Two autonomous agents for Python codebases. Symbiote maps your dependency graph and delivers PEP 484 type annotations as a reviewable PR — 0 pyright errors on delivery. Patchward scans for security vulnerabilities, generates verified fixes, and opens draft PRs — scanning runs entirely on-premise, and its triage and fix-generation stages call the Anthropic API and read repository content to do their job.
We deliver the PR. Your team reviews and merges. We never touch your main branch.
Every public function in your codebase gets comprehensive type annotations. Static analysis works. IDE autocomplete works. Linters stop screaming.
Every public function gets a typed signature. Your existing docstrings, inline comments, and doctests are preserved verbatim — the engine is strictly additive.
Mirror is non-destructive by design. Your execution logic stays untouched. Top-level formatting preserved. No surprise dependency rewrites.
Patchward runs Semgrep, Bandit, pip-audit, Trivy, and ESLint across your repositories, triages findings with a Haiku-based analyst, generates targeted fixes, verifies them through a three-gate deterministic pipeline, and opens a draft PR. Static analysis runs entirely on-premise in a network-isolated sandbox; the triage and fix-generation stages call the Anthropic API directly and read repository content as needed.
→ Request a Patchward pilotSemgrep, Bandit, pip-audit, Trivy, and ESLint run in parallel. Findings are normalised to SARIF, triaged by severity, and handed to Fix-Gen — one finding, one focused fix, no blast radius.
Gate 1: re-scan confirms the rule no longer fires. Gate 2: diff bounds check confirms the edit is within the authorised lines. Gate 3: test suite must pass. A fix that fails any gate is discarded — never pushed.
Patchward's scanners run entirely inside your environment, in a Docker sandbox with default-deny iptables egress: most scanners (Semgrep, Bandit, ESLint, Trivy, OSV-Scanner) run fully offline, and pip-audit/npm-audit get a narrow, allowlisted exception to reach PyPI and the npm registry for vulnerability-database lookups. Two LLM stages — triage and fix generation — call the Anthropic API directly to do their work, and read file contents from your repository as needed; credentials are scrubbed from Patchward's own logs and CLI output, not from what is sent to Anthropic.
uv tool install patchward — single command, then patchward fix --repo . Point it at any repository and it runs the full pipeline.
Symbiote parses your repo into a typed AST graph and computes the dependency blast radius for every file. You get a free Reconnaissance Scan: missing type hints, undocumented functions, fragile call paths.
The Mirror agent annotates each file under Bouncer-mediated file locks, with collision-free guarantees logged to a nanosecond-precision audit trail (kernel.log). Additive-only by design: the engine adds PEP 484 type annotations to existing signatures and does not change runtime logic. Before any write reaches disk, a deterministic check aborts it if a function's existing docstring would shrink by more than 20%. All work happens on a dedicated branch.
You receive a single Pull Request on a symbiote/plan-{id} branch. Your engineering team reviews and merges. We never push to your main branch. You own every commit.
Every write is preceded by a granted lock with transitive blast-radius checking. Two agents physically cannot modify overlapping dependency chains simultaneously.
kernel.log records every lock acquire, wait, release, and denial with monotonic-nanosecond timestamps. Every run ends with a verdict line: COLLISION-FREE ✓ or COLLISION DETECTED ⚠.
Code snippets transit Anthropic's enterprise API with zero data retention. Your proprietary code is never used to train future models. Full NDA available.
Every mutation lives on its own symbiote/plan-{id} branch. We never touch main. Worst-case rollback is a single git branch -D.
Full-file LLM rewrites under context-budget pressure can compress existing prose on large, well-documented codebases. The v1 engine avoids this entirely: it only adds type annotations and leaves every existing docstring, comment, and doctest untouched. The v2 architecture replaces full-file rewrites with an AST-aware patch-merge model that splices changes at the ParsedNode level — eliminating context pressure before we ship documentation generation at scale.
AI Systems Architect based in Aarhus. CallMed AI is a one-person + AI agency. I built Symbiote to solve governed, collision-free autonomous code mutation — and Patchward to bring the same rigour to security: scan, triage, fix, verify, and PR, all on-premise. Every delivery ships under my personal sign-off.
CallMed AI is an autonomous Python codebase engineering service based in Aarhus, Denmark. We build two products: Symbiote, which adds PEP 484 type annotations to your repository and delivers a reviewable PR within 72 hours; and Patchward, which scans for security vulnerabilities, generates verified fixes, and opens draft PRs — entirely on-premise. We never modify your main branch.
Symbiote is an autonomous codebase evolution engine. It parses a Python repository into a typed AST dependency graph, then runs a Mirror Pass agent that writes type annotations under Bouncer-mediated file locks — collision-free concurrent writes with a nanosecond-precision audit trail. Built by CallMed AI in 2025–26.
Yes — Symbiote. It maps your dependency graph, identifies every untyped public function, and writes complete PEP 484 typed signatures without changing logic, formatting, or existing docstrings. Delivered as a single Pull Request with 0 pyright errors confirmed before delivery.
MonkeyType requires running your test suite and introduces up to 270× execution overhead — it produces a draft a developer still needs to review and clean up. Pyrefly's infer command can insert hints but produces unverified output with no pyright check. Symbiote delivers a commit-ready PR with 0 pyright errors confirmed before delivery. The difference is a draft versus a deliverable.
CallMed AI, founded by Yehor Kaliberda and based in Aarhus, Denmark. Built for engineering teams and CTOs who need measurable static-analysis compliance without the internal bandwidth to run annotation sprints manually.
$1,500 flat for a full Mirror Pass — complete PEP 484 type annotations across your entire Python repository, reviewable PR within 72 hours. A free Reconnaissance Scan (read-only, no code changes) is included. One free pilot scan per company per quarter.
Yes. Symbiote's Mirror Pass is strictly additive: it only adds type annotations and never modifies runtime logic, comments, or existing docstrings. Every write is gated by a Bouncer lock with transitive blast-radius checking. All work happens on an isolated symbiote/plan-{id} branch. Worst-case rollback is a single git branch -D.
Symbiote adds type annotations. Patchward fixes security vulnerabilities. Patchward runs five static analysis scanners (Semgrep, Bandit, pip-audit, Trivy, ESLint), triages findings with an AI analyst, generates fixes, and validates each one through a three-gate deterministic pipeline — re-scan, diff bounds, test suite — before opening a draft PR. The scanners run entirely on-premise in a network-isolated sandbox; the triage and fix-generation stages call the Anthropic API directly from your environment and read repository content as needed to do their job.
For type coverage: send a Python repository URL and get a free Reconnaissance Scan — a map of missing type hints and dependency blast radius, plus a fixed quote for the full Mirror Pass. For security: request a free Patchward pilot and see verified fix PRs before you commit to anything.