Build with Since.dev.

Create an organization, mint a key from the dashboard, and make the two calls that matter: watch the public sources you depend on, then read what changed. Everything else is refinement.

curl -X POST https://api.since.dev/v1/subscriptions \
  -H "Authorization: Bearer $SINCE_DEV_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "items": [
      { "subjectType": "package", "subject": "npm:react", "aspect": "versions" },
      { "subjectType": "package", "subject": "npm:react", "aspect": "deprecation" },
      { "subjectType": "project", "subject": "vercel/next.js", "aspect": "releases" }
    ]
  }'

Over MCP the same step is one call: subscribe({ subjectType: "package", subject: "npm:react", aspect: "versions" }). You can also paste a dependency manifest in the dashboard and activate the packages you care about.

You can create your first watch before connecting an agent, or skip setup and explore the terminal. A first check records the baseline. Later changes appear when detected; an empty feed means there is nothing to report yet. When only World State or Free watches follow a source, failed shared classification is saved and retried. Changes monitored only by paid repositories can be published as raw differences before private repository analysis.

curl "https://api.since.dev/v1/changes" \
  -H "Authorization: Bearer $SINCE_DEV_KEY"

# {
#   "changes": [ { "change": { ... }, "context": { ... } } ],
#   "cursor": 84219,
#   "hasMore": false,
#   "truncated": false,
#   "acknowledgeable": true,
#   "delivery": "at-least-once; acknowledge only after processing, and dedupe on idempotencyKey",
#   "filtering": "no relevance filter; returns every change available to an active watch. A paused or closed watch stops contributing changes, including changes returned earlier"
# }

Every request carries an API key as a bearer token. Keys look like sc_live_<prefix>_<secret> (a 12-character lookup prefix and a 192-bit secret, both hex) and are shown once at creation. Only a SHA-256 digest is stored, so a lost key is replaced rather than recovered.

Authorization: Bearer sc_live_9f2c4b8e1a03_7d1e...

A key belongs to one agent inside one organization, and every response is scoped to that organization. There are no sandbox or test keys; use a free account when you want to evaluate the API without starting a paid plan.

Classification

Eligible World State and Free repository watches use Since AI for shared source classification. A judged change carries one of five categories as verdict.category, beside verdict.severity.

A change monitored only by paid repositories is published as a raw difference with verdict: null and judge.judged: false. Each workspace’s connected provider assesses its private repository impact. If an eligible World State or Free watch independently follows the same source, its shared classification remains funded by Since. When a paid repository also follows the source, a hosted suppression or failure still publishes the raw difference without a verdict so its provider can assess impact; World State may also receive that unjudged change. A missing verdict is not a finding that the change is harmless or cosmetic.

All requests and responses are JSON. Times are ISO 8601 in UTC. Unknown fields in a request body are ignored rather than rejected, so a typo in an optional field name is silently the default. Check the echoed values in the response if a setting does not seem to have taken.

Watches

{
  "set": { "id": "set_9c14b027", "name": "Direct subscriptions" },
  "created": 2,
  "alreadySubscribed": 0,
  "blocked": [],
  "watching": [
    { "id": "sub_react", "subjectRef": "npm:react", "aspect": "versions" },
    { "id": "sub_linear", "subjectRef": "Watch Linear's changelog", "aspect": null }
  ],
  "removed": 0,
  "closed": 0,
  "planned": [
    { "id": "sub_linear", "statement": "Watch Linear's changelog", "created": true }
  ],
  "statementResults": [
    {
      "ok": true,
      "itemIndex": 1,
      "childIndex": 0,
      "statement": "Watch Linear's changelog",
      "id": "sub_linear",
      "created": true
    },
    {
      "ok": false,
      "itemIndex": 1,
      "childIndex": 1,
      "statement": "Watch Stripe's changelog",
      "error": {
        "code": "needs_clarification",
        "message": "Which Stripe changelog should be watched?"
      }
    }
  ]
}

Sets

A set is a named group of watches: a repository’s dependencies, a starter pack, a team’s list. Attachment to a set is what makes its watches visible to your key, whoever created them. Anything you create through POST /v1/subscriptions lands in your own set automatically. Attach to any other set whose watches this agent needs to receive.

