Mergerie
Français

Security

What leaves your machine

Mergerie is a local application. There is no hosted Mergerie service standing between your code and the tools you already use. This page says exactly which network calls happen, and why.

The three destinations

  • Your machine → your forgeGitLab or GitHub, at the tokens and endpoints you configure. Mergerie fetches merge requests and diffs from there, and publishes reports and comments there.
  • Your machine → your AI providerThe claude, copilot, codex or gemini CLI you already installed and authenticated. Mergerie calls that CLI locally. What it sends onward to Anthropic, GitHub, OpenAI or Google, and what that provider retains, is governed by that provider's own terms, not Mergerie's.
  • Your machine ✕ a Mergerie serverThere isn't one. Nothing you do in Mergerie is proxied, logged or stored elsewhere: there is no Mergerie server to send it to.

"Zero telemetry", precisely

Mergerie ships no analytics SDK, no crash reporter, no update checker that calls a Mergerie server. Its runtime dependencies are express (the local server), better-sqlite3 (the local database) and gpt-tokenizer (counting tokens offline). Check package.json yourself. What stays on your machine: the SQLite database, local logs, your tokens. What Mergerie never sends anywhere: usage statistics, error reports, your prompts or diffs, outside of the forge and AI calls you configured.

What Mergerie itself does not do

  • It does not read your code to send it to a Mergerie-run model: there is no Mergerie-run model.
  • It does not resell, cache or retain a copy of your diffs beyond the local database you control.
  • It does not push, publish or merge without an explicit click, unless you turn on the autonomous convergence loop yourself, with the thresholds you set.
  • It does not add a new account, a new API key or a new bill: it drives the CLI and forge credentials you already have.
  • It does not give the agent more than your CLI already has. Without the secure mode, the agent runs with exactly the rights of the CLI you installed, as it does in your terminal. The environment variables you give it (a local Ollama behind Claude Code, a proxy) go to the one agent Mergerie launches, never to your terminal.
  • The secure mode switches on with one click, asked once at start-up, in Settings → AI sessions. Reviews, explanations, questions and explorations then run the agent read-only. Coding sessions run in the CLI's sandbox once Test the sandbox has seen it block a write outside the folder and a network call on your machine; until that is proven, an allowlist removes web fetching, curl, ssh, git push and git config. Either way, what leaves your machine does not change, and the server's protections below hold.
  • It does not let a CLI claim a guarantee it cannot prove. Claude Code and Copilot CLI are proven and wired with what their flags enforce; Codex CLI and Gemini CLI are written from their documentation, wired with what they declare, and Settings say “unverified”. Any other CLI runs at a reduced level, which the journal states on its first line.
  • It does not hand the agent your secrets. The forge token travels as a header in the git process only, never in a clone's origin URL. The agent's file tools cannot read the database or the .env. Text from elsewhere (a ticket, a merge request description) enters the prompt framed as data.
  • It does not run code a colleague sent without asking: a verifier or an agent received through the team repository waits for Approve on this machine. A verification that starts by itself never sees your HOME. One you launch by hand says so at the moment you click, with a throwaway-HOME box remembered per verifier. And it refuses to start exposed on the network without an access token. On loopback, a local session token guards /api/ against any other process on the machine.

Reporting a vulnerability

Mergerie's threat model and how to report a security issue are documented in SECURITY.md, in the repository.

Related reading