Every dated fact stated anywhere on this site is quoted from this file, not hand-copied per page. If a number here looks old, it's a bug — file it rather than trust it.
The triage and fix-generation stages send repository file contents to the Anthropic API to do their work. Credential scrubbing applies to Patchward's own CLI output and logs — not to what is sent to Anthropic.
source: credential_proxy.py / fix_gen.py source trace, build doc D11
patchward/fix-<finding-id>
source: fix_worktree.py source, directly inspected; lookbook §10
91.20%
source: Yehor's machine, Python 3.14.4 — same run as test-count
checkdmarc#261 — Patchward flagged a Bandit B110 (try/except/pass) finding. Outcome label: closed — superseded. The PR itself was closed with unmerged commits; the maintainer reviewed it, narrowed the exception catch to UnicodeError, and shipped that fix in v5.17.3. The finding shipped; this PR did not.
source: Outcome label verified directly against the PR 2026-08-11 ("Closed with unmerged commits", lookbook §12.2); maintainer follow-up and v5.17.3 cross-checked against callmedai.com live copy 2026-08-20.
2 Patchward security-fix PRs merged, both on mpfb2. Which two of the nine merged mpfb2 PRs are Patchward's is not distinguished by any source available to this site, so they are stated as a count and not linked individually.
source: callmedai.com live copy, read 2026-08-20 ("11 PRs merged across mpfb2, aeon, and mellea — 9 Symbiote type-annotation PRs plus 2 Patchward security fixes, both on mpfb2"). The non-attribution is itself the verified finding, per lookbook §12.2's rule that an outcome label must be literal rather than optimistic.
Runs against your real test suite in the normal (CLI-delivered) case. On the hosted webhook path, when no test runner is present, Gate 3 skips and the PR discloses this explicitly rather than proceeding silently or failing the whole fix.
source: webhook.py / pipeline.py source, §5/C2 decision (2026-08-01), build doc D7 + D8 + Decision 9
uv tool install patchward
source: callmedai.com live copy, cross-checked against real patchward --help output
Free, self-hosted CLI. Install it yourself (`uv tool install patchward`) and run it with your own Anthropic API key and GitHub token — your code and credentials never pass through Patchward's own infrastructure. There is no hosted service, no paid tier, and no sales process.
source: Decision made 2026-09-11 (Yehor Kaliberda): Patchward licensed MIT and the paid GitHub Marketplace / hosted-webhook path formally dropped in favor of staying a free, self-hosted tool. Confirmed against the LICENSE file and the `license` field added to pyproject.toml the same date. Supersedes the prior entry, which described the pre-decision pilot-delivery state (Yehor running the CLI manually against a customer's repository) — that was accurate as of 2026-08-11 and is not retracted, just superseded.
>=3.12
source: pyproject.toml
Semgrep, Bandit, pip-audit, Trivy, ESLint
source: src/patchward/ pipeline source, directly inspected
565 passed, 3 skipped
source: Yehor's machine, Python 3.14.4 — real gate run, not self-reported