start

start is a command for Claude Code from Hassaan146/forge-mentor. It costs 18 tokens per session (4,678 once invoked), scanned A, original, MIT.

A security rule set for generated code that always applies during Forge work. It covers password storage, database queries, secrets, input validation, error messages, outside text, and server-side permissions.

In plain words
What is it for?
Use it when generating or reviewing code that handles accounts, databases, secrets, user input, errors, external content, or access control.
Why use it?
It prevents common security mistakes from being treated as optional project decisions. It also keeps untrusted text from being mistaken for instructions.

Command for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable. Also seen: reads .claude/ paths; mentions subagents; names the AskUserQuestion tool.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the forge plugin — 4 skills, 6 commands, 4 agents, 4 hooks, 1 MCP server shipped together

Good fit Use it when generating or reviewing code that handles accounts, databases, secrets, user input, errors, external content, or access control.

Compare 6 commands from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add Hassaan146/forge-mentor
Claude Code
/plugin install forge

Made for: Claude Code.

Or install forge, the plugin that ships this one along with the rest of its 4 skills, 6 commands, 4 agents, 4 hooks, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for start

README.md
[![agentmods](https://agentmods.dev/badge/commands/hassaan146/forge-mentor/start.svg)](https://agentmods.dev/commands/hassaan146/forge-mentor/start)
Your own site
<a href="https://agentmods.dev/commands/hassaan146/forge-mentor/start"><img src="https://agentmods.dev/badge/commands/hassaan146/forge-mentor/start.svg" alt="Measured on agentmods" height="20"></a>
Per session 18 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 4,678 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00018 $0.04678
Opus 5 $0.00009 $0.02339
Sonnet 5 $0.00004 $0.00936
Haiku 4.5 $0.00002 $0.00468

Measured 7d ago against content hash ce3aa20c9587, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

start scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/start.md · 393 lines

How it starts

The opening of the file, as written. The whole thing — 393 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/forge:start

Turn this project into a Forge project. Run the setup interview, then begin the foundation interrogation.

Forge only acts in projects where this command has been run. Every other project stays plain Claude Code.

If this project already has notes

Call resume first. If .claude/forge/ exists, this is not a new project and Steps 1 to 5 below are not for it. resume reads the notes and returns the question that was on screen when the session closed, in the same shape.

  1. Print the banner and the update check as below. Skip the readiness check and the colour key: both were shown when this project was set up.
  2. Say at most one line of where things stand. Its resume field is that line.
  3. Paste its block verbatim if there is one, and stop. That is the turn.
  4. If block is empty, follow its next.

If it returns needs_repair, the notes are damaged: say so and run /forge:status, which is where repair lives. Do not offer to start again: a project's decisions are not something to re-ask for want of a header.

Nothing else happens on this path. No setup interview, no permission requests, and above all no foundation question that already has an answer: asking one twice is the fastest way to lose a user's trust in the record.

If Forge was switched off here

If .claude/forge/paused.md exists, someone ran /forge:stop in this project. Delete it, say in one line that Forge is back on, and then take the resume path above. The answers are already recorded.

Step 0 — is the engine even here?

Call color_legend first. It reads nothing and changes nothing, and it is Forge's own MCP tool, so it answers one question no readiness check can: is the engine loaded in this session.

If it is not available, the user installed Forge during this session and the engine was never started. Do this and nothing else:

python "${CLAUDE_PLUGIN_ROOT}/scripts/forge_ui.py" engine

Paste that block as your whole reply and stop. No banner, no readiness check, no explanation of how plugins load, no account of what would go wrong if you asked the questions by hand. All of that was on a real screen and none of it was the answer, which is one command long. The block already carries the two steps and the fallback.

Read the full file on GitHub · 393 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 393 lines · 18 tokens per session scan A ce3aa20c9587

Subscribe to this mod's changes

start is a command published in the GitHub repository Hassaan146/forge-mentor (22 stars, last pushed 21d ago), licensed MIT. It adds 18 tokens to every session and 4,678 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.