Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/nxtg-ai/forge-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/nxtg-ai/forge-plugin/update)<a href="https://agentmods.dev/commands/nxtg-ai/forge-plugin/update"><img src="https://agentmods.dev/badge/commands/nxtg-ai/forge-plugin/update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/nxtg-ai/forge-plugin/update"><img src="https://agentmods.dev/badge/commands/nxtg-ai/forge-plugin/update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00014 | $0.01222 |
| Opus 5.5 | $0.00006 | $0.00489 |
| Sonnet 5.5 | $0.00003 | $0.00244 |
| Haiku 4.5 | $0.00001 | $0.00122 |
Grade D, and why
update scanned grade D with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
echo "=== installed_plugins.json ===" && cat ~/.claude/plugins/installed_plugins.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); [print(f'{k}: {[s.get(\"scope\",\"?\") for s in v]}') for k,v in d. Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf ~/.claude/plugins/marketplaces/*forge* How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forge Update
You are the Update Agent — pull the latest Forge plugin and refresh project config. Includes a built-in workaround for Claude Code #29071 (stale marketplace cache).
Parse Arguments
Arguments received: $ARGUMENTS
Options:
- No arguments: Check for updates, update plugin, refresh project config
--check: Only check what would be updated (no changes)--plugin: Only update the plugin itself--config: Only update governance config and hooks
Step 1: Detect Current Install
The plugin may be registered under different names (forge, forge@forge, etc.) and scopes (local, user). Run:
echo "=== installed_plugins.json ===" && cat ~/.claude/plugins/installed_plugins.json 2>/dev/null | python3 -c "import sys,json; d=json.load(sys.stdin); [print(f'{k}: {[s.get(\"scope\",\"?\") for s in v]}') for k,v in d.get('plugins',{}).items() if 'forge' in k.lower()]" 2>/dev/null || echo "no installed_plugins.json"
echo "=== marketplace dir ===" && ls -d ~/.claude/plugins/marketplaces/*forge* 2>/dev/null || echo "no marketplace clone"
echo "=== plugin.json version ===" && cat ~/.claude/plugins/marketplaces/*forge*/.claude-plugin/plugin.json 2>/dev/null | python3 -c "import sys,json; print(json.load(sys.stdin).get('version','?'))" 2>/dev/null || echo "unknown"
Display:
## Forge Update
**Installed:** {plugin identifier} ({scope})
**Marketplace version:** {version from marketplace clone}
Step 2: Sync Marketplace (#29071 bypass)
Claude Code's plugin update fetches but never merges the marketplace clone. We pull it ourselves first.
MARKETPLACE_DIR=$(find ~/.claude/plugins/marketplaces/ -maxdepth 1 -name "*forge*" -type d 2>/dev/null | head -1)
if [ -n "$MARKETPLACE_DIR" ]; then
cd "$MARKETPLACE_DIR" && git pull --ff-only origin main 2>&1 || git pull --ff-only origin master 2>&1
NEW_VERSION=$(python3 -c "import json; print(json.load(open('.claude-plugin/plugin.json')).get('version','?'))" 2>/dev/null)
echo "SYNCED: $MARKETPLACE_DIR → v$NEW_VERSION"
else
echo "NO_MARKETPLACE_CLONE"
fi
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago Changed b6c733b1f9ab
- 1mo ago Changed · +9 lines · +14 tokens per session scan A → D 01b242dfa506
- 1mo ago First seen · 122 lines · 0 tokens per session scan A b591ff956757
update is a command published in the GitHub repository nxtg-ai/forge-plugin (6 stars, last pushed 4d ago), licensed MIT. It adds 14 tokens to every session and 1,222 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it D with 2 findings (reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
paul:help
Show available PAUL commands and usage guide.
paul:verify
Guide manual user acceptance testing of recently built features.
deep-audit.skeleton
Description: This section is populated by Bootstrap with manifest data. Required manifest fields: project.description, stack.primary, project.structure, project.subprojects, stack.orm, stack.authmethod Example output.
mutate
Run mutation testing to verify test quality. Builds a custom mutation tool or uses an existing framework, runs mutations, and reports the mutation score with surviving mutants.
hatch3r-refactor-plan
Plan a refactoring or migration effort -- spawn parallel researchers, produce refactoring spec, ADR(s), and phased todo.md entries for board-fill.
test-coverage
Analyze test coverage and identify the highest-value gaps to fill.