alongkornonline2019-forgeCAUTION
Forge Engine MCP connector — the MIT-licensed Forge Runtime CLI (@forgeengine/cli) and registry manifest. Forge is the living plan AI coding agents read before they build and report back to, with every change reviewed before it lands.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://www.npmjs.com/package/@forgeengine/cli) [](./LICENSE) [](https://nodejs.org/) [](https://registry.modelcontextprotocol.io/)
Many agents. One plan. No mess.
Forge Engine is the living plan for teams that build software with AI coding agents. Agents read the design over MCP and build in parallel — claiming tasks so work never overlaps, checking what breaks before they change it, and reporting back what's actually built — in a structured plan anyone on the team can read and question, coder or not. A markdown file works for one dev; a team needs Forge.
🌐 [forgeengine.app](https://forgeengine.app/)
See a real design in 10 seconds, without installing anything. A Forge project can publish one public link that serves its whole design as plain text — paste it into an AI chat and the assistant answers over the real thing. See Read a design with zero setup.
What's in this repository. This is the public home of Forge's MCP connector: the source of the Forge Runtime CLI (@forgeengine/cli, MIT) and the registry manifest (server.json). The Forge application and its hosted MCP server are developed in a separate private repository — so this repo is the part that runs on your machine, published openly precisely because it is the part that holds your token. See Security & privacy.
Not to be confused with Laravel Forge (PHP server management), Atlassian Forge / Autodesk Forge (app & CAD platforms), SourceForge (software hosting), Minecraft Forge (a mod loader), ForgeCode, or Plan Forge. In the context of MCP and AI codin
e9550b86ae3aOBSERVED · 2026-10-14Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add cli --env FORGE_TOKEN=${FORGE_TOKEN} -- npx -y @forgeengine/[email protected]{
"mcpServers": {
"cli": {
"command": "npx",
"args": [
"-y",
"@forgeengine/[email protected]"
],
"env": {
"FORGE_TOKEN": "${FORGE_TOKEN}"
}
}
}
}Trust audit
CAUTIONgrade B · trust 89/100 Install with care. The audit found things worth knowing before you trust its output.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (2 observation(s))
- Shell
- none-observed
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (6)
console.log(` Token stored at ${paths().token} (0600).`);console.log(`Logged out — local token removed (${paths().token}).`);@modelcontextprotocol/sdk
open source — you can read every line that touches your credentials (it's under
`config.json`. Token access goes through one seam, so an OS-keychain backend can
Gates applied: no_behavioural_pass.
e9550b86ae3afull audit observations/trust-audit/mcp-server/alongkornonline2019__forge-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-14 | e9550b86ae3a | CAUTION | B | 89 | first audit |
Questions
What is the alongkornonline2019-forge MCP server?
Forge Engine MCP connector — the MIT-licensed Forge Runtime CLI (@forgeengine/cli) and registry manifest. Forge is the living plan AI coding agents read before they build and report back to, with every change reviewed before it lands.
Is alongkornonline2019-forge safe to connect to an agent?
With care. The audit graded it B (89/100) and found 6 things worth knowing before you trust this server, listed below with the exact line each was found on.
What credentials does alongkornonline2019-forge need?
It reads FORGE_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does alongkornonline2019-forge run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @forgeengine/cli at 0.3.1.
How current is this page?
The grade is for one exact copy of the source (e9550b86ae3a), read on 2026-10-14. The repository is watched and re-audited when it changes.