Your stack

AI agent for Ruby on Rails applications

Convention over configuration works in an analyser's favour. In a conventional Rails application, almost everything Merlean needs is exactly where the framework says it should be.

What Merlean reads in a Ruby on Rails codebase

Merlean connects to your repository through GitHub or GitLab and analyses the application rather than recording a user clicking through it. In a Ruby on Rails project, that analysis draws on:

config/routes.rb, including resourceful routes, nested resources and member and collection actions.
Controller actions and their strong parameter declarations, which give the permitted field list precisely.
Model validations and callbacks, which describe what a valid record is and what happens around a save.
Authorisation policies from Pundit or ability definitions from CanCanCan.
Views and form builders, for multi-step flows that only exist as a sequence of screens.
Active Job definitions, so background work is reported as queued rather than as done.

The result is a machine-readable model of what the application can do, which fields each action needs, which order multi-step work has to run in, and who is allowed to run it. That model is what user requests are resolved against.

Authentication and permissions

Merlean acts with the user's existing session or token. Before-actions, policy checks and scoping all run as they normally do, and CSRF protection is satisfied the same way your own forms satisfy it.

Worth knowing about Ruby on Rails specifically

Strong parameters are the single most useful signal in a Rails codebase, because they state exactly which fields a controller will accept.
Business logic in callbacks is picked up, but logic in service objects invoked from controllers is clearer to analyse and produces better workflow models.
Applications on non-resourceful custom routes analyse less cleanly than conventional ones. It still works; the model just requires more review.

Getting started

Connect the repository, run the first analysis, and review what Merlean understood. Reviewing is the step worth spending time on: the analysis is derived from your code, so where it is wrong it is usually pointing at something genuinely ambiguous in the application.

Then add the widget with a single script tag, or expose the application over the Model Context Protocol so an AI agent your users already use can reach it.

Frequently asked questions

Is there a gem to install?

No. Merlean reads the repository and calls your existing controllers over HTTP. Nothing is added to the Gemfile.

How is CSRF protection handled?

The same way your own forms handle it. Merlean issues requests that carry the token from the authenticated session rather than disabling the protection.

Does it understand Pundit and CanCanCan?

Yes, both are read to determine who may perform an action. Enforcement still happens in your application at request time.

See it against your own application

Merlean reads your repository and shows you what it understood before anything is exposed to a user. The fastest way to judge the fit is to point it at a real codebase.

Get in touch Read the docs