Verify

{
  "checked": 2,
  "results": [
    {
      "subjectKey": "package:npm:left-pad",
      "aspect": "deprecation",
      "fieldPath": "deprecated",
      "verdict": "changed",
      "expectedValue": null,
      "currentValue": "use String.prototype.padStart",
      "reason": null,
      "observedAt": "2026-08-04T09:12:44Z",
      "source": "npm, Inc."
    },
    {
      "subjectKey": "package:npm:not-watched",
      "aspect": "versions",
      "fieldPath": "version",
      "verdict": "unknown",
      "expectedValue": "1.0.0",
      "currentValue": null,
      "reason": "Since.dev has never observed this subject.",
      "observedAt": null,
      "source": null
    }
  ]
}

Changes

{
  "cursor": 84219,
  "hasMore": false,
  "truncated": false,
  "acknowledgeable": true,
  "delivery": "at-least-once; acknowledge only after processing, and dedupe on idempotencyKey",
  "filtering": "no relevance filter; returns every change available to an active watch. A paused or closed watch stops contributing changes, including changes returned earlier",
  "changes": [{
    "change": {
      "seq": 84219,
      "changeId": "chg_5b21...",
      "idempotencyKey": "a3f1c9...",
      "subject": {
        "key": "package:npm:left-pad",
        "type": "package",
        "name": "left-pad"
      },
      "aspect": "deprecation",
      "kind": "state_change",
      "fieldChanges": [{
        "path": "deprecated",
        "label": "deprecated",
        "from": null,
        "to": "use String.prototype.padStart"
      }],
      "headline": "left-pad was deprecated",
      "source": {
        "publisher": "npm, Inc.",
        "url": "https://registry.npmjs.org/left-pad/latest"
      },
      "significance": 0.94,
      "detectedAt": "2026-08-04T09:12:44Z",
      "occurredAt": null,
      "subscriptionIds": ["sub_2f9a7c31"]
    },
    "context": {
      "judge": {
        "judged": true,
        "source": "model",
        "fallback": false,
        "model": null,
        "judgedAt": "2026-08-04T09:12:45Z"
      },
      "verdict": {
        "severity": 0.72,
        "category": "deprecated",
        "basis": ["The package is deprecated in favour of a language built-in."],
        "breaking": { "answer": "no", "reasoning": "The published code still installs and runs." },
        "upstreamGuide": {
          "available": true,
          "text": "use String.prototype.padStart",
          "why": "The publisher named the replacement rather than restating the field."
        }
      },
      "subjectType": "package",
      "publisher": "npm, Inc.",
      "changedFields": ["deprecated"],
      "evidenceQuote": "use String.prototype.padStart",
      "summary": "The publisher deprecated left-pad in favour of a language built-in."
    }
  }]
}

Coverage

{
  "coverage": "good",
  "explanation": "npm publishes version and deprecation metadata directly.",
  "suggestion": null,
  "sources": [{
    "publisher": "npm, Inc.",
    "rationale": "Authoritative registry for this package."
  }],
  "cadenceMinutes": 720,
  "subject": { "key": "package:npm:react", "name": "react", "qualifier": null },
  "candidates": [ ... ]
}

Subjects

{
  "subject": { "key": "package:npm:react", "name": "react", "type": "package" },
  "changes": [ ... ],
  "volatility": {
    "total": 34,
    "firstSeen": "2026-01-18T04:00:11Z",
    "lastChangeAt": "2026-07-29T17:41:02Z"
  }
}

Webhook endpoints

Usage

{
  "plan": "pro",
  "limits": {
    "subscriptionsLimit": 150,
    "verificationsPerMonth": 500,
    "membersLimit": 3
  },
  "usage": {
    "activeSubscriptions": 11,
    "verificationsThisMonth": 402
  },
  "hostedAllowance": null
}

Every delivery is a POST with a JSON envelope and four primary headers. World-State-Signature carries a unix timestamp and an HMAC-SHA256 over `${t}.${rawBody}`, computed with your endpoint’s signing secret.

POST /your/endpoint HTTP/1.1
Content-Type: application/json
World-State-Signature: t=1785312764,v1=9f2c4b8e...
World-State-Event: change.detected
World-State-Delivery: whd_51c0...
Idempotency-Key: sub_2f9a7c31:a3f1c9...

{
  "id": "whd_51c0...",
  "type": "change.detected",
  "idempotencyKey": "sub_2f9a7c31:a3f1c9...",
  "createdAt": "2026-08-04T09:12:46Z",
  "data": {
    "subscriptionId": "sub_2f9a7c31",
    "change": {
      "seq": 84219,
      "changeId": "chg_5b21...",
      "idempotencyKey": "a3f1c9...",
      "subject": { "key": "package:npm:left-pad", "type": "package", "name": "left-pad" },
      "aspect": "deprecation",
      "kind": "state_change",
      "fieldChanges": [{ "path": "deprecated", "label": "deprecated", "from": null, "to": "..." }],
      "headline": "left-pad was deprecated",
      "source": { "publisher": "npm, Inc.", "url": "..." },
      "significance": 0.94,
      "detectedAt": "2026-08-04T09:12:44Z",
      "occurredAt": null,
      "subscriptionIds": ["sub_2f9a7c31"]
    },
    "context": { "judge": { "...": "as in GET /v1/changes" }, "verdict": { "...": "the same saved verdict" }, "subjectType": "package", "publisher": "npm, Inc.", "changedFields": ["deprecated"], "evidenceQuote": "use String.prototype.padStart", "summary": "The publisher deprecated left-pad." }
  }
}

