For DevOps and SRE teams

The code changes Renovate and Dependabot can't make.

Tidra is the AI agent DevOps teams use for org-wide code changes that go beyond version bumps: API substitutions, framework upgrades, CI/CD migrations, and CVE remediation across every repo in scope.

Start free trial Book a demo

Built by OpsLevel · SOC 2 Type II · Used by

1. Describe the change

What change do you want to make to your repositories?

We'll generate a step-by-step plan and propose the necessary code changes.

Describe the change you want to make across your repositories...

Start with a sample prompt:

Scan JS package managers for affected Axios versions Upgrade Lambda runtime to Python 3.12 Add static-analysis workflow to all repos Upgrade a library with breaking API changes

REFINEMENT HISTORY

Just now

Use random IV per call instead of static

2 minutes ago

Generated initial plan

How would you like to refine this plan?

E.g. "Prioritize Python services first"

CURRENT PLAN

Summary

Replace deprecated crypto.createCipher and createDecipher calls with createCipheriv and createDecipheriv across all Node.js services. Tidra will refactor each call site to generate a random initialization vector per encryption and update calling code to thread the IV through.

Key Changes

✓ Identify createCipher and createDecipher call sites
✓ Refactor each call to use createCipheriv with random IV
✓ Update calling functions to pass and store the IV
✓ Add helper to generate cryptographically random IVs
✓ Update unit tests for new function signatures
⚠ 3 repos use custom encryption wrappers: will flag for review

Maintenance Agent / Crypto API Upgrade

Crypto API Upgrade Active

23 repos targeted

12 complete · 6 generating · 5 queued

RepoStatusComplexityTime

acme/auth-service Code Generated Medium 2.0s

acme/session-manager Code Generated Low 1.6s

acme/payment-processor Generating High ...

acme/api-gateway Generating Medium ...

acme/user-service Queued Low ·

acme/billing-service Queued Medium ·

acme/notifications-service Queued Low ·

acme/file-storage-api Queued Medium ·

acme/encryption-utils Queued High ·

acme/audit-log-service Queued Low ·

…and 13 more repos

acme/permissions-api

permissions api Code Generated Medium Complexity

21 files changed

Files

src/utils/crypto.js

src/services/session.js

tests/crypto.test.js

src/utils/crypto.js

1 /**

3 * Migrated from createCipher (deprecated) to createCipheriv.

5 function encrypt(payload, key) {

6 − const cipher = crypto.createCipher('aes-256-cbc', key);

7 − let encrypted = cipher.update(payload, 'utf8', 'hex');

8 − encrypted += cipher.final('hex');

9 − return encrypted;

6 + const iv = crypto.randomBytes(16);

7 + const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);

8 + let encrypted = cipher.update(payload, 'utf8', 'hex');

9 + encrypted += cipher.final('hex');

10 + return { iv: iv.toString('hex'), data: encrypted };

src/services/session.js

1 async function storeSession(userId, payload) {

2 const key = await getEncryptionKey(userId);

3 − const encrypted = encrypt(payload, key);

4 − return db.sessions.create({ userId, data: encrypted });

3 + const { iv, data } = encrypt(payload, key);

4 + return db.sessions.create({ userId, iv, data });

tests/crypto.test.js

1 describe('encrypt', () => {

2 it('produces a different ciphertext per call', () => {

3 − const result1 = encrypt('secret', key);

4 − const result2 = encrypt('secret', key);

5 − expect(result1).not.toEqual(result2);

3 + const result1 = encrypt('secret', key);

4 + const result2 = encrypt('secret', key);

5 + expect(result1.data).not.toEqual(result2.data);

6 + expect(result1.iv).not.toEqual(result2.iv);

Maintenance Agent / Crypto API Upgrade

Crypto API Upgrade Active

0 PRs created of 23

RepoStatusPull RequestAction

acme/auth-service Code Generated · Create PR

acme/session-manager Code Generated · Create PR

acme/payment-processor Code Generated · Create PR

acme/api-gateway Code Generated · Create PR

acme/user-service Code Generated · Create PR

acme/billing-service Code Generated · Create PR

acme/notifications-service Code Generated · Create PR

acme/file-storage-api Code Generated · Create PR

acme/encryption-utils Code Generated · Create PR

acme/audit-log-service Code Generated · Create PR

Crypto API Upgrade · Complete

23 Pull requests created

23 repos updated

3 Teams notified

~0 Hours saved

estimated across 23 repos · 13 minutes elapsed

Built for the teams keeping your infrastructure and pipelines running

DevOps engineers, SREs, and CI/CD specialists. You set up Renovate two years ago. It handles routine bumps fine. It hands you back the actual work: the API substitutions, the breaking changes between major versions, the per-repo adaptation, the coordination across team owners.

Tidra handles that work. Not as a replacement for Renovate, but as the layer that picks up where it stops.

Your existing controls stay in place: branch protection rules, required reviewers, and CI checks all run as they normally would.

Tidra teams run anywhere from 100 to 2,000+ repos with platform teams of 3 to 15 engineers.

Beyond version bumps

Adapt code, not just versions

Node 18 to 20 isn't just a number change. url.parse to new URL. crypto.createCipher to createCipheriv. Tidra writes the actual code changes.

Learn more

Move every pipeline at once

GitHub Actions to GitLab. Old runners to new. Workflows that adapt to each repo's existing setup.

Learn more

Find and fix every affected repo

When a new CVE drops, Tidra scopes the affected repos, generates the fix per repo, and coordinates the merge.

Learn more

One config pattern, every repo

Dockerfile base images. Secret rotation. Linter rules. Per-repo conventions respected.

Learn more

From the change description to merged PRs

STEP 1

Plan the change

Describe what needs to change. Tidra drafts a structured change plan covering the affected files, edge cases, and rollout strategy.

STEP 2

Generate the code

Tidra writes the change across every targeted repo in parallel, adapting to each repo's stack: package manager, CI config, framework, and existing conventions.

STEP 3

Review the diffs

Every diff is reviewable before any PR is created. Branch protection rules, required reviewers, and CI checks all run as they normally would.

STEP 4

Ship and coordinate

Open PRs in bulk. Tidra surfaces failing CI runs, review comments, and stuck PRs in one dashboard so you can drive the rollout to completion.

Trusted by DevOps and SRE teams

"Our maintenance initiatives touch hundreds of services and 30-plus teams. That used to mean months of planning and competing with feature work. Now Tidra just does the work, and teams only verify and merge: our last initiative closed nearly 500 PRs that way."

Jay Politzer

Engineering Manager · Keller Williams Realty

Run a code migration that Renovate can't

Start with one breaking-change initiative on your own repos. Free for 2 weeks, no credit card.

Start free trial Book a demo