AI agent for Laravel applications

What Merlean reads in a Laravel codebase

Merlean connects to your repository through GitHub or GitLab and analyses the application rather than recording a user clicking through it. In a Laravel project, that analysis draws on:

• Route definitions in routes/web.php and routes/api.php, including route model binding and named routes.
• Controller actions and the request classes they type-hint, which give field names and validation rules directly.
• Form request rules, so Merlean knows what a valid payload looks like before it sends one.
• Policies and gates, plus middleware on route groups, which describe who may perform an action.
• Eloquent models and relationships, for resolving references like "the latest quote for this customer".
• Inertia or Blade views, when the workflow only exists as a sequence of screens.

The result is a machine-readable model of what the application can do, which fields each action needs, which order multi-step work has to run in, and who is allowed to run it. That model is what user requests are resolved against.

Authentication and permissions

Merlean acts through your existing session or Sanctum token. Middleware runs as normal, policies are enforced as normal, and a request Merlean makes is indistinguishable from one your own frontend would make. There is no service account and no bypass path.

Worth knowing about Laravel specifically

• Validation defined in a form request is far more useful to the analyser than validation inlined in a controller, because the rules are named and reusable. Applications that use form requests consistently get a more accurate model.
• Route model binding is understood, so Merlean can resolve "this customer" to a bound model rather than guessing an identifier.
• Queued work is visible: when an action dispatches a job, Merlean reports the work as accepted rather than as complete, which avoids telling a user something finished when it is still in the queue.

Getting started

Connect the repository, run the first analysis, and review what Merlean understood. Reviewing is the step worth spending time on: the analysis is derived from your code, so where it is wrong it is usually pointing at something genuinely ambiguous in the application.

Then add the widget with a single script tag, or expose the application over the Model Context Protocol so an AI agent your users already use can reach it.

Frequently asked questions

Does Merlean need a package installed in the Laravel app?

No. It reads the repository and calls your existing HTTP endpoints. There is no composer package, no service provider and no change to your application code.

How are policies and gates respected?

They run exactly as they do for a browser request, because Merlean sends a browser-equivalent request with the user's own credentials. Authorisation is enforced by your application, not re-implemented by Merlean.

Does it work with Inertia?

Yes. Inertia endpoints are ordinary Laravel routes, and the page components help the analyser understand which fields belong to which step of a workflow.

Related