Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/forgeyclap/claude-forge/forgegit clone --depth 1 https://github.com/ForgeyClap/claude-forgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.09381 |
| Opus 5 | $0.00034 | $0.04691 |
| Sonnet 5 | $0.00014 | $0.01876 |
| Haiku 4.5 | $0.00007 | $0.00938 |
Grade A, and why
forge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/forge
Input: $ARGUMENTS. Obey CLAUDE.md (project isolation + honesty + no fake claims). Work only in this project folder.
Sub-commands & natural-language triggers (check $ARGUMENTS first)
Also trigger on plain language: "use Forge system", "gebruik Forge systeem", "start Forge dashboard", "open Forge dashboard", "gebruik forge voor dit project".
dashboard/start Forge dashboard→ confirm the active project folder, then find the Command Center — the ONE dashboard for every project (owner decision 2026-07-31; it auto-discovers projects, so it does not need to live in THIS folder): (1) ifcommand-center/gateway/bin.mjsexists in this project, that IS the Command Center home — ifcommand-center/dashboard/distis missing (never built), print the build command (cd command-center/dashboard && npm install && npm run build) instead of failing silently; prefer the supervisor for long sessions (node command-center/gateway/supervisor.mjs— auto-restarts the gateway) or start the gateway directly (node command-center/gateway/bin.mjs, port 4100); (2) if it does not live here, health-check the central instance anyway —http://127.0.0.1:4100/api/healthanswering means this project is already covered. Either way: health-checkhttp://127.0.0.1:4100/api/healthand reporthttp://127.0.0.1:4100as the dashboard URL — never claim it is running unless that check passed; never fake a start. Do NOT auto-start the retired per-project Control Center as a fallback —.claude/forge-dashboard/server.cjsis RETIRED (never started automatically in any project); onlylog-event.cjsin that directory stays in active service as the per-project run-event writer, completely unchanged. If no Command Center is reachable anywhere, say so honestly and print the exact command + expected URL. Also start the usage guard:node .claude/forge-bin/usage-guard.cjs start(idempotent, single global instance).legacy dashboard/old Forge dashboard→ the RETIRED per-project Control Center, available ONLY on this explicit request (it never starts automatically): check.claude/forge-dashboard/server.cjsexists, start it, health-checkhttp://localhost:<port>/api/health(port from.claude/forge-dashboard/PORT), report that URL, and remind that the Command Center on 4100 is the current dashboard.start→ same asdashboard, then begin a new run (steps 0–1 below).use/use Forge system/gebruik Forge systeem→ load project memory/profile; if Forge isn't installed, offer the installer; start (or show how to start) THIS project's dashboard; then continue the task via the flow below.status→ read.claude/FORGE_MEMORY.md+.claude/forge-dashboard/DASHBOARD_STATE.json+ newest.claude/forge-runs/*/run.json; summarize project status, latest run, and dashboard URL.runs→ list THIS project's.claude/forge-runs/*/newest-first.resume <run_id>(WAVE D) → a session/usage limit killed a swarm mid-run; reconcile that run's manifest purely from its loggedevents.jsonlcontent (never inferred from side effects, never a fabricated "done") and re-dispatch only the still-unfinished work packages with their original narrowed scope. Requires the run to have been ARMED at dispatch time — that ARM step is nowarm-manifestin.claude/config/orchestration/run-checklist.json(advisory, sits betweenrouteanddispatch):node .claude/forge-bin/forge-manifest.cjs arm --run <run_id> --wps <file.json> --log-event— one record per WP:wp_id, agent, narrowed_prompt, deps?.--log-eventlogs themanifest_armedproof event in the SAME act as the write (2026-08-01), so arming and its proof can no longer disagree; without it you must logmanifest_armedyourself orforge-orchestrate.cjs auditwill report the step skipped. Once a run is armed,node .claude/forge-bin/forge-manifest.cjs ready --run <run_id>gives the honest frontier and... waves --run <run_id>gives the full dispatch order in which everything inside one wave is mutually independent — that is the mechanical way to satisfy the owner's "one writer per hotspot at a time" HARD MUST instead of eyeballing the order. Then:node .claude/forge-bin/forge-swarm-resume.cjs --run <run_id> [--json](orforge.cmd resume --run <run_id>/forge.ps1 resume --run <run_id>/bash forge.sh resume --run <run_id>) — exit 0 = complete (nothing to resume) / 