# Mgit > Sandboxed version control for autonomous coding agents: an agent's untrusted code runs in a per-task microVM, its work stays in an isolated, append-only store, and only the reviewed result lands in your git. Part of HyperSwe. - **Type:** MCP server - **Install:** `agentstack add mcp-hyper-swe-mgit` - **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior - **Seller:** [hyper-swe](https://agentstack.voostack.com/s/hyper-swe) - **Installs:** 0 - **Category:** [AI & ML](https://agentstack.voostack.com/c/ai-and-ml) - **Latest version:** 0.1.0 - **License:** Apache-2.0 - **Upstream author:** [hyper-swe](https://github.com/hyper-swe) - **Source:** https://github.com/hyper-swe/mgit - **Website:** https://github.com/hyper-swe/mgit#readme ## Install ```sh agentstack add mcp-hyper-swe-mgit ``` Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent. ## About mgit Sandboxed version control for autonomous coding agents. Part of the HyperSwe suite. **mgit is a sandboxed, version-controlled workspace for autonomous coding agents.** It runs an agent's untrusted code (dependency installs, builds, and tests) in a disposable per-task microVM, and records the agent's work in an isolated, append-only store separate from the project's git. Each change is tagged to the task that produced it, and only the reviewed, squashed result is landed into the repository. Coding agents increasingly run unattended, installing packages and executing build and test commands as they iterate. mgit makes that safe on a real codebase: execution is contained to a throwaway VM with access limited to what the task needs, the project's git is never modified directly, and every step the agent takes is preserved as a traceable, reviewable record. ### What you get - 🛡️ **Sandboxed execution**: installs, builds, and tests run in an isolated VM, never on the host. - 🔒 **Default-deny networking**: the agent reaches only what the task needs; your secrets and network stay unreachable. - ✅ **Verified land**: only changes that pass host-side re-verification (dual-hash, task binding, host-anchored attestation) reach your repo. - 🧬 **Isolated, clean history**: intermediate work stays in mgit's own store; only the squashed result lands in your git, and you can roll back or branch from any step. - 📜 **An audit trail you can stand behind**: append-only, task-tagged, dual-hash-verified history; trace any landed change back to the task, the agent, and every step that produced it. - 🤝 **Multi-agent parallelism**: per-task worktrees and per-task sandboxes let agents work different tasks side by side without collisions. - 🔌 **Fits what you have**: runs over your existing git repo without touching `.git`, stays in sync with it automatically, and wires into Claude Code, Codex, and Cursor with one command. > *"Six tickets, zero conflicts, and `squash --to-git` round-trips byte-for-byte. The microVM sandbox is the one capability plain git worktrees fundamentally lack."* > Independent team that integrated their own project through mgit ## Quick start Two minutes, on top of your existing repo. Nothing to migrate; your git is left untouched. Install with Homebrew (macOS / Linux): ```bash brew install hyper-swe/tap/mgit ``` or with Go: ```bash go install github.com/hyper-swe/mgit/cmd/mgit@latest ``` Start an agent on a task. `mgit work` provisions a task-bound worktree and wires the agent's harness; with `--sandbox` it also launches the task's microVM. The `--sandbox` leg requires [enabling the sandbox](#enable-the-sandbox) first (the daemon and a guest image); everything else in this walkthrough works without it. ```bash mgit init # set mgit up alongside your existing git repo mgit work ./wt-PROJ-12 --task-id PROJ-12 \ --sandbox --image base@sha256: --network allowlist --allow registry.npmjs.org ``` Inside that worktree, the agent's commands execute in the guest VM, and each coherent step becomes a task-tagged micro-commit: ```bash cd ./wt-PROJ-12 mgit run -- npm install # runs in the microVM, never on the host (fail-closed) mgit commit -m "add validation helper" # task ID auto-inherited from the worktree mgit run -- npm test mgit commit -m "wire validation into handler" ``` Review, squash, and land: ```bash mgit log --task-id PROJ-12 --oneline # the step-by-step history is the review surface mgit diff --task-id PROJ-12 mgit squash --task-id PROJ-12 # one reviewable commit for the whole task mgit sandbox land --task-id PROJ-12 # host-verify and append into your real repo ``` If a decision turns out wrong mid-task, [backtrack, fork, and salvage](#course-correction-a-checkpointed-working-substrate) instead of rewriting from scratch. Agent harnesses (Claude Code, Codex, Cursor) are wired automatically by `mgit work`, so all of this is transparent to the agent. > **Worktree notes.