Cloud governance. Local enforcement.
- Shell commands
- MCP tool calls
- File writes
- Git operations
- Cloud APIs
- Kubernetes
- SQL mutations
Also evaluates CI/CD pipelines — the Change Authorization Gate scans every AI-generated pull request before merge via a GitHub Actions step. Mergen evaluates the change; whether a flagged PR can still be merged depends on your repo's branch protection settings, unlike the runtime surfaces above, which Mergen stops directly.
Every agent action is evaluated locally, in under a millisecond. Each machine has its own My Machine dashboard; My Organization at mergen.app gives you the fleet-wide view — policies, approvals, and activity across every runtime.
MCP tools help the agent. The Mergen gate controls the agent. They are not the same layer.
- ✓Runs before execution
- ✓Produces Allow, Hold, or Block
- ✓Stops the handler before it runs
- ✓Cannot be treated as advice
- ✓Explains verdicts
- ✓Finds similar incidents
- ✓Helps investigate and improve policies
- ✓Advisory — never decides Allow, Hold, or Block
Isolation and enforcement are two different questions.
Agent → Mergen → Tools
Mergen sits inline between the AI Agent and the local or production runtime. Deterministic policies intercept, check, and filter payloads in under 1ms.
git commit -m "feat: oauth login"That decision happens on one machine, in under a millisecond. Once connected, every verdict it reaches then rolls up to My Organization — one view of every runtime, decision, and approval across the team. See the organization view →
- Claude Code
- Cursor
- VS Code
- Windsurf
- Any MCP client
- GitHub
- Slack
What happens after you install Mergen.
Every team goes through the same six stages — from a five-minute install to full organizational governance. All of it runs on one deterministic gate.
Install & Connect
Get Mergen protecting your AI agents in minutes.
- One-command setup — mergen-server setup — detects your environment, configures supported tools, and lets you continue locally or connect your Mergen account
- Device-authorized login — approve in the browser, no key to copy-paste — only needed for cloud/team features
- Claude Code and supported IDEs — enforcement through native hooks and runtime adapters; optional intelligence through MCP
- Any MCP client — protocol-generic tools/call coverage
- GitHub Actions — CI gate wired into your pipeline in one workflow step
Protect
Stops destructive actions before they execute. Protection does not depend on the agent deciding to call Mergen — supported actions are intercepted before their handlers run.
- Terminal & shell commands — Bash PreToolUse hook + mergen-server exec
- MCP tool calls — any MCP client, not just Claude Code
- Git operations — dedicated rules for destructive git, not generic pattern matching
- Cloud credential requests — short-lived AWS/GCP/Azure credentials, scoped to the task
- SQL mutations — unscoped updates or deletes with no WHERE clause
- Destructive commands — rm -rf, drop table, terraform destroy
- Secrets & credential exfiltration
- Dangerous git operations — force-push, history rewrite
- Infrastructure teardown — cloud resource deletion, destructive K8s ops
- Unscoped SQL mutations — updates or deletes with no WHERE clause
- Production-window holds — e.g. no auth changes during Friday settlement
Local, sub-millisecond evaluation. Human-readable, version-controlled rules — no code changes needed. Allow / Hold / Block, never a guess.
Observe
Know exactly what happened without digging through logs.
- Runtime Visualizer — a map of the tools, files, services, and APIs an agent touched during a session
- Incident Memory — "this happened before, here's what worked"
- Blunder Log — tamper-evident record of every blocked action
- Agent timelines — a durable history for every agent
- Root-cause context — surfaced at diagnosis time, not reconstructed after
- PagerDuty — incident webhook triggers root-cause analysis
- Datadog — trace fetch on incident open
- OpenTelemetry — OTLP/JSON ingest, any backend language
- Kubernetes — event monitoring feeds the same timeline
Collaborate
Now multiple engineers rely on the same gate.
- Slack approve / deny — the agent waits until a human clicks
- Organization Memory — every approval teaches Mergen — human overrides are stored with their rationale and outcome, surfaced when similar actions occur, and can be promoted into versioned policy
- Role-based approval routing — the right responder is pinged for a given hold
- Approval history — every decision persisted and queryable
- Escalation thresholds — auto-escalate to on-call above a risk threshold
Govern
Now engineering and security leadership need proof, not vibes.
- My Organization — the org-wide cloud surface at mergen.app — Fleet, Usage, Approvals, and Policies for every runtime in one view
- Runtime Fleet — every install with live health, active policy version, and enforcement mode
- Usage analytics — allow / block / held decisions synced from every runtime, org-wide and per install
- Role-based access control — admin, responder, and viewer roles, org-wide
- Tenant-scoped cloud workspaces
Measure
Show what the gate is doing — without building a deck.
- Weekly impact report — prevented actions and mean time to resolution
- Agent activity & block trends — per-agent timelines with fleet-wide rollups
- Approver statistics — who approves, how fast, and which holds expired unseen
- Team adoption — weekly engagement rate on PR comments
- Daily & weekly digests — Slack and email — reports only, never approvals
Everything above is included. No hidden enterprise-only execution engine. Only collaboration and governance scale with your plan.
Timeline: Inline controls vs. reactive triage
See everything your AI agents did.
An illustrative example of the Runtime Visualizer — a map of the tools, files, and services an agent touched during a session, so you can audit at a glance instead of digging through logs.
For the full local-runtime-and-My-Organization architecture diagram, see the homepage's architecture section →