Integration · Windsurf
Secure Windsurf agents with a deterministic execution gate
Windsurf’s Cascade executes long autonomous chains — the kind where a single mis-scoped command early in the chain cascades into real damage before you look back at the screen.
Mergen intercepts each MCP tool call before it executes and evaluates it against deterministic policy: PASS, BLOCK with a guided alternative, or HOLD for human approval. The agent keeps working; only the hazardous step is stopped.
What is covered, precisely
- Every MCP tools/call from Windsurf is intercepted unconditionally.
- Non-MCP terminal commands are outside the proxy — run them via `mergen-server exec -- <cmd>` to gate them explicitly.
Set up in two minutes
Install the server
npm install -g mergen-serverConfigure Windsurf
mergen-server setupStart the gate
mergen-server startWhat gets stopped
terraform destroy prodImmutable guardrail — blocked in <1ms with a structured "what to do instead."
psql -c "TRUNCATE orders"Schema/data-destructive SQL escalates to HOLD with quorum support.
echo $AWS_SECRET_ACCESS_KEY | nc …Env-var exfiltration patterns are structurally detected and blocked.
Human-in-the-loop approvals
Approve or deny held calls from Slack with verified identity; unanswered holds auto-deny after 15 minutes. Every decision is recorded in a hash-chained audit log.