Mgit

mgit

Sandboxed version control for autonomous coding agents.

Part of the HyperSwe suite.

mgit is a sandboxed, version-controlled workspace for autonomous coding agents. It runs an agent's untrusted code (dependency installs, builds, and tests) in a disposable per-task microVM, and records the agent's work in an isolated, append-only store separate from the project's git. Each change is tagged to the task that produced it, and only the reviewed, squashed result is landed into the repository.

Coding agents increasingly run unattended, installing packages and executing build and test commands as they iterate. mgit makes that safe on a real codebase: execution is contained to a throwaway VM with access limited to what the task needs, the project's git is never modified directly, and every step the agent takes is preserved as a traceable, reviewable record.

What you get

• 🛡️ Sandboxed execution: installs, builds, and tests run in an isolated VM, never on the host.
• 🔒 Default-deny networking: the agent reaches only what the task needs; your secrets and network stay unreachable.
• ✅ Verified land: only changes that pass host-side re-verification (dual-hash, task binding, host-anchored attestation) reach your repo.
• 🧬 Isolated, clean history: intermediate work stays in mgit's own store; only the squashed result lands in your git, and you can roll back or branch from any step.
• 📜 An audit trail you can stand behind: append-only, task-tagged, dual-hash-verified history; trace any landed change back to the task, the agent, and every step that produced it.
• 🤝 Multi-agent parallelism: per-task worktrees and per-task sandboxes let agents work different tasks side by side without collisions.
• 🔌 Fits what you have: runs over your existing git repo without touching .git, stays in sync with it automatically, and wires into Claude Code, Codex, and Cursor with one command.

> "Six tickets, zero conflicts, and squash --to-git round-trips byte-for-byte. The microVM sandbox is the one capability plain git worktrees fundamentally lack." > Independent team that integrated their own project through mgit

Quick start

Two minutes, on top of your existing repo. Nothing to migrate; your git is left untouched.

Install with Homebrew (macOS / Linux):

brew install hyper-swe/tap/mgit

or with Go:

go install github.com/hyper-swe/mgit/cmd/mgit@latest

Start an agent on a task. mgit work provisions a task-bound worktree and wires the agent's harness; with --sandbox it also launches the task's microVM. The --sandbox leg requires [enabling the sandbox](#enable-the-sandbox) first (the daemon and a guest image); everything else in this walkthrough works without it.

mgit init                                    # set mgit up alongside your existing git repo
mgit work ./wt-PROJ-12 --task-id PROJ-12 \
  --sandbox --image base@sha256: --network allowlist --allow registry.npmjs.org

Inside that worktree, the agent's commands execute in the guest VM, and each coherent step becomes a task-tagged micro-commit:

cd ./wt-PROJ-12
mgit run -- npm install                 # runs in the microVM, never on the host (fail-closed)
mgit commit -m "add validation helper"  # task ID auto-inherited from the worktree
mgit run -- npm test
mgit commit -m "wire validation into handler"

Review, squash, and land:

mgit log --task-id PROJ-12 --oneline    # the step-by-step history is the review surface
mgit diff --task-id PROJ-12
mgit squash --task-id PROJ-12           # one reviewable commit for the whole task
mgit sandbox land --task-id PROJ-12     # host-verify and append into your real repo

If a decision turns out wrong mid-task, [backtrack, fork, and salvage](#course-correction-a-checkpointed-working-substrate) instead of rewriting from scratch. Agent harnesses (Claude Code, Codex, Cursor) are wired automatically by mgit work, so all of this is transparent to the agent.

> Worktree notes. An mgit worktree is not a git repo (no .git); integrate by exporting the squash as a patch (mgit squash --task-id --to-git | git apply), never by running git inside the worktree. Gitignored build artifacts (e.g. an embedded web/dist) are not seeded into worktrees; list them in .mgit/seed-include (one glob per line) to carry them in.

Why · Containment · Course-correction · Audit · Install · Commands · Security · Scope

---

Why this exists

An autonomous agent working a task routinely executes code no one has read: a single npm install runs the install hooks of hundreds of transitive dependencies, and supply-chain attacks on public registries are reported weekly. When the agent runs directly on your machine, that code runs with your privileges, alongside your credentials and every other repository you have, and there is no version control for a leaked key. Containment has to happen before execution, not after.

mgit provides that containment, and pairs it with a working history built for how agents actually work: many small steps, some of them wrong, that need to stay reviewable and reversible without polluting the project's git.

