// USE CASE · ENGINEERING

Automate code review with AI agentsthat pause before every merge.

Your senior engineers spend half their week reviewing other people's code, prepping audits, and writing post-mortems instead of shipping. Melaya lets you build a ten-persona engineering crew that reviews PRs, runs the OWASP checklist, triages hotspots, drafts RFCs, and stages every comment, ticket, and config change for one-click approval. The crew does the prep, your staff engineers keep the judgment call, the replay log keeps the receipts.

01
// What breaks today

Manual workflows cost more than the agent does.

Three pains every sales and BD team hits weekly. Each one is what your reps actually complain about, not what a feature page would call them.

  1. 01

    Code review backlogs grow when the senior engineers who should read a diff are stuck in meetings instead.

  2. 02

    Security audits, performance profiling, and accessibility checks get skipped under deadline pressure, one at a time, until none of them run.

  3. 03

    Pull requests wait on 3-4 reviewers with different specialties who each look at it a day apart.

02
// Pipelines you can build

Agent workflows: compose, approve, replay.

Every pipeline below is a shape you wire on the canvas using the crew and tools further down. Not a feature we ship for you, a pattern you configure.

P01

Ten-specialist review, run in one pass

A pipeline built in Melaya Agents runs the tech_team crew's 10 personas in sequence on one diff. RustPythonEngineer and BackendEngineer check code quality, SecurityAuditor audits the attack surface, PerformanceExpert applies the USE method, FrontendEngineer and UIUXDesigner grade the UI, and TechLead synthesizes a single PRODUCTION_READY / NEEDS_FIXES verdict.

P02

Cross-host repo intel before you review

Pull merge-request context, issues, and file history from GitHub, GitLab, Gitea, or Codeberg with one tool call each, without opening four separate tabs. BackendEngineer or DevOpsEngineer reads the diff and TechLead cites the real file and line in the verdict.

P03

Trigger a review from Claude Code or Cursor, not the Melaya UI

Connect Claude Code, Cursor, ChatGPT, or Le Chat to api.melaya.org/mcp over OAuth 2.1 and grant the melaya:pipelines scope (7,307 tools) to fire a tech_team review straight from the assistant you already pay for. Pair it with melaya:browser (7,307 tools) to open the staging build in a real browser and check the change live.

P04

Dependency risk, checked before merge

SecurityAuditor or PerformanceExpert checks npm, PyPI, and crates.io package info and download trends for a new dependency before it lands, flagging an abandoned or newly-spiking package by name.

P05

File the verdict where the team already works

TechLead's synthesis becomes a Jira or Linear issue, or a Notion page, with severity, blast radius, and the top-3 fixes, without a human retyping the findings.

03
// The multi-agent crew

Engineering & Tech crew

Real personas from the tech_team crew. Each ships with a tuned system prompt and a default tool allowlist. Swap models per persona on the canvas.

Tech Lead

TechLead

Synthesizes findings from every specialist into a sprint plan with named owners, day-level deadlines, and measurable success criteria.

{ }

Rust Python Engineer

RustPythonEngineer

Reviews Rust and Python code for unwrap risk, hot-loop allocations, FFI overhead, and tokio blocking calls that would crash a 24/7 service.

Backend Engineer

BackendEngineer

Audits REST and WebSocket integrations, retry logic, decimal precision, and reconciliation coverage so state never drifts silently.

Security Auditor

SecurityAuditor

Runs the ten-item OWASP checklist against the diff, flags CWE numbers, and writes the step-by-step attack path before recommending a fix.

Performance Expert

PerformanceExpert

Applies the USE method to every component, estimates p50, p95, p99, and ranks the three highest-ROI hotspots with expected gain and measurement method.

HFT Quant Dev

HFTQuantDev

Profiles the signal-to-order path against a documented latency budget and proposes ranked optimizations with effort and verification steps.

DevOps Engineer

DevOpsEngineer

Scores the SRE posture across CI/CD, secrets, observability, DR, and alerts, naming the runbook gaps that would extend the next outage.

Frontend Engineer

FrontendEngineer

Reviews React components for stale closures, missing memoization, WebSocket leaks, and bundle bloat against fixed performance budgets.

UI UX Designer

UIUXDesigner

Audits trader-facing screens for data-ink ratio, fast-scan effectiveness, keyboard coverage, and WCAG AA contrast.

Smart Contract Expert

SmartContractExpert

Audits onchain interactions across EVM, Cosmos, Solana, NEAR, and Sui, scoring reentrancy, oracle, MEV, and bridge risk in audit-firm format.

04
// Scoped tools

Tool allowlists: only the actions you grant.

