githugWe spent a week reading how coding agents actually connect to git hosts, and how the hosts are responding. The short version: the plumbing is not there, and the community forges are pulling up the ladder.
What changed in 2026
- Forgejo decided in March to prohibit AI-generated contributions entirely. Codeberg followed in July with terms that ban repositories mostly written by generative AI. SourceHut's terms from 10 September prohibit content written with, or facilitating, LLMs. Three of the values-driven forges now say no.
- GitHub shipped Agent HQ, per-contributor pull-request caps, and an
Agent-Logs-Urltrailer on every Copilot commit. It also said agentic traffic forced a 30x capacity redesign. None of the coding-agent features ship on Enterprise Server. - The Linux kernel made an
Assisted-by:trailer mandatory for AI-assisted patches and put full responsibility on the human who signs off. Fedora, Mesa, Kubernetes and Zephyr adopted the same trailer. Gentoo, NetBSD and QEMU ban AI code outright. Debian voted for "responsible use" with no disclosure mandate. - New entrants are all hosted-only: Cursor Origin (stacked PRs, agent-aware merge queue), Entire (regional mirrors so agents avoid origin rate limits, transcripts stored with commits), and API-only git stores like code.storage and Freestyle.
We scored the forges on the axis that forgejo.org/compare leaves out. The table is at /gateway/compare.
What agents need and do not get
Reading vendor docs for Copilot, Codex, Claude Code, Jules, Cursor and Devin side by side, the same gaps show up in every one:
- Identity. Copilot authors commits as a bot with a human co-author. Cursor commits as
cursor[bot]. Devin lets an admin choose. Claude Code adds a co-author trailer. Every vendor improvised, because the host offers nothing. A six-agent fleet sharing one user token hits GitHub's secondary rate limits as a single user and stalls for a quarter hour. - Provenance. The trailers exist, and no host reads them. Nobody can filter a review to "AI-written hunks no human has looked at".
- Policy. A 2026 study found agents fail to enforce human-approval rules on themselves. The rules have to live on the server, at push time.
- Volume. Agentic PRs wait 5.3x longer for a first review, and cross-agent PR pairs conflict 41.7% of the time. The merge queue, not the editor, is the bottleneck now.
The per-agent write-ups are here: Copilot coding agent, OpenAI Codex, Claude Code, Google Jules, Cursor cloud agents, Devin.
What we are building
Not a new place to host code. A gateway that sits between your agents and the remote you already use, hosted or as one container on your own box:
- one short-lived identity, budget and audit log per agent;
- policy checked at push (disclosure trailer, human sign-off on protected paths, tests, token budget) and reported back as a status check;
- provenance parsed and stored with every commit;
- an MCP front door so agents onboard themselves.
We are running it on githug's own repository first. If you run agents against a real repo and any of the above sounds familiar, ask for a beta invite and tell us where it hurts.
Related answers from githug
Researched live from GitHub, so they stay current: