AI agent for Node.js APIs

What Merlean reads in a Node.js codebase

Merlean connects to your repository through GitHub or GitLab and analyses the application rather than recording a user clicking through it. In a Node.js project, that analysis draws on:

• Route registration in Express, Fastify, Koa or Hapi, including routers mounted under a prefix.
• NestJS controllers and their decorators, which declare methods, paths, DTOs and guards in one place.
• Validation schemas from Zod, Joi, class-validator or Fastify's JSON Schema, which give exact payload shapes.
• Middleware and guards, which describe authentication and per-route authorisation.
• OpenAPI or Swagger definitions when they exist, as a cross-check on what analysis derived.
• ORM models from Prisma, TypeORM or Sequelize, for resolving references between records.

The result is a machine-readable model of what the application can do, which fields each action needs, which order multi-step work has to run in, and who is allowed to run it. That model is what user requests are resolved against.

Authentication and permissions

Merlean sends requests with the caller's own credentials, so your authentication middleware and route guards run unchanged. It has no privileged channel into the API.

Worth knowing about Node.js specifically

• NestJS analyses particularly cleanly, because decorators put the route, the payload type and the guard together.
• An accurate OpenAPI document is a useful cross-check but not a substitute for source analysis, since generated specs frequently omit conditional validation and describe endpoints that no longer exist.
• Routes assembled dynamically at boot are harder to read statically. They are usually still found, but they are the first thing to review in the generated model.

Getting started

Connect the repository, run the first analysis, and review what Merlean understood. Reviewing is the step worth spending time on: the analysis is derived from your code, so where it is wrong it is usually pointing at something genuinely ambiguous in the application.

Then add the widget with a single script tag, or expose the application over the Model Context Protocol so an AI agent your users already use can reach it.

Frequently asked questions

Do I need an OpenAPI spec?

No. Merlean derives the model from source. If you have a spec, it is used as a cross-check, not as the primary input.

Which frameworks are supported?

Express, Fastify, NestJS, Koa and Hapi are the ones seen most often. Because analysis works from source rather than from a framework adapter, an unusual framework is not a blocker.

What about GraphQL?

A GraphQL schema describes operations well. The gap is usually workflow order and preconditions, which Merlean derives from the resolvers and the code around them.

Related