import { createHmac, timingSafeEqual } from "node:crypto"

function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(
    header.split(",").map((piece) => piece.split("=").map((s) => s.trim())),
  )
  const timestamp = Number(parts.t)
  if (!Number.isFinite(timestamp)) return false

  // Reject replays of a captured body.
  const age = Math.abs(Math.floor(Date.now() / 1000) - timestamp)
  if (age > toleranceSeconds) return false

  const expected = createHmac("sha256", secret)
    .update(timestamp + "." + rawBody, "utf8")
    .digest("hex")

  const a = Buffer.from(expected, "hex")
  const b = Buffer.from(parts.v1 ?? "", "hex")
  return a.length === b.length && timingSafeEqual(a, b)
}

Event types

One type, and that is the whole list. Coverage loss is not pushed today: check status on GET /v1/subscriptions for that.

Retries

Any non-2xx response or a timeout past 15 seconds is retried with exponential backoff (30s, 60s, 2m, 4m, doubling to a one-hour cap) for up to 8 attempts. If every attempt fails, the delivery is retained and surfaced in the dashboard. Five consecutive failures mark the endpoint degraded. Nothing is dropped silently.

Return 2xx as soon as you have durably accepted the event, and do the work afterwards. Deliveries are at-least-once, so deduplicate on idempotencyKey. The same change reaching two of your endpoints carries the same key.

Webhook deliveries and retries are never billed. The same change also remains available from /v1/changes, so a webhook is one delivery mode rather than the only way to recover it.

Open Repositories and choose Connect repository. Connect GitHub if needed, select an accessible repository, and review the monitoring and repair choices. Automatically monitor dependencies is checked for new connections. Paid connections default to Automatic draft PRs; Free uses Monitor only with manual impact checks. Existing repository choices are preserved. The application opens directly without an onboarding wizard.

A repository opens on Overview, with Dependencies and Settings alongside it. The scan records its revision, manifests, dependencies and coverage gaps. Choose directories for a narrower monorepo scan if needed. Each dependency has separate source-check times: Rescan dependencies scans manifests, not the external source. Disabled, paused or excluded monitoring remains visible as stopped.

Free includes Since-hosted impact analysis, 25 credits per month, one connected repository, and no repair PRs. Pro connects five repositories and requires an Anthropic or OpenAI API key. Studio connects fifteen repositories; Studio and Enterprise also support AWS Bedrock. In Settings → AI provider, a workspace owner or admin connects credentials, chooses a supported catalog model, tests the connection, and reviews token usage. Your provider bills repository analysis and repairs directly. World State remains on Since AI with separate monthly limits. A missing or invalid model connection pauses repository AI work; Since does not switch providers automatically.

Free repository dependencies have a separate allowance from World State watches, counting once across connected repositories in the workspace. Paid plans have no repository dependency count limit. To add a source outside a manifest, use Settings → Advanced source management. Link World State watch attaches an existing watch. Create a World State watch opens the watch creation page; after creating it, return to the repository and link it. The first source reading is a baseline, not a repair trigger.

Owners and admins manage repository setup and repair permissions. Draft PRs require GitHub Contents and Pull requests write access. This permission does not turn routine dependency releases into upgrade PRs. Work requiring package-manager execution, lockfile generation or workflow changes is deferred without publishing an incomplete fix.

Use the account menu to create or switch workspaces, including invited teams. Settings → Members contains invitations and roles. Authorized managers can copy a pending invitation link if the email does not arrive. Recipients must sign in with the invited email; an accepted link can reopen the team while membership remains. Each login includes one Free owned workspace. Every additional owned workspace requires its own paid subscription. Creating a workspace opens billing for that workspace; payment is required before monitoring or repository work starts. Checkout updates the currently selected workspace. Owners manage billing and roles; admins can invite/remove members; members cannot administer repositories or open repair PRs. Ownership transfer is unavailable. Deleting an additional workspace cancels its subscription and removes its data while preserving your login and other workspaces.