** An mgit worktree is **not** a git repo (no `.git`); integrate by exporting the squash as a patch (`mgit squash --task-id --to-git | git apply`), never by running `git` inside the worktree. Gitignored build artifacts (e.g. an embedded `web/dist`) are not seeded into worktrees; list them in `.mgit/seed-include` (one glob per line) to carry them in. Why · Containment · Course-correction · Audit · Install · Commands · Security · Scope --- ## Why this exists An autonomous agent working a task routinely executes code no one has read: a single `npm install` runs the install hooks of hundreds of transitive dependencies, and supply-chain attacks on public registries are reported weekly. When the agent runs directly on your machine, that code runs with your privileges, alongside your credentials and every other repository you have, and there is no version control for a leaked key. Containment has to happen before execution, not after. mgit provides that containment, and pairs it with a working history built for how agents actually work: many small steps, some of them wrong, that need to stay reviewable and reversible without polluting the project's git. ## How containment works mgit runs the agent's untrusted execution inside a **per-task microVM** (Firecracker on Linux/KVM; Apple Virtualization.framework on macOS, running a Linux guest), so the blast radius of a compromised package is a disposable VM, not your host: - **Hardware-isolated execution.** Installs, builds, and tests run in the guest VM. The host filesystem, your other repos, and your credentials are never mounted in. The microVM boundary is the same one cloud providers trust to isolate tenants. - **Default-deny egress.** The guest gets no direct network route. A per-task allowlist permits only the destinations a task actually needs (e.g. your package registry), enforced at the IP/flow layer by a host-side proxy. Raw-IP, QUIC, DNS-tunnelling, and metadata-endpoint tricks are denied. (`none` / `allowlist` / `open` modes.) - **A verified airlock back to your repo.** The agent commits inside the sandbox; only its changes are pulled back over a dedicated channel, re-verified host-side (dual-hash, task binding, and a host-anchored attestation the guest cannot forge), and appended to your real repository. Nothing the guest produces reaches your repo unverified. - **Fail-closed routing.** `mgit run -- ` transparently routes the agent's execution into the task's sandbox; if the sandbox is unavailable it fails closed and never silently runs on the host. This is mgit's first job: make running agents in auto mode safe by default. The version-control layer below is the airlock that lets contained work flow back out cleanly. The isolation boundary has been adversarially audited; see [Security model](#security-model). ## Course-correction: a checkpointed working substrate Contained execution gets work *in* safely. The other half is giving the agent a place to **work** that keeps your real repo clean and lets you undo a wrong decision without throwing away the good work around it. Instead of crowding your git history with agent micro-commit noise, the agent commits each small, coherent step into an **isolated `.mgit` store**, a self-contained go-git repository that provably never touches your project's `.git`. That gives you a checkpointed timeline of the agent's reasoning that you can rewind, fork, and salvage from: ``` mgit work -> commit -> commit -> commit -> (wrong lib chosen) -> commit \ | \ +-- rollback: revert the wrong step (append-only) \ | \ +-- checkout -b: fork a new line, continue the right way \ | +-- restore the good bits from -----------+ any earlier checkpoint (the old line stays preserved in history) | +-- squash -> land only the reviewed result ``` When a decision turns out wrong, you don't reprompt the agent to rewrite hundreds of lines from scratch: 1. **Backtrack**: `mgit rollback` reverts the wrong step's task as a new commit and restores the pre-task state in your working tree; nothing is deleted, and the wrong attempt stays in the history. 