MCP Observatory
2m ago Tracked 55,861 Last 2m ago 24h 2,736
github JavaScript analyzed 2e77471 unconfirmed MCP

ForgeyClap/claude-forge

github

Zero-dependency multi-agent build, automation and review system for Claude Code. 18 agents, 23 skills, a live per-project dashboard, and a /setup-forge onboarding wizard. One command: /forge.

maintainer
ForgeyClap
licence
MIT
first seen
2026-07-18
last seen
2026-08-04
releases · 30d
0
short id

Drift inferred · capture-to-capture

  1. HIGH code analysis flagged hidden prompt content ×8 in ForgeyClap/claude-forge
  2. HIGH code analysis flagged hidden prompt content ×16 in ForgeyClap/claude-forge
capabilities 0 tools
transport http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 2e77471 · analyzer v33 · 1w ago

skills & prompt files 48

danger signals4

code evidence vv2.0.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 719

filesystem 341

  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-actiongate.cjs :104 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-actiongate.test.cjs :9 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-agents.test.cjs :6 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-agui.cjs :14 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-all-lens.test.cjs :15 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-artifact.test.cjs :6 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-audit-loop.cjs :97 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-audit-loop.test.cjs :7 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-autonomy.cjs :44 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-autonomy.test.cjs :10 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-beads.cjs :68 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-beads.test.cjs :8 const fs = require('fs');
show 28 more
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-bench.cjs :16 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-bosses-panel.test.cjs :6 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-briefing.test.cjs :18 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-caller-wiring.test.cjs :26 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-capabilities-panel.test.cjs :14 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-capabilities.cjs :62 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-capabilities.test.cjs :10 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-certify.cjs :86 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-certify.test.cjs :12 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-chaos.cjs :83 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-chaos.test.cjs :24 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-checkpoint.cjs :117 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-checkpoint.test.cjs :24 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-codemodel.cjs :68 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-codemodel.test.cjs :6 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-coldverify.cjs :93 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-coldverify.test.cjs :7 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-configdrift.cjs :83 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-configdrift.test.cjs :7 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-consolidate.cjs :51 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-consolidate.test.cjs :6 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-contextbudget.cjs :84 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-contextbudget.test.cjs :6 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-cost.cjs :52 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-cost.test.cjs :9 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-deeplearn.cjs :33 const fs = require('fs');
  • fs (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-deeplearn.test.cjs :6 const fs = require('fs');
  • fs ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-distill.cjs :43 const fs = require('fs');

301 more not shown — this panel samples each group; the count above is the real total.

shell / exec 135

  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-actiongate.test.cjs :13 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-artifact.cjs :28 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-audit-loop.cjs :99 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-audit-loop.test.cjs :10 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-autonomy.test.cjs :14 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-beads.test.cjs :11 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-bench.cjs :29 { id: 'honesty.canonical-name', cap: 'honesty', fn: () => { const r = require('child_process').spawnSync(process.execPath, [path.join(__dirname, '..', 'forge-dashboard', 'log-event.cjs'), 'bench-canon
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-briefing.test.cjs :21 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-caller-wiring.test.cjs :30 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-capabilities.test.cjs :14 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-certify.test.cjs :16 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-chaos.cjs :86 const { spawnSync } = require('child_process');
show 28 more
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-chaos.test.cjs :27 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-checkpoint.test.cjs :27 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-codemodel.test.cjs :10 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-coldverify.cjs :95 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-coldverify.test.cjs :10 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-configdrift.test.cjs :279 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-consolidate.test.cjs :10 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-cost.cjs :37 * Lead must either resolve the shim path explicitly or spawn with `{ shell: true }` (`spawnSync('claude',
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-cost.test.cjs :12 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-deeplearn.cjs :35 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-distill.cjs :45 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-distill.test.cjs :11 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-docdrift.cjs :73 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-docs.cjs :79 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-docs.test.cjs :13 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-doctor.cjs :143 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-doctor.test.cjs :198 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-echo.cjs :42 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-echo.test.cjs :13 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-evals.cjs :104 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-evals.test.cjs :11 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-event-wiring.test.cjs :32 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-evidence.test.cjs :15 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-fixtures.test.cjs :10 const { spawnSync } = require('child_process');
  • shell ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-flaky.cjs :29 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-genesis.test.cjs :12 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-harvest.test.cjs :12 const { spawnSync } = require('child_process');
  • shell (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-heartbeat.test.cjs :10 const { spawnSync } = require('child_process');

95 more not shown — this panel samples each group; the count above is the real total.

