Secure Windsurf agents with a deterministic execution gate
Windsurf’s Cascade executes long autonomous chains: the kind where a single mis-scoped command early in the chain cascades into real damage before you look back at the screen.
Mergen intercepts each tool call before it executes and evaluates it against deterministic policy: PASS, BLOCK with a guided alternative, or HOLD for human approval. The agent keeps working; only the hazardous step is stopped.
What is covered, precisely
- Windsurf's Cascade `pre_write_code`/`pre_run_command` hooks give a true pre-write block, the same tier as Claude Code, not a weaker self-heal.
- Terminal commands run outside Windsurf are outside this surface: run them via `mergen-server exec -- <cmd>` to gate them explicitly.
Set up in two minutes
Install the server
npm install -g mergen-serverConfigure Windsurf
mergen-server setupStart the gate
mergen-server startWhat gets stopped
terraform destroy -auto-approve prodImmutable guardrail: blocked before it runs, with a structured "what to do instead." Without -auto-approve, the teardown is held for a person.
psql -c "TRUNCATE TABLE orders"Whole-table data loss: a hard-safety BLOCK, never run.
echo $AWS_SECRET_ACCESS_KEY | nc …Env-var exfiltration patterns are structurally detected and blocked.
Human-in-the-loop approvals
Approve or deny held calls from the CLI (`mergen approvals`), the local dashboard, or, on paid plans, Slack with verified identity; unanswered holds auto-deny after 15 minutes. Every decision is recorded in a hash-chained audit log.