The self-hosted forge for the age of coding agents.

exist.io is an open-source Git forge that runs entirely on infrastructure you control — one pure-Go binary, SQLite storage, no cloud dependency, no external services to babysit.

It treats coding agents as first-class citizens: a native MCP server with 35 tools, scoped capability leases, and autonomous pull-request review. Humans and agents hold real permissions — the agent gets a lease, not the keys to the kingdom.

OIDC and SAML single sign-on, SCIM 2.0 provisioning, OpenSSH and GPG commit verification, and official Terraform and Helm deployments — wire-compatible with the forge APIs your tooling already speaks.

One prompt. Your agent does the rest.

~/exist.io $

Bootstrap a self-hosted exist.io forge on this machine:
1. Download the latest existd release binary for this platform.
2. Run: existd bootstrap --email <you@example.com> --namespace <org>
3. Start the daemon (HTTP :8080, SSH :2222).
4. Create my first repository and give me the clone URL.
5. Register yourself as an MCP client at http://localhost:8080/mcp
   and verify the connection works.
Confirm each step before running the next, and tell me when it's done.

agent — ready ▮

Works with Claude Code, Cursor, and Cline — anything that speaks MCP.

119 REST operations · 35 MCP tools · 25 Go packages at 100% test pass · 137 frontend tests · Git LFS · SSH :2222 · zero cgo

SSH

OpenSSH

SAML

SCIM 2.0

What the forge does

Every piece of a modern Git platform, implemented in one hermetic daemon.

› Pull requests & 3-way merge Deterministic merge engine with squash, approval gates, required checks, and merge queues. ruleset policy engine

› Issues & threads SQLite-backed issue tracking with threaded comments, labels, and one-click agent triage. internal/app

› Releases Tagged binary distribution with checksums and draft publishing. cryptographically verified

› Webhooks HMAC-SHA256 signed delivery with attempt audit log and redelivery. per-event routing

› Primer-parity UI GitHub Primer-faithful interface: 6px squircles, 1px borders, contribution heatmaps. React 19 · Vite

› Contributions 52-week activity heatmaps across every namespace. live aggregation

Transports & storage

Two Git transports and a storage layer with no external dependencies.

› Smart-HTTP Pure-Go HTTP transport for authenticated clone, fetch, push. :8080

› Embedded SSH Standalone pure-Go SSH server — no host OpenSSH daemon required. :2222 · zero cgo

› Git LFS v1 Content-addressable storage with SHA-256 validation and file locking. /info/lfs/locks

› SQLite WAL Metadata, grants, PRs, rules, and SSO in one embedded database. modernc.org/sqlite

› Bare repositories go-git v6 against on-disk bare repos — packfiles, trees, refs. go-git v6

› Portable builds CGO-free binaries for every platform you run. linux/amd64 · arm64 · darwin/arm64 · windows/amd64

Security & verification

Cryptographic proof of origin and policy enforcement at the push boundary.

› Commit signatures Real-time OpenSSH SIGSPEC and GPG (RFC 4880) parsing with fingerprint matching. audit popover

› Pre-receive hook Blocks pushed secrets, private keys, and API tokens before they land. internal/security

› Rulesets Approvals, required checks, CIDR allowlists, and SSH certificate authorities. policy engine

› Audit log Immutable compliance record of administrative actions. internal/audit

› Archive freeze Archived repos reject all writes over HTTP, SSH, issues, PRs, and releases. 403 · exit 1

› Deploy keys Per-repository UUID isolation; read-only keys abort receive-pack. strict isolation

Enterprise identity & IaC

The integration surface your platform team expects from a forge.

› Single sign-on OIDC and SAML 2.0 login with metadata endpoints. /api/v1/auth/sso/*

› SCIM 2.0 RFC 7644 user provisioning with automated offboarding revocation. /scim/v2/Users

› Terraform / OpenTofu Official provider managing namespaces, repos, and rulesets declaratively. deploy/terraform-provider-exist

› Kubernetes Helm Production chart with dual-port service and non-root security contexts. deploy/helm/exist-enterprise

› Prometheus Metrics exposition with ServiceMonitor for Grafana. /metrics

› Health probes Kubernetes liveness and readiness endpoints. /healthz

Your agents hold permissions

exist.io treats autonomous coding agents as first-class citizens — connected by MCP, bounded by capability leases, and put to work as reviewers.

Point your agent at the forge

exist.io speaks the Model Context Protocol natively. Add it to your agent configuration file (Claude Desktop, Cursor, Cline) and the agent gets repository browsing, symbol search, and pull-request workflows over JSON-RPC 2.0.

mcp.json

{
  "mcpServers": {
    "exist-io": {
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Bearer <your-token>"
      }
    }
  }
}

Untrusted agents: point the URL at /mcp/readonly — any mutation attempt is blocked at the protocol layer.

