Gitfence
Start free

Changelog

What shipped, when. Not built yet: a fenced GitHub mirror for cloud agents, self-serve Fenced CI on hosted, rules as code.

Self-hosted Gitfence, Go and Python types, large monorepos and a GitHub-like view for contractors

  • Self-hosted. One container image with a compiled build, installed with docker compose. A signed license checked offline, no telemetry, your own GitHub App, backups to your own bucket, and Fenced CI in a sandbox on your host.
  • Customer-managed key. Self-hosted, the encryption keys can be sealed with a HashiCorp Vault transit key. Disable it in Vault and the code locks.
  • GitHub Enterprise Server. Self-hosted Gitfence works with GitHub Enterprise Server 3.9 or later.
  • Types only for Go and Python. Go and Python get stubs at the same path that keep every exported type and signature, with bodies that panic or raise and every value replaced, so their code still builds.
  • Large monorepos. Building a view is now per directory and cached: the full Kubernetes history (163,380 commits) is prepared once in 33 minutes on two CPUs, then fetches take seconds. git keeps the connection open while a view is prepared.
  • A GitHub-like view for contractors. Code browser, pull requests with conversation, checks and files changed with line comments, and issues, all from their own copy. Their comments post to the same GitHub thread.
  • Secrets list. Values that only look like a password are listed per file and line, with who can read them; Mark as safe stops reporting one.
  • Product tour. A guided walk through a contractor's first day to their last, at /tour/.

SSO and SCIM, encryption at rest and EU backups

  • Single sign-on. SAML 2.0 and OpenID Connect, with setup steps for Okta, Google Workspace and Microsoft Entra ID, verified email domains, Require SSO and owner recovery codes.
  • SCIM provisioning. People and groups from your identity provider, IdP groups mapped to access groups. Deactivating someone offboards them everywhere.
  • Encryption at rest. Code is encrypted with a key we don't keep: your people's and agents' credentials and your recovery key hold it. Locked after ten idle minutes.
  • Backups. Daily, in the EU, with no source code. A restore drill has been run.

The access ladder and exit packs

  • Access ladder. Access that widens on a schedule you approve step by step, and end dates with reminders.
  • Exit packs. One click ends a person's access everywhere and gives you a signed record of what they received and signed.

Risk-based review, agent seats, secrets, signed receipts and one-paste setup

  • Risk-based review. Pull requests that come through Gitfence get a Gitfence review check: Needs a human when they touch sign-in, payments, migrations, CI and infrastructure, dependencies, permissions or secrets, otherwise Low risk. A plain-language summary lists what changed, new dependencies with versions, the test result and which agent made it. Decided from the diff, not by a model.
  • Agent seats. An agent can be given less than its owner. Agent sign-ins end after 30 days by default, or when their pull request merges or closes, or their ticket closes. Folders can be marked No AI agents. Every agent commit ends with a Gitfence-Agent line that can't be faked.
  • Secrets. Secrets files are left out of every restricted copy by default, credential values inside other files are replaced, and pushes that add a new secret are refused.
  • Leak tracing. Each person's copy carries a harmless marker in the text Gitfence generates, so a leak that includes it can be traced to one copy.
  • Signed exposure receipts. Per person or agent, and a per-repository attestation of what was never served to any AI agent. Ed25519-signed JSON and PDF, share links you can withdraw, and a public verify page.
  • One-paste setup. One prompt for Claude Code or Codex sets up an invited person's clone and tools. For admins, the agent sets Gitfence up from a plain description and shows a preview before anything changes.

Temporary and ticket-scoped access, Slack, exposure reports, audit export

  • Temporary access. Exceptions and access approvals can end after 2 hours, a day, a week or on a date. Expiry is checked on every git, MCP and CI access, and every grant and expiry is audited.
  • Ticket-scoped access. Tie a grant to a Linear issue or Jira ticket; it ends when the ticket is done or deleted. Agents can ask for a duration or a ticket through request_access.
  • Slack. Access requests, pending invitations and signatures, and rejected pushes post to a channel, with one-tap Approve and Deny for linked admins.
  • Signed webhooks. HMAC-signed event deliveries for Discord or Teams adapters and SIEMs, with retries, plus optional audit streaming.
  • Exposure reports. What a person could ever see or edit, and when, or who could see a path; JSON, CSV or a printable page.
  • Audit export and retention. One ordered JSONL or CSV export across git, MCP, invitations, settings, billing and access changes, with a retention setting that keeps signature evidence.
  • Testing note. Slack, Linear and Jira are tested offline against stand-in servers that follow their APIs, not yet against the live services.

Invitations, signed documents and GitHub collaboration

  • Invitations. Links for one GitHub user, an email domain or anyone with the link, with expiry, use limits, optional approval and an access end date.
  • Documents and NDAs. Require markdown or PDF documents before access. Git, MCP and Fenced CI stay closed until they're signed. Signatures record the exact version hash, typed name, time and IP, with an exportable certificate.
  • GitHub collaboration. Restricted members see their pull requests' reviews (including CodeRabbit), review comments and checks, with hidden content redacted, and can reply. Issues can be shared by label.
  • Fork mode. Restricted people's branches can go to a private fork in a separate organization, with Actions disabled there by default.
  • Gitfence check. Every fenced pull request gets a check naming the person and agent, confirming the head matches the delivery, and scanning added lines for hidden-code fingerprints.
  • Sign in with GitHub. PKCE sign-in, member home page with clone commands, git passwords and agent tokens you can revoke.
  • Per-person exceptions. Give one person different access to a path on top of their group, and preview exactly what they'll get.

The engine, Fenced CI, MCP and the admin app

  • Filtered views. Per-view filtered history built in a private mirror, forward-only when permissions change, served from repositories that never contain hidden objects.
  • Push validation. Every pushed commit validated per path, including look-alikes, symlinks, Windows spellings and protected config; atomic across refs; delivered as pull requests.
  • Types only. Generated TypeScript declarations with literal values redacted.
  • Fenced CI. Tests on the real code in a no-network sandbox, with output redaction or summary-only mode.
  • MCP server. fence_status, check_paths, run_tests, request_access and my_access_requests for agents.
  • AGENTS.md / CLAUDE.md guide. A section explaining the fence in every view, stripped again on push.
  • Admin app. Files view with access per folder, access matrix, preview as anyone, requests inbox, tests settings, tokens and activity.
  • Billing. Pay only for restricted people; full-access teammates free.
  • Security tests. Property tests against real git clients; four issues found and fixed, documented on the security page.

Fence your first repository in minutes

Free for one repository and your own team. Add a restricted person and Pro is free for 14 days, no card.

Start free with GitHubHow it works