Atlas / MCP servers / akira-tl / 中文

中文BLOCK

Name: 中文
Author: akira-tl

mcp/akira-tl/forgerelay

MCP server by akira-tl · Audited 2026-10-12

⚑ Report / re-scan Source ↗

Local development control plane for MCP coding agents.

Verdict

BLOCK

Grade

Trust score

62 /100

Exposed tools

36 32r · 3w · 1d

Transport

stdio · streamable-http

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Use MCP coding agents on the projects and tools already on your machine. 让 MCP 编程 Agent 直接使用你电脑上现有的项目和开发工具。

中文 · English

ForgeRelay 是一个运行在你自己机器上的 MCP Server。它解决的是一个很实际的问题:ChatGPT 这类 Host 会写代码,但默认碰不到你电脑上的项目、Shell 和 Git。

把 ForgeRelay 接上以后,Agent 就能直接在你现有的仓库里改文件、跑测试和构建、执行 Git、调用语言服务器,并继续使用你已经装好的工具链。项目不用搬到另一套工作目录,也不用为了这件事再换一套 Coding Agent。

安装

需要 Node.js >=22.19 <27、npm 和 Git。

npm install -g @akira-tl/forgerelay
forgerelay init
forgerelay serve

不想全局安装也可以:

npx @akira-tl/forgerelay init
npx @akira-tl/forgerelay serve

默认 MCP 地址:

http://127.0.0.1:7676/mcp

forgerelay init 会让你选择允许访问的项目目录,并生成 Owner password。第一次连接 MCP Host 时,用这个密码批准客户端。

检查当前实际生效的配置和 Shell:

forgerelay doctor
forgerelay config check
forgerelay config sources
forgerelay config explain

ForgeRelay 的 Config System 统一解析 User、Project 和机器私有 Project Local 配置,优先级是 runtime > project-local > project > user > built-in。External MCP、L

Read from source at commit 6d45f330f3a0OBSERVED · 2026-10-12

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add forgerelay --env FORGERELAY_DEBUG_OWNER_TOKEN=${FORGERELAY_DEBUG_OWNER_TOKEN} --env FORGERELAY_OAUTH_OWNER_TOKEN=${FORGERELAY_OAUTH_OWNER_TOKEN} --env GH_TOKEN=${GH_TOKEN} --env GITHUB_TOKEN=${GITHUB_TOKEN} -- npx -y @akira-tl/[email protected]

claude-desktop

{
  "mcpServers": {
    "forgerelay": {
      "command": "npx",
      "args": [
        "-y",
        "@akira-tl/[email protected]"
      ],
      "env": {
        "FORGERELAY_DEBUG_OWNER_TOKEN": "${FORGERELAY_DEBUG_OWNER_TOKEN}",
        "FORGERELAY_OAUTH_OWNER_TOKEN": "${FORGERELAY_OAUTH_OWNER_TOKEN}",
        "GH_TOKEN": "${GH_TOKEN}",
        "GITHUB_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}

Exposed tools (36)

32 read · 3 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`artifact.download`	write	Save one Host-native file into a workspace-relative destination without overwriting.
`artifacts-review`	write	Native artifact transfer and aggregate change review.
`batch-execution`	read	One-call execution of multiple independent ForgeRelay core operations.
`batch.execute`	write	Execute multiple independent ForgeRelay core operations in one Agent interaction.
`claude`	read	A profile that shadows the raw provider.
`code-intelligence`	read	Read-only semantic code navigation backed by external Language servers.
`code.intelligence`	read	Read semantic code information and, when explicitly enabled by the user, manage ForgeRelay-owned Language Servers for this instance.
`direct_image`	read
`double_image`	read
`echo_text`	read
`fail`	read
`fixture_tool`	read	fixture
`helper`	read	Valid helper.
`hidden-path-skill`	read	Loads without exposing its filesystem path.
`hooks.check`	read	Validate the active ForgeRelay Hook configuration for this workspace.
`host-integration`	read	OAuth, public endpoint, stale Host metadata, and MCP App debugging.
`http_echo`	read
`legacy-only`	read	Legacy user profile.
`lifecycle-hooks`	read	Hook events, blocking, reports, and configuration.
`malformed_image`	read
`mcp.external`	read	Discover and call tools from user-configured external MCP servers through the ForgeRelay Capability gateway.
`modern_echo`	read
`path_only`	read
`resource_only`	read
`review.changes`	read	Review accumulated workspace changes from the Git-backed review checkpoint.
`reviewer`	read	Review changes.
`shell-processes`	read	Long-running bash processes, processId interaction, PTY, and platform edges.
`subagent.session`	read	Delegate explicit work to provider-backed Subagent Sessions in the current Execution Workspace; disclose delegation and verify returned results before presenting them as final.
`subagents`	read	Local subagent delegation and session follow-up.
`tdd`	read	Test-driven development
`unsupported_image`	read
`url_only`	read
`workspace-tasks`	read	Persistent Task Lists owned by the current Workspace.
`workspace.checkpoint`	destructive	Create, list, inspect, safely restore, or delete immutable Git-backed checkpoints owned by the current persistent Workspace.
`workspace.recovery`	read	Inspect or safely repair the current managed-worktree Workspace when ForgeRelay can prove the surviving managed branch and execution backing ownership.
`workspace.tasks`	read	Maintain persistent Task Lists owned by the current Workspace.

Trust audit

BLOCKgrade D · trust 62/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	WARN
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (6 observation(s))
Network: declared (6 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found

Findings (25)

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

src/ui/review/heavy-payload.tsx

heavy-payload.tsx

Why it matters. member named after an attack tool

Fix. remove or justify

HIGHInventory / provenance · inv.suspicious_name · CWE-1104

src/ui/review/review-payload.tsx

review-payload.tsx

Why it matters. member named after an attack tool

Fix. remove or justify

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/cli/config/inspect.test.ts:306

const secret = "EXPLAIN_SECRET_SENTINEL";

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/cli/config/migrate.test.ts:37

const secret = "MIGRATION_SECRET_SENTINEL";

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/cli/system/status.test.ts:77

token: "system-status-active-token-00000000",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/cli/system/status.test.ts:89

token: "system-status-stale-token-00000000",

MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321

src/runtime/config/external-mcp-registry.test.ts:118

const secret = "resolved-secret-sentinel";

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

workspace.checkpoint

Why it matters. 1 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59

src/lsp/code-intelligence.server.test.ts:18

assert.equal(languageServerCommandRequiresShell("/usr/local/bin/server.cmd", "darwin"), false);

LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59

src/mcp/server/operations/filesystem.test.ts:696

await symlink("/etc/hosts", escapedPath);

LOWFilesystem / path · fs.system_paths · CWE-22, CWE-59

src/mcp/server/operations/filesystem.test.ts:722

arguments: { workspaceId, path: "/etc/hosts" },

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/config/schema.mjs:6

import { CONFIG_DEFINITION_CATALOG } from "../../src/runtime/config/definition/catalog.ts";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/config/schema.mjs:7

import { generateConfigSchemaFiles } from "../../src/runtime/config/definition/schema.ts";

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/debug/accept/media.mjs:41

new URL("../../../src/mcp/operations/external-mcp/test-fixtures/external-mcp-server.mjs", import.meta.url),

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/debug/host/run.sh:4

repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)"

LOWFilesystem / path · fs.traversal · CWE-22, CWE-59

scripts/debug/traffic/run.sh:4

cd "$(dirname "$0")/../../.."