2. **Fork**: `mgit checkout -b` opens a new line, preserving the old attempt. 3. **Salvage**: `mgit restore --all --commit ` returns the whole tree to any checkpoint (or a single file without `--all`), and `mgit cherry-pick` applies a still-good step from the old line, content and provenance both. 4. **Squash**: the corrected micro-commits land as one reviewable commit. Micro-granularity earns its keep *in-task* (cheap course-correction plus a fine-grained review surface); the landed artifact is the squashed result. **You can always see and undo exactly what the agent did**: every step, including the abandoned line, stays in an append-only history for review. ## An audit trail for agent work When an agent's change breaks something weeks later, `git blame` tells you which commit; mgit tells you the story behind it. The store is append-only (rollbacks create revert commits, nothing is ever deleted), every commit carries its task and agent identity, and integrity is dual-hashed (SHA-1 for git compatibility, SHA-256 for tamper detection): ```bash mgit audit --task-id PROJ-12 # who did what, when, in order (including rollbacks) mgit log --task-id PROJ-12 # every micro-step behind the landed commit mgit verify --task-id PROJ-12 # prove the recorded chain has not been tampered with ``` That turns incident forensics from archaeology into a query: trace a landed commit back to its task, the agent that worked it, and every intermediate step including abandoned attempts; scope a regression's blast radius by asking what else that task touched. The trail is available for as long as the `.mgit` store is retained alongside the repo, which is how HyperSwe deployments run it. ## Installation **Homebrew** (macOS / Linux): ```bash brew install hyper-swe/tap/mgit ``` **Go**: ```bash go install github.com/hyper-swe/mgit/cmd/mgit@latest ``` **From source**: ```bash git clone https://github.com/hyper-swe/mgit.git && cd mgit && make build ``` **Binary releases**: pre-built binaries for Linux, macOS, and Windows (amd64 and arm64) are on [GitHub Releases](https://github.com/hyper-swe/mgit/releases). Everything above installs the `mgit` binary, which is all you need for the version-control workflow: init, worktrees, commit, log, squash, and landing by patch. The microVM sandbox (`mgit run`, `mgit work --sandbox`) is a separate, optional layer with its own prerequisites. ### Enable the sandbox The sandbox needs a second host binary, `mgit-sandboxd`, and a guest image. On Linux and macOS arm64, Homebrew and the release archives install `mgit-sandboxd` next to `mgit` automatically; you can also `go install github.com/hyper-swe/mgit/cmd/mgit-sandboxd@latest`. - **Linux** requires KVM (`/dev/kvm`) and the `firecracker` binary on `PATH`. - **macOS** requires Apple Silicon (arm64), macOS 13+; the release/brew daemon is code-signed with the virtualization entitlement (a `go install`-ed daemon is unsigned and must be signed locally). - **Windows and Intel macOS** have no sandbox backend yet; core mgit runs without it. The daemon boots a guest image (kernel + rootfs) that must be provisioned and pinned separately. The full walkthrough, platform prerequisites, and the guest-image story are in [docs/INSTALL-SANDBOX.md](docs/INSTALL-SANDBOX.md). **Without the sandbox**, mgit is still a complete checkpointed working substrate. `mgit run` and `mgit sandbox land` are the only sandbox-gated commands; integrate a task's result by exporting its squash as a patch and applying it to your git: ```bash mgit squash --task-id PROJ-12 --to-git | git apply # or: git am ``` ## Commands The everyday surface: | Command | Description | |---------|-------------| | `mgit init` | Set mgit up alongside your existing git repo | | `mgit work PATH --task-id ID [--sandbox --image REF]` | Start an agent on a task: worktree + agent wiring + optional microVM | | `mgit run -- ` | Run a command in the task's microVM (fail-closed; never on the host) | | `mgit