Mesrai

Mesrai is a multi-agent AI code review platform for product engineering teams. It reviews pull requests on GitHub, GitLab, Bitbucket, and Azure Repos with specialised agents for bugs, security, performance, architecture, and team rules, and posts inline comments ranked by severity. The vendor says reviews usually land in 2–3 minutes.

What It Is

Mesrai connects to a repository via OAuth or a personal access token and listens for pull request webhooks. It parses changed code into an AST graph of the whole repository (the mesrai-graph engine), runs specialist agents in parallel, and posts findings on the diff with severity, rationale, and a suggested fix. The same engine is available as a CLI and through IDE rule sync.

Whole-codebase context

Instead of reading only the diff, Mesrai indexes packages across monorepos and multiple repos to trace the blast radius of a change, such as cross-file impact, layer violations, and hidden coupling. Security checks cover OWASP and CWE categories, including SQL injection, XSS, hardcoded secrets, and vulnerable dependencies. Performance checks flag N+1 queries and missed indexes. Architecture-aware review is described as deepest on JavaScript/TypeScript, Python, Go, Java, and Rust.

Rules, CLI, and IDE sync

Teams can write review rules in plain English or YAML, with per-org, per-repo, and per-directory overrides. Rule files from Cursor, Copilot, Claude, Windsurf, and other assistants can be imported so the IDE, cloud reviewer, and CLI enforce one policy. The CLI runs the same review locally, as a pre-push hook, or as a CI step, and posts findings back to the pull request. Custom prompts, a severity filter, and auditable memories are also documented.

Metrics, keys, and data handling

Pulse is an analytics surface that tracks DORA metrics such as deployment frequency and lead time alongside PR cycle time and AI-finding adoption. Mesrai supports bring-your-own LLM keys (OpenAI, Anthropic, Vertex, Bedrock, or compatible endpoints). The vendor states it never trains models on customer code, that zero retention is still rolling out, and that enterprise options include self-hosting, SAML SSO, role-based access, and audit logs.