Illustrative — lease issuance drawer

Issue capability lease

agent: claude-code · session 8f2a
ref prefix: refs/heads/agent/*
expires: 15m
signature: HMAC-SHA256 · a1b2…c3d4

One daemon, three layers

existd is a single hermetic binary: clients and agents reach it over HTTP and SSH, policy and transports run in-process, and all state stays on local disk.

clients · agents · automation
  git :8080     git :2222     agents :8080/mcp
  lfs           web ui :3000  idp oidc/saml
  terraform     scim 2.0

            |
            v

existd daemon  (pure go · zero cgo)
  gateway · ssh · smart-http · lfs cas
  signatures · mcp (35 tools) · rest (119)
  federation · policy · merge

            |
            v

hermetic local storage
  sqlite wal      bare git repos     lfs cas
  metadata        go-git v6          sha-256
▮

┌──────────────────────────────────────────────┐
│ CLIENTS · AGENTS · AUTOMATION                │
│  git :8080    git :2222    agents /mcp      │
│  lfs          ui :3000     idp oidc/saml    │
│  terraform    scim 2.0                       │
└──────────────────────────────────────────────┘
                    │
                    v
┌──────────────────────────────────────────────┐
│ EXISTD DAEMON  (pure go · zero cgo)          │
│ gateway :8080 · ssh :2222 · smart-http       │
│ lfs cas · signatures · mcp 35 tools          │
│ rest 119 · federation · policy · merge       │
└──────────────────────────────────────────────┘
                    │
                    v
┌──────────────────────────────────────────────┐
│ HERMETIC LOCAL STORAGE                       │
│ sqlite wal · bare git repos · lfs cas        │
└──────────────────────────────────────────────┘
▮

┌────────────────────────────────────────────────────────────────┐
│ CLIENTS · AGENTS · AUTOMATION                                  │
│  git (smart-http :8080)   git (ssh :2222)   ai agents (mcp)   │
│  git lfs                  web ui (:3000)    idp (oidc/saml)    │
│  terraform / helm         scim 2.0 sync                      │
└────────────────────────────────────────────────────────────────┘
                              │
                              v
┌────────────────────────────────────────────────────────────────┐
│ EXISTD DAEMON  (pure go · zero cgo · single binary)            │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐ │
│ │ http gateway │ │ pure-go ssh  │ │ signature engine         │ │
│ │ :8080        │ │ :2222        │ │ openssh sigspec · gpg    │ │
│ └──────────────┘ └──────────────┘ └──────────────────────────┘ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐ │
│ │ smart-http   │ │ lfs cas      │ │ mcp json-rpc  (35 tools) │ │
│ │ transport    │ │ engine       │ │ /mcp · /mcp/readonly     │ │
│ └──────────────┘ └──────────────┘ └──────────────────────────┘ │
│ ┌──────────────┐ ┌──────────────┐ ┌──────────────────────────┐ │
│ │ rest api     │ │ federation   │ │ policy engine            │ │
│ │ /v1/origin   │ │ scim · sso   │ │ merge · rulesets · cidr  │ │
│ │ 119 ops      │ │              │ │                          │ │
│ └──────────────┘ └──────────────┘ └──────────────────────────┘ │
└────────────────────────────────────────────────────────────────┘
                              │
                              v
┌────────────────────────────────────────────────────────────────┐
│ HERMETIC LOCAL STORAGE                                         │
│ ┌──────────────────┐ ┌──────────────────┐ ┌──────────────────┐ │
│ │ sqlite wal       │ │ bare git repos   │ │ lfs content-     │ │
│ │ metadata · grants│ │ go-git v6        │ │ addressable      │ │
│ │ prs · rules · sso│ │ packfiles · refs │ │ sha-256 cas      │ │
│ └──────────────────┘ └──────────────────┘ └──────────────────┘ │
└────────────────────────────────────────────────────────────────┘
▮

Service surface

:3000 Web UI Space UI developer dashboard & admin console

:2222 SSH Pure-Go embedded SSH clone, fetch, push

:8080 Smart-HTTP HTTP clone, fetch, push

/info/lfs LFS Git LFS v1 batch and object API

/v1/origin REST Forge REST API — 119 operations

/scim/v2/Users SCIM RFC 7644 user provisioning

/api/v1/auth/sso/* OIDC/SAML Enterprise SSO login and metadata

/mcp MCP Read-write MCP endpoint — 35 tools

/mcp/readonly MCP Sandboxed read-only MCP endpoint

/metrics Prometheus Metrics exposition

/healthz HTTP Liveness and readiness probes

Built clean

25 Go packages passing at 100% across unit and integration suites.
137 frontend tests across 37 Vitest suites, zero failures.
CGO_ENABLED=0 builds verified on linux/amd64, linux/arm64, darwin/arm64, windows/amd64.
Zero-mock production integrity: the UI never flashes demo data at a live cluster — the same rule this page holds itself to.

Honest roadmap

Phases 1–5 shipped: core forge & MCP, enterprise protocols & IaC, Space UI, agent review & leases, GitHub Primer parity.
Phase 6 next: multi-region active-active Raft replication and S3 object sharding.

Deploy in 5 minutes

Three commands to a running forge — or skip the manual path and hand the prompt at the top of this page to your agent.

$ go build -o bin/existd ./cmd/existd

$ ./bin/existd bootstrap \
    --email admin@corp.exist.io \
    --namespace acme \
    --data-dir ./data

$ ./bin/existd

Prefer containers? docker compose -f docker-compose.enterprise.yml up -d runs the full stack.

★ Star on GitHub Read the docs