MCP Observatory
7m ago Tracked 59,479 Last 7m ago 24h 2,575
github TypeScript analyzed 1043663

moretea-labs/forge

github

Local-first action assistant for durable, reviewable software work.

maintainer
moretea-labs
licence
MIT
first seen
2026-08-11
last seen
2026-09-06
releases · 30d
3
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 0 tools
transport stdio · streamable-http · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

No tools enumerated yet for this server.

skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed commit 1043663 · analyzer v33 · 1w ago

skills & prompt files 22

danger signals8

code evidence vv1.7.2 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 1154

filesystem 400

  • fs moretea-labs-forge-1043663/adapters/browser/session-authority.ts :2 import { readdirSync, readFileSync, rmSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/access-mode.ts :1 import { existsSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/audit.ts :2 import { appendFileSync, mkdirSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/auth.ts :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/multi-repository.ts :7 import { realpathSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/oauth.ts :13 } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/paths.ts :1 import { existsSync, lstatSync, realpathSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/policy.ts :1 import { existsSync, readFileSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/repo.ts :1 import { existsSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/runtime-gateway/execution-tools.ts :1 import { existsSync, readFileSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/runtime-gateway/runtime-tools.ts :2 import { existsSync, readFileSync, statSync } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/server.ts :23 import { readFileSync } from 'fs';
show 28 more
  • fs moretea-labs-forge-1043663/adapters/mcp/setup.ts :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
  • fs moretea-labs-forge-1043663/adapters/mcp/tool-mapping/legacy-tool-service.ts :12 } from "fs";
  • fs moretea-labs-forge-1043663/adapters/mcp/transports/http.ts :2 import { existsSync, watch } from 'fs';
  • fs moretea-labs-forge-1043663/adapters/mcp/tunnels/openai-secure-tunnel.ts :1 import { readFileSync } from 'fs';
  • fs moretea-labs-forge-1043663/assets/templates/helpers/architecture-event.ts :2 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/capability-config.ts :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/capability-resolver.ts :2 import { existsSync, readdirSync, readFileSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/check-skill-version.ts :12 import { readFileSync, existsSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/contract-run.ts :2 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/inspect-project-state.ts :1 import { existsSync, readFileSync, readdirSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/migrate-workflow-docs.ts :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
  • fs moretea-labs-forge-1043663/assets/templates/helpers/workflow-contract.ts :1 import { existsSync, readFileSync } from "fs";
  • fs (weak) moretea-labs-forge-1043663/evaluation/candidate-runner.test.ts :2 import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/calibration.ts :2 import { readFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/candidate-artifact.ts :2 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/corpus.ts :2 import { existsSync, readFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/execution-evidence.ts :1 import { existsSync, readFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/report.ts :1 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/sandbox.ts :2 import { existsSync, mkdirSync, mkdtempSync, realpathSync, rmSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/scenario.ts :2 import { readFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/lib/trace.ts :2 import { existsSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/evaluation/run-paired.ts :3 import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
  • fs moretea-labs-forge-1043663/packages/kernel/identity/infrastructure/identity-store.ts :2 import { closeSync, existsSync, fsyncSync, linkSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync } from 'fs';
  • fs moretea-labs-forge-1043663/packages/kernel/scheduler/infrastructure/schedule-store.ts :2 import { existsSync, readdirSync, rmSync, statSync } from 'fs';
  • fs moretea-labs-forge-1043663/packages/kernel/work/infrastructure/work-contract-store.ts :2 import { existsSync, mkdirSync } from 'fs';
  • fs (weak) moretea-labs-forge-1043663/scripts/activate-source-baseline.ts :12 } from 'fs';
  • fs (weak) moretea-labs-forge-1043663/scripts/assemble-template.ts :9 import { readFileSync, existsSync, readdirSync } from "fs";
  • fs (weak) moretea-labs-forge-1043663/scripts/benchmark-background-check-overlap.ts :13 import { mkdtempSync, mkdirSync, readFileSync, rmSync, writeFileSync } from 'fs';

360 more not shown — this panel samples each group; the count above is the real total.

