Bug
agentLogic errors, null dereferences, race conditions, off-by-one, unhandled edge cases.
Reviews that understand your code.
Five specialist agents review every pull request against an architecture graph of your repo — scoring security, performance, and design, then posting inline comments with severity, confidence, and a recommended fix.
25,000+ PRs reviewed·99.2% signal precision
feat: add user authentication flow#247 · 6 files
api/users.tsline 42
42−const msg = searchParams.get("error");
Mesraireviewed · just now
High · SecurityOWASP · CWE-79confidence92%
XSS via URL parameters. searchParams reaches JSX unsanitized — an attacker can inject script.
Suggested change
−const msg = searchParams.get("error");
+const msg = sanitize(searchParams.get("error"));
3.2×
more bugs caught before merge
58%
faster time-to-merge
<4 min
median review time
99.2%
signal precision
I.Five specialist agents
run in parallelEvery PR is reviewed by five agents at once — each with its own prompt, model, and severity calibration. Their findings merge into one clean, deduplicated comment thread.
Security
agentInjection, XSS, hardcoded secrets, auth gaps, IAM mis-scopes, vulnerable deps — OWASP & CWE tagged.
Performance
agentN+1 queries, missing indexes, render thrash, oversized bundles, hot-path allocations.
Architecture
agentLayer violations, hidden coupling, cross-file regressions, dead code, naming drift.
Mesrai Rules
agentYour team's standards in plain English or YAML — enforced on every PR, per repo or path.
One clean thread
Findings are deduped and ranked by severity, then posted as a single review — never five bots arguing in your PR.
II.Review pipeline
4 stages01
Repository graph
Mesrai parses your repo into an AST graph — imports, exports, type relationships, and call sites across files. Reviews see the whole system, not just the diff.
02
Multi-agent fan-out
Specialist agents fire in parallel: security, performance, architecture, naming, style. Each scores the diff independently — findings merge into one PR comment thread.
03
Inline PR feedback
Mesrai posts comments on the exact lines, with severity, rationale, and a recommended fix. Optional PR summary at the top of every PR.
04
Auto-approve or block
Set a severity threshold. PRs below it auto-approve. PRs above it request changes. Merge gates available on enterprise tier.
III.Rules + control
you own the policyenglish · yaml · overrides
Mesrai Rules — your standards, enforced
Write rules in plain English or YAML. Apply per-org, per-repo, or per-directory. Auto-generate starter rules from your past merged PRs.
categories · prompts
Custom prompts + categories
Tell Mesrai what you care about. Toggle review categories (security, perf, etc) or write a custom prompt for your domain.
low → critical
Severity filter
Choose the minimum severity Mesrai reports — low / medium / high / critical. Cut noise to exactly the signal your team needs.
audit · prune
Memories
Mesrai remembers decisions across reviews. Doesn't re-suggest the same fix twice. Memory you can audit and prune.
IV.Platform
byo everythingBring your own LLM key
Connect OpenAI, Anthropic, Vertex, Bedrock, or any compatible provider. You pay the provider directly. Mesrai never trains on your code.
Per-rule model selection
Tune model choice per rule type. Run cheap models on style, premium models on security — total cost control.
Notifications you choose
Per-event routing: email, in-app, Slack, Discord, webhook. Critical events render a sticky banner in the app.
Centralized config
Drop a YAML file in your repo and Mesrai treats it as the source of truth. Override the web settings or vice versa.
// beyond bugs
Business Logic Validation.
Mesrai links to your issue tracker and compares each PR against the ticket's requirements — catching code that compiles and passes tests but doesn't do what the spec actually asked. Available on Pro AI-Included and Enterprise.
JiraLinearGitHub Issues
MES-482 · requirement
“Refunds must be denied when the order is older than 30 days.”
✕PR checks createdAt but never enforces the 30-day window — requirement not met.
V.Where it runs
4 providers- GitHub
- GitLab
- Bitbucket
- Azure Repos
?Frequently asked
6 questionsHow does multi-agent code review differ from a single AI model?+
A single-model reviewer asks one prompt and gets one answer — strong on style and obvious bugs, weak on specialised concerns. Mesrai runs five specialised agents in parallel on every PR (Bug, Security, Performance, Generalist, and your team's Mesrai Rules) — each with its own prompt, model temperature, and severity calibration. Findings are merged + deduped before posting, so the PR gets one clean comment thread covering depth that a single model would miss.
What is the mesrai-graph AST engine?+
mesrai-graph parses every changed file into an abstract syntax tree, then builds a semantic graph across imports, type references, and call chains — so the review understands which symbols are exported, which call sites depend on the changed code, and where the architectural boundaries live. This is what lets Mesrai catch cross-file regressions that a line-by-line reviewer would miss.
Can I customise which agents run on which PRs?+
Yes. Each repository can pick a cadence preset (Steady, Sentinel, Sprint, Mentor) that enables a different agent mix and severity threshold. Settings → Code Review → Cadence per repo. You can also disable a specific agent for a specific path glob — e.g. skip the Performance agent on /docs/* changes.
How does Mesrai handle false positives over time?+
Mesrai watches the reactions teammates leave on AI comments (👍 / 👎 / resolve / dismiss) and re-weights similar future findings — both per-finding-type and per-repository. Override rate is exposed in Pulse so the team can see the trend. Teams typically see a 50-70% drop in false positives within the first 6 weeks of active use.
Does AI review replace human review?+
No. AI handles the first pass on every PR — style, obvious bugs, security patterns, missing tests, dead code, routine refactors. Humans focus on the ~20% of PRs that need architectural judgement, business-logic understanding, or mentorship. The merged workflow runs 3-5× faster than humans-only while keeping a human approval gate before merge.
What is Business Logic Validation?+
BLV links Mesrai to your issue tracker (Jira, Linear, GitHub Issues) and compares the PR diff against the requirements doc on the linked ticket. It catches cases where the code compiles + passes tests but doesn't actually implement what the spec asked for. Available on Pro and Enterprise plans.
// ship
See it on your next PR.
Install in two minutes. Mesrai reviews every commit. Free for individuals — fair pricing when teams need analytics.