Every tool below is a real shared tool from the Melaya bundle. Allowlist per agent; HITL-gate the writes; revoke any of them in one click.

shared/tools/core/

Read-only access to the repo so RustPythonEngineer and FrontendEngineer can pull the diff, blame a line, and grep for patterns. No writes, so nothing ships without a separate HITL-gated step.

git_statusgit_diffgit_loggit_showgit_blamegrep_searchglob_searchfile_read
shared/tools/gitlab_public_tools/

Pull merge requests, project metadata, and file contents from GitLab so the review crew works against the real diff. Read-only by design; comments and approvals route through a separate HITL gate.

gitlab_list_merge_requestsgitlab_project_infogitlab_repo_filegitlab_list_issuesgitlab_repo_tree
shared/tools/codeberg_tools/

Same review surface for teams on Codeberg or self-hosted Gitea. Reads only. The agent drafts the review, an engineer posts it.

codeberg_list_pullscodeberg_repo_infocodeberg_repo_filecodeberg_list_issues
shared/tools/package_intel_tools/

Resolve dependency metadata, last-publish date, and download counts so SecurityAuditor can flag stale or abandoned packages in the diff. Read-only fetches against public registries.

npm_package_infopypi_package_infocrates_package_infonpm_downloadspypi_downloads
shared/tools/devops/

Read cluster state, pull pod logs, and stage manifest changes for DevOpsEngineer's runbooks. k8s_apply and aws_cli writes are HITL gated by default so no rollout happens without an SRE approving.

aws_clik8s_getk8s_logsk8s_applydocker_psdocker_logs
shared/tools/project_mgmt/

File the action items TechLead produced as Jira or Linear tickets with owners and deadlines, and drop the post-mortem into Notion. Every create call is HITL gated so titles and assignees are reviewed before the ticket exists.

jira_create_issuelinear_create_issuenotion_create_pagelinear_create_commentnotion_search
shared/tools/knowledge/

Build the per-workflow knowledge store from ADRs, past post-mortems, coding standards, and security playbooks. Feeds all three knowledge layers for every persona on the crew.

build_knowledge_from_textbuild_knowledge_from_file
shared/tools/messaging/

Push the synthesized review summary or incident timeline to the on-call channel. Sends are HITL gated so the wording is approved before the room sees it.

discord_send_messagetelegram_send_message
05
// Three knowledge layers

The crew reads what you give it.

Every pipeline ships with three layers of knowledge access. Mix and match per agent on the canvas. No shared vector space with another tenant, no surprise reads, no opaque retrieval.

L1

Static context

includeContext

Per-pipeline documents appended to specific agents' input on every run. The ICP brief, playbook, pricing sheet, or won-deal email corpus. Whatever needs to be there before the agent thinks. You pick which personas get which docs.

L2

RAG retrieval tool

rag_retrieve

A scoped tool granted per-agent. When the agent decides it needs more depth, it queries the workflow's vector store on demand. Same knowledge base as Static context, accessed only when the model asks for it.

L3

Cross-run memory

pipeline_memory

Pipeline-level state that carries from one run to the next. Yesterday's research is in scope for today's follow-up. The crew remembers what it already prospected, what got approved, what was sent. The audit log is the second-order knowledge base.

07
// FAQ

AI agent questions we get every week.

Can Melaya review a pull request that spans GitHub, GitLab, and a self-hosted Gitea instance?

Yes. The tech_team crew's BackendEngineer and DevOpsEngineer personas read repo trees, commits, and diffs through separate tool sets for GitHub, GitLab, Gitea, and Codeberg, so a review pipeline is not locked to one host.

Does the review crew run different specialists, or one generic model on repeat?

Ten personas in sequence: RustPythonEngineer, SecurityAuditor, HFTQuantDev, FrontendEngineer, DevOpsEngineer, PerformanceExpert, UIUXDesigner, BackendEngineer, SmartContractExpert, TechLead, each with its own checklist and output format, closed out by TechLead's synthesis.

Can I trigger a code review from Cursor instead of opening Melaya?

Yes. Melaya runs a remote MCP server at api.melaya.org/mcp with OAuth 2.1. Point Claude Code, Cursor, ChatGPT, or Le Chat at it and grant the melaya:pipelines scope to fire a run.

Does it flag risky or abandoned dependencies before merge?

Yes, through real npm, PyPI, and crates.io package-intel tools that surface metadata and download trends so SecurityAuditor or PerformanceExpert can flag a dependency by name.

Where do the findings end up?

Wherever your team already tracks work: the crew files results to Jira, Linear, or Notion directly, with no manual transcription.

Is this only useful for smart-contract or crypto codebases?

No. SmartContractExpert is one of ten personas and only matters when relevant; the other nine cover general Rust/Python, frontend, backend, DevOps, and performance review for any codebase.

Build engineering & tech teams pipelines on Melaya.

Sandbox tier is free with no card. Join the waitlist and we will email you the moment a slot opens.

← Back to every use case
Join the community
// Cookies
Melaya uses a small set of first-party cookies that are strictly necessary to authenticate you, maintain your session, and protect the platform from abuse. We do not use advertising cookies, cross-site trackers, or third-party analytics by default. The full cookie list is in our Privacy Policy.