Gitfence documentation
Task-focused guides for admins, security leads, self-hosting and billing. Every label and setting here matches the app.
Admins
- Getting startedSet up Gitfence for your organization: create it, connect GitHub, add a repository, restrict folders and invite your first contractor.
- Adding a contractor or new hireInvite a contractor or new hire, choose their access, require an NDA and set an end date. What they clone and how they start.
- Access levelsThe four Gitfence access levels, how rules combine, and what restricted people and AI agents can read, edit or never receive.
- Types only for Go, Python and TypeScriptGive restricted people the API of a folder without its implementation: TypeScript declarations, Go and Python stubs that compile, values removed.
- The access ladderGive a new hire or contractor a ladder: their area first, more access after 30 and 90 days, and an end date, with each step approved by you.
Security
- Single sign-onSet up SAML 2.0 or OpenID Connect for Okta, Google Workspace or Microsoft Entra ID, verify an email domain and turn on Require SSO.
- SCIM provisioningConnect Okta or Microsoft Entra ID over SCIM, map IdP groups to access groups and see how deprovisioning and GitHub renames behave.
- Encryption at restHow Gitfence encrypts code at rest, what the recovery key opens, what locked means and what is not covered.
- The signed release ledgerGitfence's signed release ledger: what is public (signatures, digests, the hash chain) and the full release record Enterprise and self-hosted customers receive.
- Offboarding and exit packsEnd a person's access, revoke tokens and agents, and download a signed exit pack with agreements, access history and exposure receipts.
Agents and review
- AI agents and MCPGive Claude Code, Codex or Cursor an agent token and connect the MCP server. Scopes, tools, run_tests availability and the guide in every clone.
- Code reviewThe Gitfence review check, risk areas, approvals and what restricted people see from reviews, checks and comments on GitHub.
- Reviewing a pull requestReview your team's pull requests in Gitfence: a diff from your own copy, line comments, reviews, and the REST API and MCP tools for AI agents.
- What contractors see from CIShow contractors why CI failed without exposing hidden code: results, error locations, filtered logs, MCP and REST access, re-runs and audit records.
- Working on pull requestsPush your own branch, open a draft pull request, update it after review, and use Gitfence tools for commit ids, tags and large clones.
- What syncs with GitHubWhat pull requests, issues, code, reviews, comments and reactions sync between GitHub and Gitfence, and what stays read-only.
Self-hosting and scale
- Self-hostingInstall Gitfence on your servers with docker compose: sizing, your GitHub App, the offline license, encryption and Vault keys, Fenced CI, backups, upgrades.
- Verify a Gitfence releaseVerify a self-hosted Gitfence release with cosign: key fingerprint, signed image digest, provenance, SBOM, release files and the running executable.
- GitHub Enterprise ServerRun self-hosted Gitfence against GitHub Enterprise Server 3.9 or later: two settings and your own GitHub App on your server.
- Performance and sizingMeasured on the full Kubernetes history (163,380 commits): one-time setup, clone, fetch and push times, memory, and the host and disk to plan for.
Looking for the product overview instead? See how it works, security and pricing.
Fence your first repository in minutes
Free for one repository and your own team. Add a restricted person and Pro is free for 14 days, no card.