mergen-server

Prompts are not boundaries. Mergen is a deterministic gate between AI coding agents and your machine.

It checks every command and file edit an agent makes, on your machine, before it takes effect, and returns one of three verdicts: PASS (it runs), HOLD (it waits for a person to approve) or BLOCK (it does not run, and the agent is told why and what to do instead). Policy rules, not a model, decide; no LLM is in the decision path.

Quick start

macOS / Linux, in a terminal:

curl -fsSL https://mergen.app/install.sh | bash

Windows, in PowerShell:

iwr https://mergen.app/install.ps1 -useb | iex

Or with npm:

npm install -g mergen-server
mergen setup      # signs you in, finds your agents, installs their hooks
mergen doctor     # checks that each agent in use is protected

How each agent is covered

| Agent | How | Guarantee | |---|---|---| | Claude Code | PreToolUse hook | Blocked before it runs | | Windsurf | Cascade pre-write and pre-run hooks | Blocked before it runs | | Codex CLI | PreToolUse hook (after you trust it in Codex /hooks) | Blocked before it runs | | Cursor, shell commands | beforeShellExecution hook | Blocked before it runs | | Cursor, file edits | afterFileEdit hook | Reverted right after the write | | VS Code (any agent) | Mergen extension | Reverted right after the write | | Your own terminal / CI | mergen run -- <cmd>, mergen shell-init | Blocked before it runs |

Cursor and VS Code edits are a detect-and-revert tier: the bad content lands on disk briefly, then Mergen restores the file.

What it checks

Commands. Built-in rules block rm -rf of home or system paths, DROP TABLE, terraform destroy, force-pushes and history rewrites, and reads of credentials headed off the machine. They hold deploys, release publishes, writes outside the repository and similar actions for approval. The rules read the command's structure (variables, cd, pipes, bash -c, command aliases), so a rewording does not change the verdict.

Code changes. Before an edit lands, detectors look at the diff: a live secret written into a file is blocked; removed auth checks, deleted tests or CI steps, changes to Mergen's own hooks, risky dependencies and similar changes are held for a person.

Your own rules. Write them in plain words on the Policies page or with mergen policy, and see what a rule would have done to your last 1,000 actions before you save it.

Approve held actions in the terminal (mergen approvals), in VS Code, on the local dashboard, or in Slack. An agent cannot approve its own hold.

Verdicts are computed locally (policy rules p50 0.35 ms, full verdict p50 2.9 ms) and do not depend on any cloud service. Every decision is recorded in a hash-chained audit log on your machine.

New since 1.6.0

• Codex CLI is protected (mergen setup --ide=codex), and Cursor shell commands are now blocked before they run.
• Code-change checks run on every agent edit before it lands, and compare against the file as the session first saw it, so a refactor split across edits is not mistaken for a removal.
• Write rules in plain words and see what each one would have done to your last 1,000 actions before saving it (paid plans). The Policies page suggests rules from commands you denied every time.
• Approvals are tighter: one approval runs the command once, only in the folder where it was approved; an agent cannot approve its own hold. Stop asking turns off a hold you always approve for 7 days.
• Fewer interruptions: deleting a path that does not exist, creating new files in the repo, and searching for a dangerous phrase no longer wait for approval.
• Gate failures no longer let calls through: a gate that answers with an error or times out now blocks with a way out; only a gate that is not running fails open (set fail-closed to change that).
• Free plan limit: past 1,000 checked actions in a month, enforcement now pauses until the next month (it used to keep evaluating). Set MERGEN_FREE_CAP_MODE=protect to keep it on.
• mergen doctor warns only about agents you actually use.
• Security: the local dashboard no longer keeps its secret in a browser cookie (other local servers could read it); browsers sign in with a single-use code.
• Removed: the PR/CI diff gate and GitHub Action (gate the commands CI runs with mergen run instead), and the Sentry, Linear, Jira and Discord integrations.

Full list of verdict changes: VERDICT_CHANGES.md.

CLI

mergen status                    # protection state and anything waiting on you
mergen approvals                 # review and answer held actions
mergen run -- terraform apply    # gate and run a command outside an agent
mergen check -- "<command>"      # what Mergen would do, without running it
mergen events --follow           # live enforcement activity
mergen doctor --fix              # diagnose and repair the install
mergen help --all                # every command

The mergen-server binary is kept for compatibility and takes the same commands.

Plans

Sign-in is required. On the Free plan enforcement covers 1,000 checked actions a month; past that, enforcement pauses until the next month (checks pass without evaluation) unless you set MERGEN_FREE_CAP_MODE=protect. Paid plans add team policy sync, Slack approvals and integrations; the gate's verdicts are the same on every plan. See mergen.app/pricing.

Configuration

MERGEN_GATE_AVAILABILITY_MODE=fail-closed   # shared/CI machines: a stopped gate blocks instead of passing
MERGEN_ADMIN_SECRET=...                     # protect admin changes (env only: an agent can read files)

Full list: mergen-server config.

What changed in how commands are judged

Every release that changes a verdict (a newly held or blocked shape, a false positive fixed, a gap closed, a known limit) is listed in VERDICT_CHANGES.md, shipped in this package.

Documentation

mergen.app/docs · questions: [email protected]