shell / exec 221

  • shell moretea-labs-forge-1043663/adapters/mcp/setup.ts :1 import { spawnSync } from "child_process";
  • shell moretea-labs-forge-1043663/assets/templates/helpers/capability-config.ts :4 import { spawnSync } from "child_process";
  • shell moretea-labs-forge-1043663/assets/templates/helpers/capability-resolver.ts :4 import { spawnSync } from "child_process";
  • shell moretea-labs-forge-1043663/assets/templates/helpers/contract-run.ts :4 import { spawnSync } from "child_process";
  • shell moretea-labs-forge-1043663/bin/forge-hook.mjs :2 import { spawnSync } from 'node:child_process';
  • shell moretea-labs-forge-1043663/bin/forge-runtime-service.mjs :2 import { spawnSync } from 'node:child_process';
  • shell moretea-labs-forge-1043663/bin/forge-runtime.mjs :2 import { spawnSync } from 'node:child_process';
  • shell moretea-labs-forge-1043663/bin/forge.mjs :2 import { spawnSync } from 'node:child_process';
  • shell (weak) moretea-labs-forge-1043663/evaluation/candidate-runner.test.ts :1 import { execFileSync } from 'node:child_process';
  • shell moretea-labs-forge-1043663/evaluation/lib/corpus.ts :1 import { execFileSync } from 'node:child_process';
  • shell moretea-labs-forge-1043663/evaluation/lib/trace.ts :1 import { spawnSync } from 'node:child_process';
  • shell moretea-labs-forge-1043663/evaluation/run-paired.ts :2 import { execFileSync } from 'node:child_process';
show 28 more
  • shell (weak) moretea-labs-forge-1043663/scripts/activate-source-baseline.ts :3 import { spawn } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-background-check-overlap.ts :12 import { execFileSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-controller-hotpath.ts :12 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-controller-round2.ts :1 import { execFileSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-operational-memory-activation.ts :2 import { execFileSync } from 'node:child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-quality-harness.ts :3 import { execFileSync, spawn } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-route-session-concurrency.ts :4 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-thin-harness-gateway-ab.ts :23 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-thin-harness-mcp-e2e.ts :22 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-thin-harness.ts :19 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-typescript-navigation.ts :3 import { execFileSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/benchmark-work-efficiency.ts :14 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/canary-controller-semantic-wait.ts :2 import { execFileSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/check-platform-support.mjs :2 import { execFileSync } from "node:child_process";
  • shell (weak) moretea-labs-forge-1043663/scripts/check-repository-hygiene.mjs :2 import { execFileSync } from 'node:child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/check-runtime-env.mjs :2 import { spawnSync } from 'node:child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/check-source-duplication.mjs :3 import { execFileSync } from 'node:child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/complete-control-plane-cutover.ts :3 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/forge-uu-remote-rescue-helper.mjs :3 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/forge-windows-host-recovery-helper.mjs :4 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/hook-dispatch-diet-report.ts :5 import { spawnSync } from "child_process";
  • shell (weak) moretea-labs-forge-1043663/scripts/install-independent-windows-wsl-recovery.ts :11 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/lib/run-forge-helper.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) moretea-labs-forge-1043663/scripts/migrate-requirement-portfolio.ts :4 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/migrate-windows-wsl-controller-home.ts :14 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/public-release.ts :2 import { spawnSync } from "node:child_process";
  • shell (weak) moretea-labs-forge-1043663/scripts/refresh-ios-physical-runtime.ts :1 import { spawnSync } from 'child_process';
  • shell (weak) moretea-labs-forge-1043663/scripts/run-bounded-command.mjs :2 import { spawn } from 'node:child_process';

181 more not shown — this panel samples each group; the count above is the real total.

