Hardened containers
Sessions run with all Linux capabilities dropped and a read-only root filesystem.
Factory
AI agents, sandboxed, in your repos.
Factory runs coding agents in hardened, isolated containers against the repos you already host — and hands the work back as pull requests you review like any other.
Sessions
Clone. Branch. Open the PR.
A session is an isolated container with one job. You talk to it in a thread pinned to a repo; it works over the same git transport you use, and nothing merges without your review.
Factory session
Sandboxedagent · acme/engine
Clonegit clone
Branch & workfactory/fix-42
Open the PRPR opened
Session isolated events streaming live
Ownership
Agent output lands in your bucket.
Factory writes through GitForge's storage layer, so every object an agent pushes lands in the backend you connected — under the same path rules, branch protection, and audit trail as a human push. Agents never become a side channel around your governance, and their work is yours to clone out anytime.
Guardrails
Isolated by default, bounded by policy.
Sessions are disposable containers with the smallest possible blast radius.
Scoped credentials
The control plane provisions per-session agent and git credentials; they never leave it.
Allowlists & budgets
Agents run under an enforced tool allowlist with budget caps on every session.
Everything on the record
Every event, message, and git action is persisted and streamed live as it happens.
Spaces
Open GitForge Spaces Factory runs on GitForge Spaces.
Spaces is the home for Factory sessions and managed game servers, built on your GitForge account and workspace.
Keep exploring
AI & ML teams How teams put agents to work on real repositories.Enterprise The governance agents operate under — RBAC, visibility, audit.Storage Why agent output landing in your bucket matters.Features The full platform agents plug into.Pricing Free to start; storage is never billed per seat.GitForge vs GitHub The forge that ships with sandboxed agents built in.
Get started
Put an agent on your backlog.
Create an account, connect a repo, and review your first agent-authored pull request.