Loading…
Forge Engine is a design source-of-truth for AI coding agents to read and propose project changes.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The forge MCP server exposes 54 tools, focused primarily on developer capabilities. Its published description reads: "Forge Engine is a design source-of-truth for AI coding agents to read and propose project changes". It communicates over Streamable HTTP using the 2026-07-28 protocol revision, and does not require authorization to connect. MCPGrade currently rates forge F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check forge's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add forge to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mmvdabzadclebfxyzudg.supabase.co/functions/v1/forge-mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Forge how-to on demand (no project needed): propose→adopt, what a System is, Balance Lab formats, sign-in. Call when unsure.
Run FIRST in a new repo (no project): first-connect routine + the working-agreement block to ADD to AGENTS.md/CLAUDE.md now (tell the user in one line; remove if they object).
One-command codebase import: recipe + batch id — propose one Context overview + one System per real module; the owner adopts all at once.
Recipe to design the UI from Systems (user request only): steps + batch id — confirm canvas aspect, then screens + PLACED elements + edges in one batch.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: get_project_context
A tool description tries to alter the model’s use of another tool.
resort; prefer get_project_meta + list_*/get_*/search.RecommendationDescriptions must describe only their own tool.
tool: trace_ui_from_image
A tool description tries to alter the model’s use of another tool.
ead of duplicating. You look at the picture and send back propose_elementRecommendationDescriptions must describe only their own tool.
tool: get_stale
A tool description tries to alter the model’s use of another tool.
first kind with resync_from_idea.RecommendationDescriptions must describe only their own tool.
tool: get_design_document
A tool description tries to alter the model’s use of another tool.
ead of walking list_systems → get_system N times. Returns markdown plus thRecommendationDescriptions must describe only their own tool.
tool: set_design_overview
A tool description tries to alter the model’s use of another tool.
he design (call get_design_document with for_summary:true first); invent no mechaniRecommendationDescriptions must describe only their own tool.
tool: get_briefing
A tool description tries to alter the model’s use of another tool.
m. Replaces the get_project_meta→get_system→get_build_region dance.RecommendationDescriptions must describe only their own tool.
tool: get_build_region
A tool description tries to alter the model’s use of another tool.
from the repo? report_drift. Pass `system:"<name|id>"` for ONE system plusRecommendationDescriptions must describe only their own tool.
tool: report_drift
A tool description tries to alter the model’s use of another tool.
visory; a fresh report_build_status clears it.RecommendationDescriptions must describe only their own tool.
tool: get_rejections
A tool description tries to alter the model’s use of another tool.
guidance, then resolve_rejection(title).RecommendationDescriptions must describe only their own tool.
tool: get_screen
A tool description tries to alter the model’s use of another tool.
ce_image:true → get_screen_image shows you the actual image.RecommendationDescriptions must describe only their own tool.
tool: withdraw_proposal
A tool description tries to alter the model’s use of another tool.
pose response / get_inbox).RecommendationDescriptions must describe only their own tool.
tool: propose_system
A tool description tries to alter the model’s use of another tool.
ce. Exists? use update_system. (Alias: create_proposal.)RecommendationDescriptions must describe only their own tool.
tool: propose_context
A tool description tries to alter the model’s use of another tool.
urrent systems (get_stale lists notes the systems have moved past) — it sRecommendationDescriptions must describe only their own tool.
tool: propose_dna
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "tech_notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_system
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "context_title"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: update_system
A tool description tries to alter the model’s use of another tool.
tream Idea (see resync_from_idea) — it re-stamps the staleness signal on adopt.RecommendationDescriptions must describe only their own tool.
tool: propose_element
A tool description tries to alter the model’s use of another tool.
esolution` from get_screen); no coords = unplaced pile.RecommendationDescriptions must describe only their own tool.
tool: propose_screen
A tool description tries to alter the model’s use of another tool.
ions. Whole UI? design_ui_from_systems first.RecommendationDescriptions must describe only their own tool.
tool: next_task
A tool description tries to alter the model’s use of another tool.
d out instead of colliding. Returns the claimed task + systems, or why nonRecommendationDescriptions must describe only their own tool.
tool: (server instructions)
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
sk_ key (Bearer token) — generate one in the web app under "Connect aRecommendationRemove side-channel parameters; constrain tool inputs.
tool: (server instructions)
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
lace the block (create the file if needed) WITHOUT waiting to be asked, then teRecommendationAnnotate destructive tools and require human approval.
tool: (server instructions)
A tool description tries to alter the model’s use of another tool.
rectories. Call get_help anytime for how-to (proposing, what's a System,RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: get_screen_image
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
E you can see — reads the stored file inline (signed-URL fallback past 4MB). {"type":RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: delete_entity
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: dedupe
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Append a build-log entry to Activity — what you built/decided (commit-note style).
FULL design dump — LARGE, last resort; prefer get_project_meta + list_*/get_*/search.
Projects your key reaches (id, name, role); pass an id as project_id to switch.
START HERE. Tiny overview: counts, members, task claims + working_now (avoid collisions), forge_workflow_version.