How containment works

mgit runs the agent's untrusted execution inside a per-task microVM (Firecracker on Linux/KVM; Apple Virtualization.framework on macOS, running a Linux guest), so the blast radius of a compromised package is a disposable VM, not your host:

• Hardware-isolated execution. Installs, builds, and tests run in the guest VM. The host filesystem, your other repos, and your credentials are never mounted in. The microVM boundary is the same one cloud providers trust to isolate tenants.
• Default-deny egress. The guest gets no direct network route. A per-task allowlist permits only the destinations a task actually needs (e.g. your package registry), enforced at the IP/flow layer by a host-side proxy. Raw-IP, QUIC, DNS-tunnelling, and metadata-endpoint tricks are denied. (none / allowlist / open modes.)
• A verified airlock back to your repo. The agent commits inside the sandbox; only its changes are pulled back over a dedicated channel, re-verified host-side (dual-hash, task binding, and a host-anchored attestation the guest cannot forge), and appended to your real repository. Nothing the guest produces reaches your repo unverified.
• Fail-closed routing. mgit run -- transparently routes the agent's execution into the task's sandbox; if the sandbox is unavailable it fails closed and never silently runs on the host.

This is mgit's first job: make running agents in auto mode safe by default. The version-control layer below is the airlock that lets contained work flow back out cleanly. The isolation boundary has been adversarially audited; see [Security model](#security-model).

Course-correction: a checkpointed working substrate

Contained execution gets work in safely. The other half is giving the agent a place to work that keeps your real repo clean and lets you undo a wrong decision without throwing away the good work around it.

Instead of crowding your git history with agent micro-commit noise, the agent commits each small, coherent step into an isolated .mgit store, a self-contained go-git repository that provably never touches your project's .git. That gives you a checkpointed timeline of the agent's reasoning that you can rewind, fork, and salvage from:

mgit work -> commit -> commit -> commit -> (wrong lib chosen) -> commit
                          \                        |
                           \                       +-- rollback: revert the wrong step (append-only)
                            \                              |
                             \                             +-- checkout -b: fork a new line, continue the right way
                              \                                          |
                               +-- restore the good bits from -----------+
                                   any earlier checkpoint
                                   (the old line stays preserved in history)
                                                  |
                                                  +-- squash -> land only the reviewed result

When a decision turns out wrong, you don't reprompt the agent to rewrite hundreds of lines from scratch:

1. Backtrack: mgit rollback reverts the wrong step's task as a new commit and restores the pre-task state in your working tree; nothing is deleted, and the wrong attempt stays in the history.
2. Fork: mgit checkout -b opens a new line, preserving the old attempt.
3. Salvage: mgit restore --all --commit returns the whole tree to any checkpoint (or a single file without --all), and mgit cherry-pick applies a still-good step from the old line, content and provenance both.
4. Squash: the corrected micro-commits land as one reviewable commit.

Micro-granularity earns its keep in-task (cheap course-correction plus a fine-grained review surface); the landed artifact is the squashed result. You can always see and undo exactly what the agent did: every step, including the abandoned line, stays in an append-only history for review.

An audit trail for agent work

When an agent's change breaks something weeks later, git blame tells you which commit; mgit tells you the story behind it. The store is append-only (rollbacks create revert commits, nothing is ever deleted), every commit carries its task and agent identity, and integrity is dual-hashed (SHA-1 for git compatibility, SHA-256 for tamper detection):

mgit audit --task-id PROJ-12     # who did what, when, in order (including rollbacks)
mgit log --task-id PROJ-12       # every micro-step behind the landed commit
mgit verify --task-id PROJ-12    # prove the recorded chain has not been tampered with

That turns incident forensics from archaeology into a query: trace a landed commit back to its task, the agent that worked it, and every intermediate step including abandoned attempts; scope a regression's blast radius by asking what else that task touched. The trail is available for as long as the .mgit store is retained alongside the repo, which is how HyperSwe deployments run it.

Installation

Homebrew (macOS / Linux):

brew install hyper-swe/tap/mgit

Go:

go install github.com/hyper-swe/mgit/cmd/mgit@latest

From source:

git clone https://github.com/hyper-swe/mgit.git && cd mgit && make build

Binary releases: pre-built binaries for Linux, macOS, and Windows (amd64 and arm64) are on GitHub Releases.

Everything above installs the mgit binary, which is all you need for the version-control workflow: init, worktrees, commit, log, squash, and landing by patch. The microVM sandbox (mgit run, mgit work --sandbox) is a separate, optional layer with its own prerequisites.

Enable the sandbox

The sandbox needs a second host binary, mgit-sandboxd, and a guest image. On Linux and macOS arm64, Homebrew and the release archives install mgit-sandboxd next to mgit automatically; you can also go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest.

