Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/nxtg-ai/forge-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/nxtg-ai/forge-plugin/nxtg-forge)<a href="https://agentmods.dev/plugins/nxtg-ai/forge-plugin/nxtg-forge"><img src="https://agentmods.dev/badge/plugins/nxtg-ai/forge-plugin/nxtg-forge/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/nxtg-ai/forge-plugin/nxtg-forge"><img src="https://agentmods.dev/badge/plugins/nxtg-ai/forge-plugin/nxtg-forge.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
nxtg-forge scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"$schema": "https://claude.ai/schemas/plugin.json",
"name": "nxtg-forge",
"displayName": "NXTG Forge",
"version": "3.14.0",
"description": "Governance-native AI development \u2014 33 agents, 24 commands, 27 skills, 27 hooks (4 blocking security guards, an opt-in enforced-task test guard and Stop gate, a Stop check on required command output, and Semgrep scanning), drift detection (needs a configured model), an optional CRUCIBLE test-review prompt, and shared memory for Claude Code (alpha)",
"defaultEnabled": true,
"author": {
"name": "NXTG AI",
"email": "[email protected]",
"url": "https://github.com/nxtg-ai"
},
"repository": "https://github.com/nxtg-ai/forge-plugin",
"license": "MIT",
"keywords": [
"governance",
"quality",
"testing",
"agents",
"orchestration",
"devops"
]
}
What it installs
The manifest is a name and a version. 27 skills, 24 commands, 33 agents travel with it, and installing the plugin installs all of them — 14,318 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill Architecture A 131 tokens
- Skill CLI Artisan Agent A 98 tokens
- Skill Coding Standards A 108 tokens
- Skill Integration Specialist Agent A 86 tokens
- Skill crucible-audit A 121 tokens
- Skill Agent Development A 83 tokens
- Skill Core NXTG-Forge A 161 tokens
- Skill Parallel Execution A 87 tokens
- Skill Testing A 161 tokens
- Skill verify-governance A 94 tokens
- Skill Backend Master Agent A 118 tokens
- Skill Browser Debugging A 115 tokens
- Skill Dev Environment Patterns A 105 tokens
- Skill Documentation A 112 tokens
- Skill Git Workflow A 92 tokens
- Skill Runtime Validation A 132 tokens
- Skill Skill Development A 74 tokens
- Skill Codex Framework A 118 tokens
- Skill Domain Knowledge A 99 tokens
- Skill Lead Architect Agent A 118 tokens
- Skill Optimization A 110 tokens
- Skill Platform Builder Agent A 115 tokens
- Skill QA Sentinel Agent A 108 tokens
- Skill ceo-loop B 142 tokens
- Skill Gemini Framework B 98 tokens
- Skill Claude Code Framework C 138 tokens
- Skill OWASP Security C 185 tokens
- Command feature A 9 tokens
- Command gap-analysis A 21 tokens
- Command init A 15 tokens
- Command status-enhanced A 7 tokens
- Command agent-assign A 5 tokens
- Command command-center A 7 tokens
- Command optimize A 10 tokens
- Command report A 5 tokens
- Command checkpoint A 6 tokens
- Command compliance A 12 tokens
- Command deploy A 8 tokens
- Command test A 8 tokens
- Command docs-audit A 5 tokens
- Command integrate A 6 tokens
- Command spec A 5 tokens
- Command task A 27 tokens
- Command docs-status A 5 tokens
- Command docs-update A 7 tokens
- Command restore A 6 tokens
- Command dashboard A 12 tokens
- Command status A 9 tokens
- Command ceo-loop B 82 tokens
- Command ceo-loop-cancel B 55 tokens
- Command update D 14 tokens
- Agent design-vanguard A 445 tokens
- Agent revenue-architect A 419 tokens
- Agent master-architect A 452 tokens
- Agent product-strategist A 658 tokens
- Agent qa-sentinel A 677 tokens
- Agent growth-engine A 463 tokens
- Agent incident-commander A 486 tokens
- Agent builder A 418 tokens
- Agent dx-engineer A 298 tokens
- Agent nxtg-ceo-loop A 171 tokens
- Agent scout A 425 tokens
- Agent wordsmith A 465 tokens
- Agent detective A 473 tokens
- Agent planner A 456 tokens
- Agent crucible-detective A 384 tokens
- Agent guardian A 430 tokens
- Agent oracle A 224 tokens
- Agent orchestrator A 420 tokens
- Agent governance-verifier A 187 tokens
- Agent testing A 252 tokens
- Agent ui A 221 tokens
- Agent analytics A 161 tokens
- Agent api A 175 tokens
- Agent compliance A 156 tokens
- Agent database A 152 tokens
- Agent devops A 168 tokens
- Agent docs A 187 tokens
- Agent integration A 168 tokens
- Agent learning A 175 tokens
- Agent performance A 174 tokens
- Agent refactor A 253 tokens
- Agent release-sentinel A 416 tokens
- Agent security B 254 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 883b65a98df9
- 5d ago Changed 45f344e062df
- 10d ago Changed 7a614592af71
- 11d ago Changed 2f8490fab858
- 1mo ago First seen · 24 lines scan A 6809649a5caf
nxtg-forge is a plugin published in the GitHub repository nxtg-ai/forge-plugin (6 stars, last pushed 4d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other plugins, from other repositories
atdd
Acceptance Test Driven Development for Claude Code. Enforces the ATDD methodology: write Given/When/Then specs first, generate a project-specific test pipeline, maintain two test streams (acceptance + unit). Inspired by Robert C. Martin's acceptance test approach from empire-2025.
crap-analyzer
Analyze recently-changed code for Change Risk Anti-Patterns. Computes CRAP per changed function across TypeScript, JavaScript, Python, Java, Kotlin, Go, Ruby, C#, Rust, and PHP. Auto-discovers how the repo generates coverage and proposes refactors + test stubs.
don-cheli-sdd
Full SDD (Spec-Driven Development) framework for Claude Code. 72+ slash commands (/dc:), 14 reusable skills, 15 reasoning models, TDD as an iron law, and i18n support (ES/EN/PT). Turn requirements into tested, documented, production-ready code through 7 disciplined lifecycle phases.
god-prompt-mcp
GodPrompt engineering workflows for task routing, TDD, debugging, verification, and progressive disclosure.
testing-expert
Test strategy and implementation: unit/integration/e2e, TDD, mocking, fixtures, and coverage.
macos-sandbox
Smoke-test macOS .app/.pkg in disposable Tart VMs via the macbox CLI or MCP.