network 46

  • net moretea-labs-forge-1043663/adapters/mcp/runtime-gateway/runtime-tools.ts :1664 const response = await fetch(url, { signal: controller.signal, headers: { accept: 'application/json' } });
  • net moretea-labs-forge-1043663/adapters/mcp/setup.ts :3 import { isIP } from "net";
  • net moretea-labs-forge-1043663/adapters/mcp/transports/http.ts :312 const response = await fetch(url, {
  • net moretea-labs-forge-1043663/packages/plugin-runtime/external/unix-jsonl-transport.ts :1 import { createConnection, type Socket } from 'net';
  • net (weak) moretea-labs-forge-1043663/scripts/forge-uu-remote-rescue-helper.mjs :5 import { createConnection } from 'net';
  • net (weak) moretea-labs-forge-1043663/scripts/smoke-browser-cdp-bridge.ts :22 const response = await fetch(new URL('/json/list', new URL(endpoint).origin));
  • net (weak) moretea-labs-forge-1043663/scripts/smoke-mcp-http-runtime.ts :3 import { createServer } from 'net';
  • net moretea-labs-forge-1043663/src/cli/chatgpt-browser/bind-server.ts :222 const response = await fetch(path, {method: 'POST'});
  • net moretea-labs-forge-1043663/src/cli/chatgpt-browser/bridge-extension.ts :58 await fetch(FORGE_CHATGPT_BRIDGE_URL + path, {
  • net moretea-labs-forge-1043663/src/cli/chatgpt-browser/bridge-provider.ts :478 async fetch(request) {
  • net moretea-labs-forge-1043663/src/cli/chatgpt-browser/native-provider.ts :2 import { createServer } from 'net';
  • net moretea-labs-forge-1043663/src/cli/local-bridge/connector-freshness.ts :192 const response = await fetch(url, {
show 28 more
  • net moretea-labs-forge-1043663/src/cli/local-bridge/frontend/src/lib/api.ts :10 const response=await fetch(path,{...init,headers,signal:controller.signal,credentials:'same-origin'});let payload:unknown={};try{payload=await response.json();}catch{}
  • net moretea-labs-forge-1043663/src/cli/local-bridge/server.ts :4 import { createServer, type Server } from "http";
  • net moretea-labs-forge-1043663/src/cli/local-bridge/ui-dist/app.js :10536 const M = await fetch(o, { ...E, headers: _, signal: m.signal, credentials: "same-origin" });
  • net moretea-labs-forge-1043663/src/runtime/execution/workspace-agent.ts :96 const fetchImpl: WorkspaceAgentFetch = options.fetchImpl ?? ((input, init) => fetch(input, init));
  • net moretea-labs-forge-1043663/src/runtime/platform/fetch-http-server.ts :1 import { createServer, type IncomingMessage, type ServerResponse } from 'http';
  • net moretea-labs-forge-1043663/src/runtime/plugins/app-store-connect-adapter.ts :350 const response = await fetch(url, {
  • net moretea-labs-forge-1043663/src/runtime/plugins/browser-adapter.ts :294 const response = await fetch(url, { signal: controller.signal });
  • net moretea-labs-forge-1043663/src/runtime/plugins/external-unix-socket-probe.cjs :4 const net = require('net');
  • net moretea-labs-forge-1043663/src/runtime/plugins/google-shared.ts :442 const response = await fetch('https://oauth2.googleapis.com/token', {
  • net moretea-labs-forge-1043663/src/runtime/plugins/resend-adapter.ts :341 const response = await fetch(`${API_BASE_URL}${path}`, {
  • net moretea-labs-forge-1043663/src/runtime/root/mcp-transport.ts :2 import type { Server as NodeHttpServer } from 'http';
  • net moretea-labs-forge-1043663/src/runtime/root/package-connector-service.ts :118 const response = await fetch(endpoint, { method: 'GET', redirect: 'manual', signal: controller.signal });
  • net moretea-labs-forge-1043663/src/runtime/safe-tooling/google-oauth-broker.ts :249 const response = await fetch(GOOGLE_TOKEN_ENDPOINT, {
  • net moretea-labs-forge-1043663/src/runtime/safe-tooling/resend-oauth.ts :214 const response = await fetch(url, {
  • net moretea-labs-forge-1043663/src/runtime/shared/idempotent-retry.ts :116 const response = await fetch(input, fetchInit);
  • net moretea-labs-forge-1043663/src/runtime/standalone-recovery/core.ts :1046 const request = options.request ?? ((url: string, init: { signal: AbortSignal }) => fetch(url, init));
  • net moretea-labs-forge-1043663/src/runtime/standalone-recovery/entry.ts :2 import { createServer, type IncomingMessage, type ServerResponse } from 'http';
  • net moretea-labs-forge-1043663/src/runtime/standalone-recovery/http-transport.ts :299 const response = await fetch(request.url, {
  • net moretea-labs-forge-1043663/src/runtime/standalone-recovery/installer.ts :501 const response = await fetch(`http://${input.config.gateway?.host ?? '127.0.0.1'}:${input.config.gateway?.port ?? 8787}/health`, {
  • net (weak) moretea-labs-forge-1043663/tests/cli/local-bridge.test.ts :164 const response = await fetch(new URL(path, handle.url), {
  • net (weak) moretea-labs-forge-1043663/tests/cli/mcp-http.test.ts :3 import { createServer } from 'net';
  • net (weak) moretea-labs-forge-1043663/tests/cli/mcp-runtime-proxy-routing.test.ts :443 const initializeAttempt = await fetch(runtimeTransport.endpoint, {
  • net (weak) moretea-labs-forge-1043663/tests/fixtures/isolated-controller-home.ts :2 import { createServer } from 'net';
  • net (weak) moretea-labs-forge-1043663/tests/infrastructure/test-runner-e2e.test.ts :6 import { createServer } from 'net';
  • net (weak) moretea-labs-forge-1043663/tests/live/browser-native-silent.e2e.ts :82 fetch(request) {
  • net (weak) moretea-labs-forge-1043663/tests/live/browser-runtime-v3.e2e.ts :156 fetch(request) {
  • net (weak) moretea-labs-forge-1043663/tests/runtime/canonical-single-runtime.test.ts :294 const unauthorized = await fetch(endpoint!, {
  • net (weak) moretea-labs-forge-1043663/tests/runtime/computer-interaction-target.test.ts :3 import { createServer, type Server } from 'net';

