Early access · For engineering teams
Patch every CVE.
Engineers sign off.
Spoletta turns the chores your engineers repeat into running flows. When a CVE lands, an AI agent upgrades the library and fixes the code its breaking changes hit, an engineer reviews the change, and CI ships it — with every review on the record for your audits.
- Breaking changes fixed by agents
- Every upgrade reviewed by an engineer
- An audit trail for every CVE
Two building blocks: objects and processes
Spoletta uses Object-Process Methodology, a standard way to describe how a system works. You draw your business with just two kinds of things, and the board you draw is the automation that runs.
An object is a thing your business handles
CVEs, dependencies, pull requests, releases. Its states say where it is in its life — a CVE ticket arrives open, then is patched. While a flow runs, every object holds its real value, so you can open it and read it.
A process is something that happens to objects
It takes objects in and puts objects out: it creates them, uses them up, or moves them from one state to the next. Processes are the steps of your workflow, and the links between them and the objects are the order they run in.
Here is a whole flow built from them. Keep scrolling and it runs as you go — or press play.
Any process can be done by an agent, a person, or code
You choose who does each step. The board doesn't change — the same objects go in and come out — so you can start a step with a person and hand it to an agent once you trust it.
An AI agent
For work that needs reading and judgement: extracting, researching, drafting, checking. You give it a prompt and a model; the board gives it its inputs.
Upgrade and adapt consumes CVE ticket and yields Upgrade.
A person
For decisions someone has to own. The flow waits, the right person gets a task, and their answer — and who gave it — goes on the record.
Engineering handles Review the upgrade.
Program code
For steps that must do exactly the same thing every time: calling an API, computing a value, triggering your CI. Fast, cheap, and predictable.
Merge and deploy consumes Approved upgrade.
Under each card is how Spoletta reads the board back to you: plain sentences, written as you draw, so your team and your auditors read the same thing the engine runs.
Zoom into any step
A step that gets complicated doesn't clutter the board — it becomes a flow of its own. Zoom into “Upgrade and adapt” and you find its own board, with the steps that do the upgrading — between the same CVE ticket and upgrade the outer board shows. Zoom out and it's one calm card again.
The CTO reads the top board, engineers work three levels down, and both are looking at the same live flow.
People stay in the loop
Some steps should never run unattended. Mark a process as human and the flow stops there, shows the person exactly what the agents produced, and waits. Approve, and the run continues; reject, and it stops with a record of who decided what. Automation does the legwork — judgment stays with your team.
Try it: this is the upgrade the reviewing engineer would see.
- CVE
- CVE-2026-41207 · high
- Upgrade
- fetchkit 4.9.1 → 5.2.0 · 4 call sites
- Tests
- 212 passing · 1 flag
Agents are just another step
An agent process gets a prompt, a model of your choice, and the objects that flow into it. It reads them, does the work — extraction, research, drafting, checking — and whatever it produces becomes the value of the next object on the board.
No glue code, no queue infrastructure: the diagram already says what the agent consumes and what it yields.
Scripts, scheduled triggers, and sub-flows work the same way — pick the right worker for each step, and let the board coordinate them.
Get updates as Spoletta ships
We're building in the open and release often. Leave your details and we'll send a short note when there's something worth trying — nothing else.