depended on a package the old OpenAI SDK used to install for it, and the fix declares it properly.
  • A verification guardrail that refuses to trust the agent blindly, which is what makes it safe to merge an AI-written fix from your phone.
  • It survives real failures: page refreshes, server crashes, slow agents and messaging outages all recover cleanly.
  • Once Swarm catches a break, it handles the entire api maintinence worflow about 2,900x faster than the average software company

What we learned

An AI agent is only as trustworthy as the system checking its work. The most valuable part of Swarm isn't only writing the fix, but it's also PROVING the fix works. I also learned how much good engineering lives in the unglamorous parts: timeouts, retries, honest status messages and clean recovery.

What's next for Swarm

  • JavaScript and TypeScript scanning, plus MANY MANY more vendors.
  • Vendor-side integrations, so API providers can push migrations straight to their customers' codebases.
  • Slack and email alongside iMessage, and a hosted version teams can connect in one click.

Built With

Share this project:

Updates

Submission history