Let your team use AI agents, with your eyes open.
Your developers are already running agents. Patchkin gives you a record of what they did, rules that are checked instead of hoped for, and a clear view of what it costs, without reading anyone’s code or prompts.
Different people need different answers.
Engineering lead
- See which agents run where, and how much of each change is AI-assisted
- One set of standards for every tool, kept in sync on every machine
- Know when agents sit stuck waiting for a person
Security and compliance
- Secrets flagged or blocked before they are pushed, in the agent’s own commits too
- An inventory of the MCP servers and instruction files each machine uses, with hidden-text checks
- An approved list of MCP servers, and findings for the rest
- Single sign-on, user provisioning and an activity log
Finance and operations
- Cost and tokens by tool, person and repository
- Cost per merged pull request, from your git host
- Counts only: no prompts, no responses, no code
Platform and IT
- A small program per machine, outbound only, with one-click updates
- Roles for owners, admins and developers, and teams within an organization
- A merge check that works with GitHub, GitLab, Bitbucket, Azure DevOps and Jenkins
The answers, on one screen.
Findings show what happened, where and who, with one click to acknowledge or dismiss. Nothing in them is a secret value or a line of code.
- Findings by severity, with the repository, commit and person
- AI-assisted work by tool and by repository
- The MCP servers and instruction files in use, with an approved list
- Cost by day, model and tool
Know what it costs before the invoice does.
Cost and token counts come from the tools that report them. Cost per merged pull request uses merges from your connected git host.
- By tool, person and repository over a period you choose
- Claude Code sessions started in Patchkin report on their own
- Other tools are not supported yet
- Counts only: never prompts, responses or code
Straight answers.
| You ask | Patchkin gives you |
|---|---|
| Who is using AI agents, and on what? | A list of sessions by person, machine, tool and repository. |
| How much of our code is written by AI? | AI-assisted commits and lines, recognised from the marks tools add to commits and from sessions started in Patchkin. A tool that leaves no mark is only counted when it runs through Patchkin, and the product says so. |
| Did an agent push a secret? | A critical finding with the kind of secret and where it was. The value is never stored. |
| Do AI changes get reviewed? | A rule that a pull request with agent work needs an approval from someone other than its author, checked against your git host. |
| Did the agent test its work? | Flags for source changes without tests, and optional test or lint runs when a session ends, recording pass or fail only. |
| What does it cost us? | Cost and tokens by tool, person and repository, and cost per merged pull request. |
| What are agents connected to? | The MCP servers and instruction files in use on each machine, with changes and hidden text flagged. |
| Can we enforce this? | Yes, in two places: git hooks on paired machines, and a required check in your pipeline. The pipeline check is the one that cannot be skipped, so that is the one to require. |
Start gently. Tighten when you are ready.
Pair and observe
Pair a few machines. Turn governance on in observe mode, which only records. Tell your developers what is recorded: the product shows them the notice.
Standards and visibility
Publish your first standards, such as tests required and commit conventions. Look at the findings and costs. Adjust the noisy rules.
Enforce what matters
Connect your git host and add the merge check. Set the few rules you trust to block, such as secrets and force pushes.
Governance people can live with.
Rules that feel like surveillance get worked around. Patchkin is built to avoid that.
A notice, not a secret
You must confirm you have told people what is recorded, and developers see that notice.
Totals by default
Per-person views are off unless your organization turns them on. Developers always see their own activity.
Records expire
Set how many days records are kept. Older ones are deleted automatically.
Questions from the company side.
Do we need to buy into one AI vendor?
No. Patchkin is built to work across tools, so your team can mix them and your rules and records stay in one place.
How do we enforce rules developers can bypass locally?
Hooks on paired machines stop many problems early, but anything run outside Patchkin can skip them. That is why the real gate is a required check in your pipeline. We recommend you start with observe mode, then add the required check.
What about developers who do not install it?
Pull requests still pass through your git host, so the merge check and the AI-assisted review rule apply to their work too, based on commit marks. Visibility on their machines needs the program installed.
Single sign-on?
OpenID Connect and SAML sign-in are supported, with SCIM user provisioning, two-factor sign-in and an activity log.
Where is it hosted?
Ask us about your requirements and we will tell you what is available today.
Want to see it with your own team?
Tell us about your setup. We will help you pair a few machines and turn governance on in observe mode.