Let your agents run.Decide what they may do,on every machine.
One policy checks every command and edit your agents make. Close calls go to a person, and every decision is on record.
- Decided on your machine in under a millisecond
- Rules, not a model: same action, same verdict
- Nothing leaves your machine to reach a verdict
- See the benchmarks
- 14:00:07$git checkout -b feat/invoices2.96mspassed
- 14:00:19$rg "roundTotal" src2.58mspassed
- 14:01:07editsrc/billing/rounding.ts3.03mspassed
- 14:01:26$npm test -- rounding2.87mspassed
- 14:01:40$npm test -- invoice3.12mspassed
Nothing to see here. That is the point.
Permission to use a tool isn't permission to perform every action through it.
An agent needs git, a shell, cloud tools and Terraform to do its job, and through them it can reach production and credentials too. Mergen is how a team decides what its agents may do, enforces it on every machine, and keeps the record.
- 1PolicyTeam
Write the rules once.
Safe defaults ship on; on Team, one policy reaches every developer’s machine and a rule changed on a laptop is put back.
- 2Enforcement
Checked where the agent works.
Shell commands, and edits for what they leave behind, checked on the developer’s machine; in Cursor and VS Code a bad edit is reverted just after it lands.
- 3ApprovalsTeam and Business
Close calls go to a person.
A risky action waits for an answer in the editor, the terminal, or Slack; on Business, the riskiest go only to the people a rule names.
- 4RecordTeam and Business
Every decision on record.
Every pass, hold, and block is logged with the rule that matched and who answered; on Team, every machine’s decisions in one console.
One command, start to finish.
An agent tries to tear down the infrastructure. Follow it through: what the agent is told, where you answer, when it is refused outright, and what is left behind.
What the agent gets back instead of an exit code
The agent runs a teardown. Claude Code asks Mergen first, and a teardown can be legitimate work, so it waits for a person instead of running or being refused. Nothing has run yet. Approve while the agent waits and it runs; approve later and the agent's next try of the same command goes through.
$ terraform destroy
◆ HELD
terraform destroy
Mergen is holding this action for approval.
This is not a permanent block - a human can approve it below.
Destroy every resource in the Terraform state
Risk: not assessed (treated as high)
Why
Local Gate: infrastructure teardown requested without an unattended
confirmation flag. Waiting for operator approval: verify the target
and intent before proceeding.
Decide (human only)
mergen-server approve --last --yes (run it)
mergen-server deny --last --yes (reject as unsafe)
Review, pick, or cancel
mergen approvals (interactive picker)
mergen blocked (review / cancel)
mergen-server cancel --last --yes (agent: only if you will never run it - the user changed the plan or told you to drop it. Waiting long is not a reason; the human is told)
For the agent
Agent: do not work around this, and do not end your turn. Tell the user it
needs their approval, then wait for the decision by running:
mergen-server wait 7f3a91c2-4d0e-4b8a-9c1f-2e6d5a8b3f10
Re-run it while it says STILL WAITING. On APPROVED, re-run the same command from the same directory.
Reading and inspecting also run while it waits; other commands queue behind it.
Do not reach the same result a way Mergen cannot review (a script file, a patch
fed to git apply, sh -c, another interpreter). Redoing it with Edit/Write does
not answer this hold either: an edit to a file this command names waits for
the same approval. For later edits, Edit/Write is the reviewed path - each
diff is checked before it lands.
If you cannot keep waiting, stop and tell the user what is waiting for them, with the hold pending. Do not cancel it to move on, and do not finish the task or state what it would have shown without it.
Token: 7f3a91c2-4d0e-4b8a-9c1f-2e6d5a8b3f10
Dashboard: http://127.0.0.1:3000/dashboard#/approvalsReal output, reproduced from the shipped formatter, the shipped default policy, the editor panel and the CLI as they render today. Run it against your own machine →
Works where your agents already run.
mergen-server setup hooks into every agent it finds. One set of rules for all of them.
- Commands and editsStopped before they run
- Commands and editsStopped before they run
- Commands and patchesStopped before they run
- Shell commandsStopped before they run
- File editsUndone right after they land
- File editsUndone right after they land
- Commands you wrapChecked before they run
mergen-server exec -- <cmd>- Slack (Team and up)
- PagerDuty (pages on-call, Business plan)
- CLI, dashboard, VS Code (every plan)
Protection that grows with your team
1 developer
Protect your own machine from dangerous AI-agent actions. Free, forever, no payment required. Sign in with an account.
- 1 protected runtime
- Blocks destructive actions before execution
- Edit-time change gate
- Claude Code, Cursor, Windsurf, VS Code, and Codex (beta)
- +3 more
Sign in required · No payment required
5 developers included · add up to 5 more at $40/month each
Bring Mergen to your team. Share policies, approvals, activity, and operational context across developers and machines.
- One protected runtime per developer
- Shared organization policies
- Team approvals & escalation
- Fleet visibility
- +5 more
30 days free, then $199/month, renewing monthly until you cancel · Card required · Cancel online anytime
10 developers included · add up to 10 more at $50/month each
Govern AI-agent execution across your engineering organization. Control who can approve actions, where policies apply, and how execution decisions are reviewed and audited.
- Admin-only approvals for the riskiest actions
- Route approvals to a team or Slack channel by path, repo or command, set on each machine
- Policy drift detection across the fleet
- SIEM audit export and event forwarding
30 days free, then $499/month, renewing monthly until you cancel · Card required · Cancel online anytime
Common questions
What people ask before they install.
MERGEN_FREE_CAP_MODE=protect to keep it running; paid plans are never metered on calls. Full answer →Let your agents move fast.
Put a gate in front of the dangerous stuff.
Two minutes to install. Works offline. Bring your team in when you want shared rules and approvals.
Get started free