mergen-server

Prompts are not boundaries. Mergen is the deterministic gate between AI agents and your systems.

The Execution & Security Gateway for AI agents: an MCP proxy — plus a Claude Code Bash hook and a mergen-server exec CLI entrypoint — that intercepts every covered tool call before the handler runs, evaluates it against your local policy engine in under 1ms, and either passes it, blocks it with a guided alternative, or holds it for one-click human approval in Slack. No LLM in the critical path. No probabilistic guardrails.

Quick start

npm install -g mergen-server
mergen-server setup     # connects your AI IDE, Slack, and the Claude Code Bash hook

Then add to Claude Code:

claude mcp add mergen --transport stdio -- mergen-server start

Ask your agent to git push --force. It won't — it gets a structured error explaining why the call was blocked and what to do instead, then reformulates within policy.

What it does

Agent calls a tool (MCP tools/call, Claude Code Bash, or `mergen-server exec -- <cmd>`)
  → Local policy engine evaluates the payload in <1ms
  → PASS   → handler runs
  → BLOCK  → structured error: why + guided alternative; action hash-chained to the Blunder Log
  → HOLD   → Promise suspends; Slack approve/deny resumes or denies the call

Blocked by default: rm -rf, DROP TABLE, terraform destroy, force-pushes and history rewrites, secret exfiltration, unscoped SQL mutations, infrastructure teardown. Every human override becomes binding enforcement policy for the next agent.

All data stays on your infrastructure. No cloud. No copy-paste.

CLI

mergen-server exec -- terraform apply   # gate any raw shell command outside an IDE
mergen-server doctor                    # verify gateway + hook health (--fix repairs)
mergen-server approve <token>          # resolve a held action locally
mergen-server test hitl                 # verify Slack approval delivery end to end
mergen-server login                     # device-authorized account sign-in

MCP tools

| Tool | What it does | |------|-------------| | execute_fix | Execute a fix (requires confirm: true) — intercepted by the gate first | | triage_incident | Full autonomous loop — diagnosis + optional fix | | analyze_runtime | Causal analysis — root cause + fix hint, no execution | | get_recent_logs | Console events from the ring buffer | | get_network_activity | HTTP/fetch events with status, duration, body | | validate_fix | Compare error counts before/after a fix | | generate_runbook | Self-updating runbook from your incident corpus | | search_postmortems | Semantic search over past incidents | | draft_postmortem | Blameless post-mortem draft in seconds |

Every tools/call — these and any other MCP server's — passes through the policy gate before its handler runs.

Environment variables

MERGEN_SHADOW_MODE=true            # dry-run: log verdicts, enforce nothing (trial mode)
MERGEN_AUTOPILOT=true              # enable autonomous fix execution
MERGEN_SLACK_BOT_TOKEN=xoxb-...    # Slack Web API (HITL approvals + threads)
MERGEN_SLACK_CHANNEL=#incidents    # default channel

Point your OTLP exporter at http://127.0.0.1:3000 and PagerDuty webhooks at /webhooks/pagerduty for the incident-triage loop.

Node.js SDK (one line)

import 'mergen-server/sdk/node.js';
// Captures uncaught exceptions, unhandledRejections, and process exits automatically

Full documentation

mergen.app/guide · questions: [email protected]