Open a repair to see the decision first, then expand Evidence and analysis for the source material and code findings. Insufficient evidence means No PR created, with no charge and a plain reason; it does not mean the code is safe or broken. Background source check appears only when a future recheck is scheduled. Access refusals are respected. Unchanged evidence, code and instructions reuse the prior decision instead of repeating paid analysis.

On Free, use Check a dependency change for a manual impact check. In Automatic draft PRs mode, Since automatically checks the impact of recorded changes, prepares supported repairs, and opens draft PRs. The optional Check another recorded change control is for manual inspection; it is not a required workflow step. The repair retains affected files, the base commit, patch versions and check results. Required GitHub CI is tied to the exact current PR head. Missing or failed checks remain visible; passing CI does not establish production safety. People decide whether to merge.

For a different fix, choose Revise this PR, give a concrete instruction, and select Send revision. Or add a new PR/review comment on a PR created by Since, with the installed GitHub app’s exact mention followed by a space and your instruction, such as @your-app-slug keep the public method name unchanged. The app verifies the commenter's live write permission and limits the change to the same repair and evidence. It updates the same PR with a new patch version and fresh checks. Ordinary comments do not trigger paid work. PRs that Since did not create, and closed or merged PRs, are not edited.

If a downgrade leaves repositories, World State watches, repository dependencies, or members above the new limits, monitoring, AI analysis, and repair work pause. Saved data stays available. The application shows the exact excess counts and links to disconnect repositories, close watches, stop dependency monitoring, or remove members. Reduce usage or change the plan to resume; there are no automatic overage charges.

Reject an irrelevant repair or disconnect a repository to stop new work. Rejected work is not silently recreated. Disconnection releases the active repository slot while retaining repair history; existing GitHub PRs remain under your control.

Let your coding agent inspect repairs

Share repository access with agents in Repository settings. This is an explicit grant: watching a dependency alone does not grant code or repair access. These bearer-authenticated reads expose only shared repositories.

World-state and repository tools are available over Streamable HTTP at https://api.since.dev/mcp. Authenticate with the same bearer key, or skip the key entirely: clients that support remote MCP sign-in (Claude, Codex, Cursor) can add https://api.since.dev/mcp as a remote server and sign in through the browser when prompted. The credential determines which workspace the connection can access.

Browser MCP sign-in uses your personal workspace. To connect an agent to an invited team workspace, create an agent key in that workspace and use it in the configuration below. Switching workspaces in the terminal does not retarget an existing agent key or browser MCP session.

{
  "mcpServers": {
    "since-dev": {
      "type": "http",
      "url": "https://api.since.dev/mcp",
      "headers": { "Authorization": "Bearer sc_live_..." }
    }
  }
}

On resume, call what_changed_since first. Call verify_facts before acting on remembered facts.

subscribe takes exactly one of two forms: typed or statement. Typed subscribe registers exactly one watch from subjectType, aspect, and exactly one of subject or canonicalKey (pass canonicalKey when answering an ambiguous_subject error or when you already hold a key from check_coverage), then returns that watch directly. The statement form may produce one or more ordinary watches, up to ten per call. One watch keeps the same direct response shape. Several watches return an ordered results array with a success or error for each watch. Successful watches remain active when another result fails.

{
  "results": [
    {
      "ok": true,
      "childIndex": 0,
      "statement": "Watch React releases",
      "watch": {
        "id": "sub_react",
        "subject": {
          "displayName": "React",
          "type": "package",
          "typeLabel": "Package",
          "qualifier": "npm",
          "jurisdiction": null,
          "identifiers": { "registry": "npm", "name": "react" }
        },
        "aspect": "versions",
        "setId": "set_9c14b027",
        "status": "active",
        "coverage": "good",
        "coverageExplanation": "Covered by the official release feed.",
        "threshold": null,
        "cadenceMinutes": 360
      }
    },
    {
      "ok": false,
      "childIndex": 1,
      "statement": "Watch Stripe's changelog",
      "error": {
        "code": "needs_clarification",
        "message": "Which Stripe changelog should be watched?"
      }
    }
  ]
}

POST https://api.since.dev/mcp
Authorization: Bearer sc_live_...

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "what_changed_since",
    "arguments": { "limit": 50 }
  }
}

Supported methods: initialize, notifications/initialized, tools/list, tools/call, and ping. Protocol version 2025-06-18. A GET on /mcp returns a discovery document.

The agent API takes typed inputs: subjectType names what kind of thing you mean, and aspect names what about it you care about. These lists define the input vocabulary, not a promise that every combination is covered. The coverage response names the available sources and cadence, or none with the reason.

Subject types

Aspects

Errors return { "error": "<code>", "message": "<human text>" }, sometimes with details or issues.

Limits