Trigger
Event, schedule, webhook
A CVE lands, a schedule fires, or a webhook calls. The workflow starts itself; nobody files a ticket.
Automations
The work that sits in the backlog for years gets scheduled instead.
Turn any recurring engineering task into a repeatable, agent-run workflow.
Cosmos workflows combine prompts with deterministic steps, trigger from events, schedules, or webhooks, and run across one repo or thousands. Every run ends in a reviewed PR.
cosmos / automations / run #482
cve-remediation.workflowON: CVE detected · severity ≥ high
- 01resolve affected reposdeterministic
- 02patch and pin dependencyprompt
- 03build and run testsdeterministic
- 04open PRreview fleet
Run #482CVE-2026-21338 · fan-out · 27 repos · isolated envs
- payments-apiPR #4812 · review passed
- checkout-webPR #2190 · review passed
- identity-servicereview fleet · 2/3
- ingest-pipelinetests · 41s
- + 23 more reposqueued
Audit trail · what ran, what changed, when, why09:12 UTC
Meet Cosmos
A fleet of agents behind every trigger.
Define the workflow once. Cosmos runs it on every matching event, fans agents out across parallel isolated environments, and routes every PR through the review fleet before a human sees it. Shared memory makes each run smarter than the last.
What our customers are seeing
90%
Shorter migration timelines than manual
900+
Repos modernized in a single program
73%
Lower cost on legacy migrations
5-6×
Migration velocity without added headcount
A fleet of agents takes the work from trigger to merged.
A workflow is prompts plus deterministic steps. Cosmos compiles it into a run plan, fans agents out across isolated environments, and hands every PR to the review fleet. Humans approve; the audit trail records what ran, what changed, when, and why.
Automation lifecycleone trigger, end to end
Trigger
Event, schedule, webhook
A CVE lands, a schedule fires, or a webhook calls. The workflow starts itself; nobody files a ticket.
Plan
Run Plan
Cosmos expands the definition into steps: prompts where judgment is needed, deterministic scripts where it is not.
Fan-out · parallel
Parallel Runs
Agents execute across one repo or thousands, each in an isolated environment with scoped credentials.
Review
Review Fleet
Every PR goes through the Cosmos review fleet for risk, correctness, and policy before a human sees it.
Human
Scans the reviewed PRs and approves the merge.
PRs merged · audit logged
Automation Memory
Captures what worked · Shared across every run
Fig 1 · Automation fleet
Beyond scripts
Define once. Run a thousand times.
Scripts handle the happy path. The hard part is the variation: a thousand repos, each slightly different. Cosmos workflows combine deterministic steps with prompts, so precision and judgment run in the same loop.
One-off scripts
Built for the happy path
- Breaks on the first repo that differs
- Runs once, then rots unmaintained
- No review, no audit trail, no memory
Cosmos automations
Built for variation at scale
- Prompts absorb variation, deterministic steps keep precision
- Triggers from events, schedules, and webhooks
- Every PR reviewed by the fleet before a human sees it
- Every run logged and remembered for the next one
Where teams start
Built for the work teams defer.
If it happens more than once, it can be a workflow. Three places most organizations start.
CVE remediation01
Scanners find it. Agents fix it.
A high-severity advisory lands and the workflow starts itself. Agents patch every affected repo, run the tests, and open reviewed PRs while the ticket would still be sitting in triage.
ON: CVE detected · severity ≥ high
Migrations at scale02
Years of backlog, done in days.
Framework upgrades and API migrations that sat in planning for years run across hundreds of repos in parallel isolated environments, each ending in a PR your team can actually read.
ON: dispatch · 412 repos
Recurring maintenance03
Upkeep on a cadence.
Dependency upgrades, flaky test repair, and code standardization run on the schedule you set. The fleet does the upkeep; engineers see only the reviewed result.
ON: schedule · weekly
GitHubGitLabGitHub ActionsSnykJenkinsGDPR · CCPA · HIPAA
Highly customizable to your pipeline.
Talk to Cosmos Advisor to tailor every workflow: triggers, deterministic steps, review policy, and the credentials each run can touch. Wire it into the scanners, CI, and VCS you already run.
Semgrep, Buildkite, and CircleCI are also supported, and every run is logged to your SIEM.