[L1 GOVERNANCE] A-FORGE — Execution shell. Build, deploy, orchestrate. Executes only after SEAL from arifOS. Never self-authorizes.
ariffazil/A-FORGE is an MCP server distributed on github, maintained by ariffazil, tracked here since June 2026. It has shipped 2 releases and exposes 141 tools. Tools include auth_pipeline, forge_abort, forge_agent, forge_apex_emd, forge_apex_encode, forge_apex_goal_status, and 135 more. Its composite risk grade is C — an inferred review prompt computed from observed signals, not a verdict.
Reading the source raised 3 review prompts — dangerous code, exfiltration combo and toxic flow (lethal trifecta) — each a pattern worth a human look rather than a finding of fault.
Since the previous scan on 2026-09-11: 113 tools added and 17 tools removed.
full security breakdown →-
auth_pipeline -
forge_abort -
forge_agent -
forge_apex_emd -
forge_apex_encode -
forge_apex_goal_status -
forge_apex_metabolize -
forge_apex_recompute -
forge_browser_click -
forge_browser_evaluate_js -
forge_browser_extract_text -
forge_browser_navigate -
forge_browser_screenshot -
forge_browser_type -
forge_calendar -
forge_canonize -
forge_chart -
forge_check_governance -
forge_compose -
forge_cool_drift
| version | date | src |
|---|---|---|
| v2026.08.28 | 2026-08-27 | github |
| v0.1.22 | 2026-05-22 | github |