• Linux requires KVM (/dev/kvm) and the firecracker binary on PATH.
• macOS requires Apple Silicon (arm64), macOS 13+; the release/brew daemon is code-signed with the virtualization entitlement (a go install-ed daemon is unsigned and must be signed locally).
• Windows and Intel macOS have no sandbox backend yet; core mgit runs without it.

The daemon boots a guest image (kernel + rootfs) that must be provisioned and pinned separately. The full walkthrough, platform prerequisites, and the guest-image story are in [docs/INSTALL-SANDBOX.md](docs/INSTALL-SANDBOX.md).

Without the sandbox, mgit is still a complete checkpointed working substrate. mgit run and mgit sandbox land are the only sandbox-gated commands; integrate a task's result by exporting its squash as a patch and applying it to your git:

mgit squash --task-id PROJ-12 --to-git | git apply   # or: git am

Commands

The everyday surface:

| Command | Description | |---------|-------------| | mgit init | Set mgit up alongside your existing git repo | | mgit work PATH --task-id ID [--sandbox --image REF] | Start an agent on a task: worktree + agent wiring + optional microVM | | mgit run -- | Run a command in the task's microVM (fail-closed; never on the host) | | mgit commit -m MSG | Create a task-tagged micro-commit (task ID auto-inherited in a worktree) | | mgit log --task-id ID | View a task's step-by-step history | | mgit rollback --task-id ID [--commit HASH] | Revert a task: an append-only revert commit that also restores the working tree | | mgit audit --task-id ID | Replay who did what, when, from the append-only audit trail | | mgit squash --task-id ID [--to-git] | Consolidate a task's micro-commits into one reviewable commit | | mgit sandbox land --task-id ID | Pull, host-verify, and land the sandbox's changes into your repo |

All commands support --json for structured output. mgit run and mgit sandbox land are the only sandbox-gated commands; see [Enable the sandbox](#enable-the-sandbox). Without a sandbox, land a task with mgit squash --task-id ID --to-git | git apply.

Core (init, commit, log, status, show, branch, config)

| Command | Description | |---------|-------------| | mgit init | Initialize a new mgit repository | | mgit commit --task-id ID | Create a task-tagged micro-commit | | mgit log [--task-id ID] | View commit history, optionally filtered by task | | mgit status | Show working tree status | | mgit show HASH | Display commit details | | mgit branch --task-id ID | Create a task branch | | mgit branch | List all branches | | mgit config get/set/list | Manage configuration |

Workflows (squash, rollback, verify, audit, export)

| Command | Description | |---------|-------------| | mgit squash --task-id ID [--to-git \| --to-main] | Consolidate micro-commits into one | | mgit rollback --task-id ID [--commit HASH] | Revert a task: an append-only revert commit that also restores the working tree (a step's hash resolves its task) | | mgit verify [--task-id ID] [--fix] | Verify commit chain and index integrity | | mgit audit [--task-id ID] [--since --until] | View the audit trail | | mgit export --task-id ID --format json\|git\|audit-log | Export task data |

Multi-agent (work, worktree)

| Command | Description | |---------|-------------| | mgit work PATH --task-id ID [--sandbox --image REF] | Start an agent on a task: task-bound worktree + agent-shell wiring + optional sandbox | | mgit worktree add PATH --task-id ID [--branch] | Create an isolated worktree without the agent-shell wiring | | mgit worktree list [--porcelain] | List active worktrees | | mgit worktree remove PATH [--force] | Remove a worktree | | mgit worktree prune [--dry-run] | Remove stale worktree metadata |

Sandbox / agent execution (run, sandbox launch/exec/shell/land/grants/image)

| Command | Description | |---------|-------------| | mgit run -- | Run a command inside the current worktree's task microVM (fail-closed) | | mgit sandbox launch --task-id ID --worktree PATH --image REF | Provision a sandbox for a task | | mgit sandbox exec --task-id ID -- | Execute one command in the task's sandbox | | mgit sandbox shell --task-id ID | Attach an interactive session (confined-agent mode) | | mgit sandbox land --task-id ID | Pull + host-verify + land the sandbox's changes | | mgit sandbox status ID / list / remove ID | Inspect or tear down sandboxes | | mgit sandbox grants --task-id ID / `grant --task-

…

Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: hyper-swe
• Source: hyper-swe/mgit
• License: Apache-2.0
• Homepage: https://github.com/hyper-swe/mgit#readme

Install and usage instructions live in the source repository linked above.