Borrowing it
Nothing to install: this file belongs to ForgeyClap/claude-forge. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ForgeyClap/claude-forge/main/.claude/skills/forge-mcp-clients/SKILL.mdgit clone --depth 1 https://github.com/ForgeyClap/claude-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/forgeyclap/claude-forge/forge-mcp-clients)<a href="https://agentmods.dev/skills/forgeyclap/claude-forge/forge-mcp-clients"><img src="https://agentmods.dev/badge/skills/forgeyclap/claude-forge/forge-mcp-clients/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/forgeyclap/claude-forge/forge-mcp-clients"><img src="https://agentmods.dev/badge/skills/forgeyclap/claude-forge/forge-mcp-clients.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00046 | $0.02176 |
| Opus 5 | $0.00023 | $0.01088 |
| Sonnet 5 | $0.00009 | $0.00435 |
| Haiku 4.5 | $0.00005 | $0.00218 |
Grade A, and why
forge-mcp-clients scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Forge playbook — MCP-as-client doctrine (dormant, opt-in)
Do not duplicate the config — defer to: config/orchestration/mcp-registry.json (the server catalog)
and config/orchestration/mcp-grants.json (the per-Boss least-privilege matrix) as the single source of
truth for tiers, servers, and grants. This file is doctrine/orchestration only — it explains how to use
those configs correctly, it does not re-list every server or re-derive the matrix.
Hard rules
- Nothing here installs, connects to, or activates any MCP server. The zero-dependency Forge default (fs/path only, no live network client) stays 100% intact until the owner explicitly opts a server in.
- A server is usable only when both are true: (1) the owner has opted it in (a marker naming the
server id — see "Opt-in flow" below), and (2) the requesting Boss's grant covers it (tier + server
id, per
mcp-grants.json). Either condition failing means dormant → honest native fallback. - Tier 3 (WRITE-PRIMITIVE) is never auto-used. Every tier-3 call routes through the existing
forge-actiongate.cjshard-gate classifier (the same one used for deploy/push/spend/DNS/etc.) — it is never bypassed and never reimplemented in parallel. - Never claim an MCP tool ran, was available, or was opted in when it wasn't. Absence is reported as a labeled native fallback, not silently skipped.
What "MCP-as-client" means here
Forge already ships one MCP artifact: forge-bin/forge-mcp.cjs, a read-only server that exposes this
project's own Forge run state (runs/events/reports/memory) to an external MCP host. That is Forge acting
as a server — unrelated to this skill.
This skill is the opposite direction: Forge (its Bosses) acting as an MCP client, consuming external MCP servers (docs lookup, web search, browser automation, GitHub, etc.) as extra tools during a task. The client side is deliberately dormant by default — a catalog and a validator, not a running connection.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 119 lines · 46 tokens per session scan A d2f0f058a8c1
forge-mcp-clients is a skill published in the GitHub repository ForgeyClap/claude-forge (2 stars, last pushed 1mo ago), licensed MIT. It adds 46 tokens to every session and 2,176 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
flame-harness-evaluator
Phase 6 — skeptical QA. Run the game, watch it, then judge against the contract. Default = functional check; --strict adds quality and edge-case passes.
flame-harness-admob
Phase 7 — analyze the game, decide a rewarded-ad strategy, guide manual AdMob ad-unit creation, and inject googlemobileads + ATT/UMP consent code.
flame-harness-submit
Phase 10 — upload store text metadata + categories via fastlane, then pause with exact manual steps for the final iOS review submission and Android production promotion.
flame-harness-design
Phase 3 — define the Flutter designtokens.dart spec (palette, typography, spacing), the game's art/visual concept, and the asset/audio sourcing plan.
flame-harness-retro
Phase 11 — score the completed pipeline against Anthropic's 9 harness principles plus game quality, and write the retrospective.
flame-harness-screenshot
Phase 9 — capture store screenshots in the game's configured locales via integrationtest (ads hidden), fill ASO keywords, and upload via fastlane.