3 = resumable / 2 = usage error or no manifest was ever armed. Re-dispatch each returned unfinished WP exactly as originally scoped and logwp_resumedper WP as it goes back out. AdoneWP is never re-dispatched. This module has zero side effects of its own beyond persisting the reconciled manifest — a WP whose own work is side-effecting (email/deploy/payment/etc.) still needs its ownforge-checkpoint.cjsidempotency guard before repeating that side effect.open-report→ print THIS project's newest.claude/forge-runs/*/final-report.md.learn(WAVE F, opt-in, read-only) → cross-project learning harvest: reads OTHER Forge projects'.claude/FORGE_*.mdmemory files (never writes to them) and stores real, evidenced lines from them into THIS project's reservedgloballesson namespace — the same namespaceforge-recall.cjsalways blends into every dispatch, so a lesson from project A can now surface as advisory guidance in project B.node .claude/forge-bin/forge-harvest.cjs --scan <portfolio-dir> [--global-store <file>] [--dry-run] [--json](or--projects <a,b,...>for an explicit list; orforge.cmd learn/forge.ps1 learn/bash forge.sh learn, passthrough args). Explicit discovery only — neither flag given means nothing is scanned;--scan <dir>only checks that dir's IMMEDIATE child folders for a.claude/FORGE_*marker (one level, never recursive, never a whole-disk walk). Secrets/PII excluded:.env/.env.*/*.key/*.pem/*secret*/*credential*/id_rsa*are never opened, and every line read is redacted (reusing the same secret-pattern set the leak scan uses) before it can become a lesson — a line that still looks secret-shaped after redaction is dropped outright, never stored. Evidenced-only: a stored lesson is a verbatim quote from a real logged line (a decision-log row, a "what worked" note, a recurring owner-ask) tagged with its source project/file/line — never synthesised or summarised into a new claim; un-recorded history yields no lesson. Always read-only on other projects — its only write is to this project's own global lesson store. Use--dry-runfirst to see what WOULD be learned without writing anything. Loglessons_harvested(projects scanned, lessons stored, skipped-secret, skipped-non-canonical) after a real (non-dry-run) harvest.remember <text>/ "onthoud dat …" (WAVE B / B4) → promote an explicit owner instruction into a real, ACTIVE standing rule:node .claude/forge-bin/forge-standing.cjs remember "<text>" [--scope <scope>] [--trigger always|domain|glob|on-request] [--domain <domain>] [--glob <glob>] [--topic <topic>]. This is the ONLY sanctioned path that writes a newstatus:"active"rule — it stampssource:"owner /forge remember"(never a fabricated/inferred source) and can never mint a newcannot_override_corerule. Report the written rule id + text back to the owner.snapshot(owner request 2026-07-29,.claude/skills/forge-snapshot/SKILL.md) → manual/phase-boundary context-continuity snapshot:node .claude/forge-bin/forge-snapshot.cjs write --reason phaseregenerates.claude/FORGE_SNAPSHOT.mdfrom real sources (memory/task-history/work-packages/decisions/git/latest run events/doctor) — Mission preserved verbatim, every other section re-derived fresh, never a fabricated context percentage. This is also fired automatically by the wired PreCompact (matchersmanual+auto) hook and re-injected on the following SessionStart (matchercompact) — seeHOOKS_OPT_IN.mdsection 4 for the live wiring record.node .claude/forge-bin/forge-snapshot.cjs check --max-age-hours <n>reports staleness.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 119 lines · 68 tokens per session scan A ef4a80ea4122
forge is a command published in the GitHub repository ForgeyClap/claude-forge (2 stars, last pushed 29d ago), licensed MIT. It adds 68 tokens to every session and 9,381 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
MIGRATE_DESIGN
Design doc for the migration tool PR. Author: Sol ([email protected]). Co-authored-by: wakesync.
proposal
Create a structured feature proposal in docs/11-proposals/.
plan
Create a structured task-by-task implementation plan for a feature and write it to docs/superpowers/plans/.
diff-script
Compare an MDL script against the project's current state.
toh-help
Display all Toh Framework commands and quick usage guide.
issue-resolve
Drive an assessed gflow-cli issue (verdict CONFIRMED-BUG or LIKELY-BUG, with localized verifiable scope) to a fix: isolated worktree off develop, test-first fix, /gflow:check, then a DRAFT PR for human review. Mutating and gated — runs inside a strict action envelope (never merges, never spends credits, never marks a…