network 48

  • net (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-artifact-endpoint.test.cjs :13 const net = require('net');
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-docdrift.cjs :70 const https = require('https');
  • net (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-docdrift.test.cjs :29 const http = require('http');
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-otel.cjs :70 const lib = url.protocol === 'https:' ? require('https') : require('http');
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-paperclip.cjs :31 const http = require('http');
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-bin/forge-ruleoftwo.cjs :58 untrustedInput: /\b(untrusted (content|input|data|source)|third[- ]party (content|input|data)|external (content|website|webpage|web page)|fetch(?:es|ed|ing)? (a |the )?(url|page|webpage|website)|scrap
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-bin/nvidia-provider.cjs :132 const r = await fetch(CONFIG.baseUrl + p, {
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-bin/usage-guard.cjs :281 const r = await fetch(USAGE_URL, { headers: { authorization: 'Bearer ' + readToken(), 'anthropic-beta': 'oauth-2025-04-20', 'content-type': 'application/json' } });
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-dashboard/app.js :545 try { const r = await fetch('/api/state', { cache: 'no-store' }); const s = await r.json();
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-dashboard/panels.js :484 const r = await fetch('/api/capabilities', { cache: 'no-store' });
  • net ForgeyClap-claude-forge-2e77471/.claude/forge-dashboard/server.cjs :24 const http = require('http');
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/cdp-driver.cjs :40 const res = await fetch(`http://127.0.0.1:${port}/json/version`);
show 28 more
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/doctor.cjs :26 const http = require('node:http');
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/full-control-test.cjs :83 const res = await fetch(`${BASE}${pathAndQuery}`);
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/shots-complete-capture.cjs :86 const res = await fetch(`${BASE}${pathAndQuery}`);
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/visible-install-test.cjs :64 const res = await fetch(`${BASE}${pathAndQuery}`);
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/wp-part2-phaseAB.cjs :31 try { const r = await fetch(`${BASE}${p}`); const b = await r.json().catch(() => null); return { ok: r.ok, status: r.status, body: b }; }
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/wp-part2-reality.cjs :81 const res = await fetch(`${BASE}${pathAndQuery}`);
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/wp-sse-retest.cjs :72 const res = await fetch(`${BASE}${pathAndQuery}`, { signal: AbortSignal.timeout(3000) });
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/scripts/wpB-clicktest.cjs :89 const res = await fetch(`${BASE}${pathAndQuery}`);
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/bridge/main.ts :32 import { request as httpRequest } from 'node:http';
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/bridge/server.ts :45 import { createServer } from 'node:http';
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/prototype/state/bridge-client.ts :943 response = await globalThis.fetch(this.httpUrl, {
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/prototype/state/gateway-client.ts :78 res = await globalThis.fetch(gatewayUrl(path), { method: 'GET' });
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/views/agents/AgentsView.tsx :606 // never the merely-requested one — a real re-fetch (the effect above), not the PATCH response
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/views/chat/Composer.tsx :553 const res = await globalThis.fetch(
  • net ForgeyClap-claude-forge-2e77471/command-center/dashboard/src/views/chat/mention-files.ts :47 * throws — a failed directory fetch (a transient error, or a directory that vanished mid-crawl)
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/tests/integration/helpers.ts :56 import { request as httpRequest } from 'node:http';
  • net (weak) ForgeyClap-claude-forge-2e77471/command-center/dashboard/tests/unit/no-runtime-contact.test.ts :160 * `globalThis.fetch(` / `new globalThis.EventSource(` — a MemberExpression, not the bare
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/attachments.js :33 this.fetchImpl = fetchImpl ?? ((url) => fetch(url));
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/bot-manager.js :5 import http from 'node:http';
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/diag-live.js :15 const guilds = await client.guilds.fetch();
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/discord-admin.js :17 const guild = await this.client.guilds.fetch(this.guildId);
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/health-server.js :1 import http from 'node:http';
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/main.js :20 const res = await fetch(`http://127.0.0.1:${config.botHttpPort}/api/health`, {
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/setup-live.js :24 const guild = await client.guilds.fetch(config.guildId);
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/setup-projects.js :32 const guild = await client.guilds.fetch(config.guildId);
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/subscription-usage.js :81 this.fetchImpl = fetchImpl ?? ((url, opts) => fetch(url, opts));
  • net ForgeyClap-claude-forge-2e77471/command-center/discord/src/transport/discord.js :227 const channel = await this.client.channels.fetch(threadId);
  • net ForgeyClap-claude-forge-2e77471/command-center/gateway/src/ask-mcp.mjs :8 // rest of gateway/src). Deliberately NOT the global `fetch`: Node's built-in fetch (undici) applies

8 more not shown — this panel samples each group; the count above is the real total.

secrets 4

  • secrets ForgeyClap-claude-forge-2e77471/.claude/forge-bin/nvidia-provider.cjs :104 key: process.env.NVIDIA_API_KEY || '',
  • secrets (weak) ForgeyClap-claude-forge-2e77471/.claude/forge-bin/nvidia-provider.test.cjs :9 delete process.env.NVIDIA_API_KEY;
  • secrets ForgeyClap-claude-forge-2e77471/command-center/gateway/src/ask-mcp.mjs :33 const EXEC_TOKEN = process.env.CC_ASK_EXEC_TOKEN || '';
  • secrets (weak) ForgeyClap-claude-forge-2e77471/command-center/gateway/test/exec-bridge.test.mjs :282 const saved = { PASSWORD: process.env.PASSWORD, DB_URL: process.env.DB_URL, MY_SECRET: process.env.MY_SECRET };

declared dependencies 27

  • lucide-react@^0.563.0
  • react@^19.2.0
  • react-dom@^19.2.0
  • react-router-dom@^7.9.4
  • ws@^8.21.1
  • @eslint/js@^9.39.0
  • @playwright/test@^1.57.0
  • @stryker-mutator/core@^9.6.1
  • @stryker-mutator/vitest-runner@^9.6.1
  • @testing-library/dom@^10.4.1
  • @testing-library/jest-dom@^6.9.1
  • @testing-library/react@^16.3.0
show 15 more
  • @testing-library/user-event@^14.6.1
  • @types/node@^24.10.1
  • @types/react@^19.2.2
  • @types/react-dom@^19.2.1
  • @types/ws@^8.18.1
  • @vitejs/plugin-react@^5.1.0
  • eslint@^9.39.0
  • eslint-plugin-react-hooks@^7.0.1
  • eslint-plugin-react-refresh@^0.4.24
  • globals@^16.5.0
  • jsdom@^27.0.0
  • typescript@^5.9.3
  • typescript-eslint@^8.46.2
  • vite@^7.1.12
  • vitest@^3.2.4