SECONDARY (user-driven UI): turn a screen's REFERENCE IMAGE into placed elements. Returns the image itself plus the recipe — the canvas resolution, the fraction→pixel conversion that stops coordinates
What has drifted between the Idea lane and the System Specs — the design's own out-of-sync list, computed deterministically (no AI, no tokens). Three kinds: Idea notes edited since the systems were ge
The recipe for re-syncing ONE changed Idea note into the specs that depend on it — the same scoped job the app's "Re-sync N systems" button does, minus the button. Returns the note, the affected specs
The WHOLE design as one readable document — Vision (+ Project DNA) → every System spec → reference notes, compiled deterministically from the current design. Read this to understand a project end-to-e
Write the Design Document's Overview — the human-readable page a new team member reads first. WRITES DIRECTLY (no Inbox): it is a derived, clearly-labelled AI summary, not design truth, and the owner
ONE-CALL orientation before you build: pass `files` you're about to edit (or a `task`) → the systems that own them, each with Goal + Acceptance + build status/files/last_commit/drift + coupled_systems
ONE system's full spec (Goal/Boundary/Acceptance, markdown, sources, status) + pending Inbox changes touching it.
All systems, compact: id, name, status, 1-line goal.
System→code map per built system: implementing files, status, drift flag, last_commit, and acceptance-evidence COUNTS. Mapped files gone from the repo? report_drift. Pass `system:"<name|id>"` for ONE
Flag CODE DRIFT — mapped files no longer match the repo. Advisory; a fresh report_build_status clears it.
DESIGN MEMORY: recorded decisions/logs/rejections with who/when. Read BEFORE changing a system's direction; empty = no recorded WHY — don't invent one.
BLAST RADIUS of a system (deterministic): upstream context, siblings, dependent screens/milestones, files, code-coupled systems, pending Inbox, recent activity. Run BEFORE changing it.
Owner's DECLINED list — check at session start; follow each entry's guidance, then resolve_rejection(title).
Report you REVERTED a declined change (unlocks the owner's Clear). Call after realigning the build.
All screens, compact: id, name, purpose, status.
ONE screen's layout: canvas `resolution` (use THESE px), elements x/y/w/h, links, popups. Read before editing a screen. has_reference_image:true → get_screen_image shows you the actual image.
A screen's reference image (HUD background) as an actual IMAGE you can see — reads the stored file inline (signed-URL fallback past 4MB).
Move/resize/relabel an element — DIRECT, live. element_id (preferred) or screen+label; x+y also places an unplaced one.
Remove YOUR OWN still-pending Inbox item (id from the propose response / get_inbox).
PROPOSE a delete → Inbox (owner adopts; nothing deleted now). id preferred or exact name; flow_edge may use from+to.
Remove duplicate-named entries (keep first) — DIRECT, destructive.
Reorder milestones / tasks / elements — DIRECT. order = ids in new order; omitted keep relative order.
All milestones, compact: id, name, weeks, order, done/total.
ONE milestone: goal, weeks, difficulty, systems, every task (id/name/done/status/effort).
Change history {who, change, entity, kind, when}, newest first; filter kind/who/query.
PENDING Inbox (the owner's triage queue). Check BEFORE proposing — avoid duplicates. Read-only.
Keyword search — compact hits {kind, id, name} + snippet.
Propose a NEW system → Inbox. spec = ## Goal / ## Boundary (Owns · Doesn't own) / ## Acceptance. Exists? use update_system. (Alias: create_proposal.)
Propose a new/updated Idea note → Inbox. Title-match to update; send the COMPLETE revised text. Set resync:true ONLY when you rewrote the note FROM the current systems (get_stale lists notes the syste
Propose Project DNA and/or Tech Notes → Inbox (at least one).
Propose a system UPDATE → Inbox diff. get_system first; send the FULL revised spec. new_title renames; context_title+context bundles the Idea update. Set resync:true ONLY when you rewrote this spec FR
Read Balance Lab: stat tables, boards with EVALUATED values, scenarios.
Propose a stat-doc TABLE → Inbox. csv (header; `key%` = percent; first column = name) OR schema+rows. Adopting REPLACES same-named.
Propose a node board → Inbox. Kinds const|formula|item|sheet|loadout|picker|pool|process|note|frame; formulas reference blocks by NAME; omit x/y = auto-layout. Adopting REPLACES same-named.
Propose a NEW milestone (+ optional tasks) → Inbox.
Mark existing-milestone tasks done → Inbox progress card (owner adopts the ticks).
Report a SYSTEM's status (todo|in-progress|implemented) — DIRECT, live. ALWAYS pass files (full list — it REPLACES); non-todo with no files shows done-but-EMPTY. 'implemented' counts as VERIFIED only
SECONDARY (user-driven UI): propose a link between two existing screens → Inbox.
SECONDARY (user-driven UI): propose an element onto a screen → Inbox. ALWAYS pass x/y/w/h (px on the screen's `resolution` from get_screen); no coords = unplaced pile.
SECONDARY (user-driven UI): propose a NEW screen → Inbox. parent = popup over that screen; purpose grounds AI suggestions. Whole UI? design_ui_from_systems first.
Report a SCREEN's status (todo|in-progress|implemented) → Inbox.
Rename a screen IN PLACE — DIRECT; links/elements follow (id-referenced).
Edit milestone goal/weeks/difficulty/name — DIRECT. new_name renames (never delete+recreate).
Add a task to a milestone — DIRECT. assignee:"me" claims on creation.
DISPATCHER (multi-agent): atomically pick + claim the next task to build — walks milestones in order, skips human-only tasks and any task whose systems share code files with a task another agent alrea
Edit a task or CLAIM it — DIRECT. assignee:"me"+status:"in-progress" claims (errors if held; force:true for stale); done:true or assignee:"" releases.