commit -m MSG` | Create a task-tagged micro-commit (task ID auto-inherited in a worktree) | | `mgit log --task-id ID` | View a task's step-by-step history | | `mgit rollback --task-id ID [--commit HASH]` | Revert a task: an append-only revert commit that also restores the working tree | | `mgit audit --task-id ID` | Replay who did what, when, from the append-only audit trail | | `mgit squash --task-id ID [--to-git]` | Consolidate a task's micro-commits into one reviewable commit | | `mgit sandbox land --task-id ID` | Pull, host-verify, and land the sandbox's changes into your repo | All commands support `--json` for structured output. `mgit run` and `mgit sandbox land` are the only sandbox-gated commands; see [Enable the sandbox](#enable-the-sandbox). Without a sandbox, land a task with `mgit squash --task-id ID --to-git | git apply`. Core (init, commit, log, status, show, branch, config) | Command | Description | |---------|-------------| | `mgit init` | Initialize a new mgit repository | | `mgit commit --task-id ID` | Create a task-tagged micro-commit | | `mgit log [--task-id ID]` | View commit history, optionally filtered by task | | `mgit status` | Show working tree status | | `mgit show HASH` | Display commit details | | `mgit branch --task-id ID` | Create a task branch | | `mgit branch` | List all branches | | `mgit config get/set/list` | Manage configuration | Workflows (squash, rollback, verify, audit, export) | Command | Description | |---------|-------------| | `mgit squash --task-id ID [--to-git \| --to-main]` | Consolidate micro-commits into one | | `mgit rollback --task-id ID [--commit HASH]` | Revert a task: an append-only revert commit that also restores the working tree (a step's hash resolves its task) | | `mgit verify [--task-id ID] [--fix]` | Verify commit chain and index integrity | | `mgit audit [--task-id ID] [--since --until]` | View the audit trail | | `mgit export --task-id ID --format json\|git\|audit-log` | Export task data | Multi-agent (work, worktree) | Command | Description | |---------|-------------| | `mgit work PATH --task-id ID [--sandbox --image REF]` | Start an agent on a task: task-bound worktree + agent-shell wiring + optional sandbox | | `mgit worktree add PATH --task-id ID [--branch]` | Create an isolated worktree without the agent-shell wiring | | `mgit worktree list [--porcelain]` | List active worktrees | | `mgit worktree remove PATH [--force]` | Remove a worktree | | `mgit worktree prune [--dry-run]` | Remove stale worktree metadata | Sandbox / agent execution (run, sandbox launch/exec/shell/land/grants/image) | Command | Description | |---------|-------------| | `mgit run -- ` | Run a command inside the current worktree's task microVM (fail-closed) | | `mgit sandbox launch --task-id ID --worktree PATH --image REF` | Provision a sandbox for a task | | `mgit sandbox exec --task-id ID -- ` | Execute one command in the task's sandbox | | `mgit sandbox shell --task-id ID` | Attach an interactive session (confined-agent mode) | | `mgit sandbox land --task-id ID` | Pull + host-verify + land the sandbox's changes | | `mgit sandbox status ID` / `list` / `remove ID` | Inspect or tear down sandboxes | | `mgit sandbox grants --task-id ID` / `grant --task- … ## Source & license This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code. - **Author:** [hyper-swe](https://github.com/hyper-swe) - **Source:** [hyper-swe/mgit](https://github.com/hyper-swe/mgit) - **License:** Apache-2.0 - **Homepage:** https://github.com/hyper-swe/mgit#readme Install and usage instructions live in the source repository linked above. ## Pricing - **Free** — Free ## Security capabilities Automated source analysis of v0.1.0 — what this tool can access: - **Network access:** no - **Filesystem access:** no - **Shell / process execution:** no - **Environment & secrets:** no - **Dynamic code execution:** no *"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.* ## Versions - **0.1.0** — security scan: passed — Imported from the upstream source. ## Links - Listing page: https://agentstack.voostack.com/l/mcp-hyper-swe-mgit - Seller: https://agentstack.voostack.com/s/hyper-swe - Browse the marketplace: https://agentstack.voostack.com/browse --- Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.