6 more not shown — this panel samples each group; the count above is the real total.

secrets 6

  • secrets moretea-labs-forge-1043663/adapters/mcp/auth.ts :299 if (process.env.FORGE_MCP_TOKEN?.trim()) return process.env.FORGE_MCP_TOKEN.trim();
  • secrets moretea-labs-forge-1043663/src/runtime/execution/workspace-agent.ts :47 || process.env.OPENAI_WORKSPACE_AGENT_ACCESS_TOKEN?.trim()
  • secrets moretea-labs-forge-1043663/src/runtime/plugins/resend-adapter.ts :102 const forge = stringValue(process.env.FORGE_RESEND_API_KEY);
  • secrets moretea-labs-forge-1043663/src/runtime/safe-tooling/google-oauth-broker.ts :148 return process.env.FORGE_GOOGLE_WORKSPACE_CLIENT_SECRET?.trim()
  • secrets (weak) moretea-labs-forge-1043663/tests/runtime/external-plugin-store-integration.test.ts :822 const originalKey = process.env.FORGE_RESEND_API_KEY;
  • secrets (weak) moretea-labs-forge-1043663/tests/runtime/plan-contract-store.test.ts :71 scopeKey: process.env.SCOPE_KEY,

install hooks 1

  • prepack moretea-labs-forge-1043663/package.json :159 node scripts/sync-generated-authority.mjs --check

declared dependencies 22

  • @modelcontextprotocol/sdk@^1.28.0
  • commander@^14.0.3
  • express@^5.2.1
  • playwright@^1.54.1
  • react@^19.2.0
  • react-dom@^19.2.8
  • typescript@^6.0.3
  • @colbymchenry/codegraph@1.0.1
  • @types/bun@latest
  • @types/cors@^2.8.19
  • @types/express@^5.0.6
  • @types/react@^19.2.18
show 10 more
  • @types/react-dom@^19.2.4
  • @vitejs/plugin-react@^5.2.0
  • vite@^7.3.0
  • @colbymchenry/codegraph-darwin-arm64@1.0.1
  • @colbymchenry/codegraph-darwin-x64@1.0.1
  • @colbymchenry/codegraph-linux-arm64@1.0.1
  • @colbymchenry/codegraph-linux-x64@1.0.1
  • @colbymchenry/codegraph-win32-arm64@1.0.1
  • @colbymchenry/codegraph-win32-x64@1.0.1
  • agent-device@0.20.2

cursor-plugin 1

  • opaque (low) moretea-labs-forge-1043663/.cursor/rules/codegraph.mdc bundled .cursor/ plugin descriptor (moretea-labs-forge-1043663/.cursor/rules/codegraph.mdc) — presence-detected; review the descriptor

perm:untrusted 3

  • untrusted (weak) moretea-labs-forge-1043663/tests/cli/local-bridge.test.ts :526 const progress = await fetch(new URL("/api/progress", handle.url), { headers }).then((response) => response.json());
  • untrusted (weak) moretea-labs-forge-1043663/tests/cli/mcp-http.test.ts :160 const health = await fetch(`http://127.0.0.1:${port}/health`).then((response) => response.json());
  • untrusted (weak) moretea-labs-forge-1043663/tests/runtime/canonical-single-runtime.test.ts :576 const health = await fetch(new URL('/health', bridge!.endpoint)).then((response) => response.json()) as Record<string, unknown>;