Assurance tools
Mezair Desktop has several tools for checking work. They overlap on purpose, but each answers a different question. None of them replaces tests, a specialist reviewer or a real control in production.
Code Review
Code Review can inspect a full codebase, commit, branch, or pull request in quick-glance or deeper senior-review mode. A review stores its findings and repository change summary.
For each finding you can draft a fix prompt, dismiss it, create a work item, or post it to the linked pull request. Bulk actions support fix prompts and work-item creation. The review or its findings can also be exported.
Pull request support includes listing provider pull requests, reading a pull request diff, posting comments, and generating a persisted visualisation of the change. Exported visualisations are review aids, not a substitute for reading the diff.
Security audits
Security audits inspect an indexed repository and report progress while the configured model analyses the code. Findings can be dismissed, turned into work items individually or in bulk, and exported as a report.
A useful finding names the file, the risk, why it matters, what to do and whether it's been checked. An OWASP or CWE label on its own proves very little.
Dynamic pentests
The Pentest tab starts Docker-backed scans with an explicit scan configuration. It checks Docker availability before launch, streams scan events, stores runs and findings, and supports stop, dismissal, work-item creation, bulk work-item creation, and report export.
Dynamic scanning can execute tools against running software and network targets. Confirm the target and authorization before starting. Stopping a scan ends the current run but cannot undo traffic already sent.
Dependencies, licences, and SBOMs
The Dependencies view reads package manifests for npm, pnpm, Yarn, NuGet, and Python projects. It lists package version, manager, licence metadata, and deprecation signals.
You can run the selected manager's audit command, audit installed licence metadata, and export a software bill of materials as CycloneDX JSON, SPDX JSON, or CSV. Audit output is displayed for triage, including the command and exit code.
This is a local check. Use Mezair Registry when a team needs a policy that decides which packages get in, with caching, quarantine and audited overrides.
DB Insights
DB Insights analyses local exports in the active workspace. It detects SQL Server, PostgreSQL, MySQL, and SQLite DDL, MongoDB JSON documents, DynamoDB typed JSON items, and Redis key/type exports. Add exports from one technology per analysis. Each file is limited to 5 MB and an analysis to 20 MB.
The result reports the structure present in those files:
- SQL tables, columns, procedures, views, functions, and declared relationships
- MongoDB collection fields found in exported documents
- DynamoDB attribute names found in exported items
- Redis key patterns and types present in the export
- stored procedures and referenced objects
- risks and watchpoints
- follow-up questions that can be opened in Chat
DB Insights reads files only. It does not connect to a live database. JSON record values are omitted from the analysis context; MongoDB and DynamoDB counts describe records in the added exports, and Redis counts describe observed keys. None of these counts establish the full live database size. Add schema or key/type exports with the structure you want to discuss. Remove an imported artifact when it should no longer be part of the workspace evidence.
Data and Compliance
Data and Compliance analyses an indexed repository and can generate three document types:
- a UK GDPR-oriented data protection impact assessment
- a privacy policy draft
- a terms of service draft
The generated Markdown is saved under docs/ in the repository and shown in Mezair for review. Regeneration replaces the generated draft for that document type.
These files contain [ACTION REQUIRED] markers where code cannot supply the answer. They are starting points, not legal advice. A qualified legal or data-protection reviewer must check the final text.
Choosing the right tool
| Question | Start here |
|---|---|
| Is this change correct and reviewable? | Code Review |
| Does the source expose an implementation security risk? | Security |
| How does a running target respond to security probes? | Pentest |
| What package, licence, or SBOM risk exists? | Dependencies |
| What does this database export imply? | DB Insights |
| Which privacy or legal questions does the code leave unanswered? | Data and Compliance |
Note the exact scope and date on anything you export. A clean result on the wrong branch is still the wrong result.