Built-in permissions have gotten smarter: Claude Code's auto mode now judges individual commands, and in our live measurement it refused 50 of 160 dangerous commands on their content. What it asks is whether the user wants the action, so a destructive command the user asked for usually goes through: 105 of those 160 ran. Mergen asks what the organization allows, and answers it the same way on every agent you use (Claude Code, Codex in beta, Cursor, Windsurf, VS Code). The rest of the gap is structural: an agent's settings file is editable by the agent and covers that one agent, and a yes/no prompt is not an out-of-band approval with an audit trail that remembers the decision. Mergen's Claude Code integration is built on that same PreToolUse hook; the hook is the attachment point, not the policy. See the measurement →

A sandbox decides where an agent can run and what it can reach. It does not decide whether a specific action, once inside that boundary, should happen. An agent holding valid credentials inside a correctly-configured sandbox can still run terraform destroy against real infrastructure, drop a production table, or commit a hardcoded secret, and every one of those is "inside the boundary." Sandboxing bounds the blast radius; Mergen evaluates the action. They are complementary, and teams that are serious about this run both.

Enforcement pauses. Past the limit the gate stops evaluating: no policy rules, no approval holds, no blast-radius checks, and no hard-safety blocks either, so catastrophic actions (rm -rf /, terraform destroy, credential exfiltration) are not stopped while you are over the cap. It resumes when the month resets or you upgrade. Set MERGEN_FREE_CAP_MODE=protect to keep full enforcement running regardless of the cap. For reference, a median developer runs roughly 1,000–1,500 protected calls a month; paid plans are unlimited and never metered on calls.

A seat is a person, not a machine: each developer connects one protected runtime, and moving to a new machine replaces it. Team is $199 per month for 5 developers, plus $40 for each added developer up to 10; Business is $499 per month for 10 developers, plus $50 for each added developer up to 20. Each plan bills its minimum (5 or 10) even with fewer people. Add or remove seats from Account → Billing; the change is prorated on your next invoice. Past 10 developers, or when you need admin-only or team-routed approvals or SIEM export, choose Business.

Email omer@mergen.app. The self-serve ladder tops out at 20 developers on Business deliberately, because past that the questions are usually SSO/SCIM, audit retention, deployment model and support terms rather than seat count, and those are worth a conversation rather than a checkout page. Local enforcement is identical either way: Gate A's PASS/HOLD/BLOCK verdict is the same on every plan.

It depends on whether you use My Organization. Without it (Free, or any machine not linked to a paid org), almost nothing leaves: ingest binds to 127.0.0.1, and the only thing a signed-in Free install reports is its cumulative tool-call count (so the 1,000/mo cap can’t be reset by deleting a local file). On a paid plan, asking Claude to draft a policy from a sentence sends that sentence, and nothing else. With My Organization (Team and Business), your data no longer stays only on your machine: machine identity, usage, holds, approvals, audit records and your team policy are stored on Mergen’s hosted backend, which runs on third-party providers (Railway, Supabase, Vercel, Clerk), and those records are kept after a machine or org is removed. Command text stays local by default, but the metadata around it (hostname, rule, outcome, approver, time) does sync. Either way the verdict is computed locally and never waits on that sync. To keep everything on your own infrastructure, use the self-hosted sync plane instead.

Every agent command or file edit Mergen evaluates: shell commands and file edits in Claude Code, Windsurf and Cursor, shell commands and patches in Codex CLI (beta, after a one-time trust step in Codex), and file edits in VS Code through the extension. Commands are stopped before they run on every one of these agents, and so are Codex patches; Cursor and VS Code file edits are checked just after they land and reverted if blocked. A raw shell command typed outside an IDE isn’t automatically covered; run it through mergen-server exec -- <cmd> for the same gate.

Yes. Free runs the full local execution gate on one machine, forever, no payment required (an account is required: sign-in is a one-time step, then enforcement runs fully offline). Signing in on Free does not connect you to My Organization; that happens only when the machine joins a paid organization, and from then on its records are also stored on Mergen’s hosted backend. Neither one ever weakens local enforcement.

A risky action pauses for approval. If Slack is configured, it posts an approve/deny prompt to your team’s channel: one click resumes or denies it. On Free, the hold is still placed and logged locally even without Slack; delivery is a convenience plans gate, never the safety decision.

Yes. A payment method is required to start the 30-day trial. You won’t be charged during the trial.

You can cancel anytime from your account dashboard. Your subscription stays active and you keep access through the end of your current billing period. Your local execution gate keeps enforcing regardless; only paid coordination features (org policy sync, Slack approvals, fleet visibility) fall back to Free once the period ends.