Let Claude Code run free on your repo. It still can't see what it shouldn't.
You hand over a task and the agent runs commands, installs things and pushes for hours. Gitfence gives it a copy of your repo with the sensitive parts left out.
Clone https://demo:[email protected]/demo/shop.git, read AGENTS.md, then tell me what you can and can't see in core/ and infra/.git clone https://demo:[email protected]/demo/shop.gitA real repo with its recommender and fraud model fenced off. This public login only reads. Open the live demo to push
acme/shopon GitHubalice's cloneclaude-code (agent of alice)
Example: alice and her AI agent get the same view: src/ editable, core/ as types only, infra/ absent. An agent never has more access than its person.
Ignore files stop at the agent's terminal. Gitfence isn't an ignore file: the bytes never reach the machine.
Why ignore files and exclusion settings aren't enough
Cursor's .cursorignore
Cursor's docs:
The terminal and MCP server tools used by Agent cannot block access to code governed by
, and.cursorignorecomplete protection isn't guaranteed
.GitHub Copilot content exclusion
GitHub's docs:
Content exclusion is currently not supported in Edit and Agent modes of Copilot Chat in Visual Studio Code and other editors.
Copilot CLI has respected it since September 2026.AI gateways
A gateway checks what's sent to the AI provider through it. It doesn't decide which files are on the laptop, so the agent can still read, run and copy them.
How gateways work, not one vendor's docs
Gitfence
Not an ignore file. Fenced files are never sent, so there is nothing on the machine for any tool, terminal or agent to read.
Quotes read on October 10, 2026. These tools change often; check the linked pages for the current wording.
What the agent gets instead
Enough to finish the task without the code you kept back.
A smaller repo
Fenced folders are missing from every commit, not just hidden.
Types for the rest
Its code still compiles against what it can't read.
Real tests
Your tests run on the full code, somewhere the agent can't reach. Runs self-hosted; on hosted, we set it up with you.
The rules, in plain words
CLAUDE.md and AGENTS.md tell it what's off limits and why.
Less than its owner
Give one agent a few folders for one task. Never more than its person.
It ends on its own
After 30 days, when its pull request merges, or when the ticket closes.
No-AI folders
Mark a folder for people only. No agent gets it.
No secrets
Keys and .env files are left out. A push that adds a secret is refused.
A way to ask
It requests a file for two hours. You approve in Slack.
Clear refusals
A push into fenced code is refused, with what to do instead.
Normal pull requests
Its work lands on GitHub, marked low risk or needs a human.
Every commit tagged
Gitfence-Agent: claude-code (of @alice). It can't be faked.
The rules in plain words, and tools to ask
Each agent gets its owner's copy or less, the rules in every clone, and tools to test and ask.
AGENTS.md and CLAUDE.md, in every clone
## Gitfence: you are working in a fenced view Some paths are intentionally absent or read-only for your access. The project is not broken. Types only: core/ (import from it normally) - Do NOT create, recreate, stub or reimplement anything under a hidden path. - Need something hidden? Ask for access.
MCP tools
In our recorded run, Claude Code built a feature against types only and ran 7 passing tests through Fenced CI.
One paste and Claude Code is working
Gitfence writes the prompt. The link in it works once and stops working after 15 minutes. Codex gets the same prompt.
Shortened. Gitfence gives you the full prompt in the app.
Then you review what matters
Risky pull requests wait for a person. The rest are marked low risk.
Add gift cards to checkout #128
- What changed
- 6 files changed (212 lines added, 9 removed)
- Risk areas
- Payments and billing:
src/billing/charge.ts
Dependencies:package.json - New dependencies
stripe17.2.0- Tests
- Fenced CI ran the tests on this version and they passed.
- Who made it
- claude-code (an AI agent working for alice)
Fix cart rounding #129
- What changed
- 2 files changed (14 lines added, 3 removed): 2 in
src/cart - Risk areas
- None.
- New dependencies
- None.
- Tests
- Fenced CI ran the tests on this version and they passed.
- Who made it
- claude-code (an AI agent working for alice)
Example. Decided from the files changed, not by an AI. Make the check required on GitHub and a risky pull request can't merge until a person approves it.
Not built yet
Everything above is in the product today. These aren't.
A fenced GitHub mirror Not yet
For cloud agents that can only clone from GitHub.
Self-serve Fenced CI on hosted Not yet
Self-hosted, it runs today. On hosted, we set it up with you.
Rules as code Not yet
Access rules in a .gitfence.yml, synced with the app.
What it won't do
- It can't hide what an agent already downloaded. Fence first, then hand over the task.
- A teammate with full access can still paste hidden code into a visible file. The IP-leak check looks for that on fenced pull requests; it's a deterrent, not a proof.
- Test output is scrubbed of hidden code, but not if it's encoded (base64, for example). Use pass/fail mode for agents you don't trust.
- Risk-based review reads file names and dependency files, not logic. A risky change in an ordinary-looking file is marked low risk.
- Secret detection replaces keys it recognises. Something that only looks like a password is reported to admins but still served.
- Gitfence doesn't see prompts. For what an agent could have sent out, see exposure reports.
Questions
Did an agent really work in a fenced repo without help?
Yes. On 2026-10-08 we gave Claude Code (Sonnet) a checkout task in a fenced demo shop, inside a sandbox with only its clone, an agent token and the MCP server. It read the generated core/*.d.ts, wrote the feature and tests, ran the suite through run_tests (7 passing) and pushed a branch. It did not stub or recreate the hidden pricing code, and none of the pricing internals appeared in any object of its clone. In that demo the pull request went to a local test forge, not github.com.
Which agents work with Gitfence?
Anything that uses git. We test with Claude Code first and Codex second. Gitfence gives you one prompt to paste; it clones the repo and connects the Gitfence tools.
I'm not an engineer. Can I still use this?
Yes. Paste one prompt into Claude Code and say what's off limits in your own words. It sets Gitfence up, shows you who will see what, and waits for your yes. Approving the GitHub app is the only step you do yourself.
Can an agent get less access than the person running it?
Yes, never more. Give one agent a few folders for one task, and mark folders No AI agents so people can open them but no agent can. An agent's sign-in ends after 30 days unless you choose otherwise, or when its pull request merges or its ticket closes.
Who reviews what the agent wrote?
You, where it matters. Each pull request gets a Gitfence review check: Needs a human when it touches sign-in, payments, migrations, deploys, dependencies, permissions or secrets, otherwise Low risk. It looks at which files changed, not at the logic inside them, so it tells you where to look first. It doesn't replace review.
Isn't this what ignore files and permission prompts are for?
They help, and you should keep them. But they run on the same machine as the agent, next to the full repo. A shell command, a script or another tool can still read the file. Gitfence removes the file from the download instead.
Hand over the task, not the whole repo
Start free. Your team keeps working on GitHub as before.