AI Coding Agent Governance
Put a real harness around your agent.
One binary configures Claude Code, Cursor, Codex and 21 more to follow one spec-driven workflow — then stops the loop the moment a gate opens.
It configures the agents you already use.
Twenty-four dedicated adapters, plus a generic one for everything else. Forge detects what is installed and writes each agent its own native format. It never asks you to switch tools.
VS Code's Agents window gets more than config — a dedicated plugin bundling skills, subagents, an MCP server, and lifecycle hooks as one install. See how it installs.
- Claude Code
- Codex
- Cursor
- OpenCode
- Gemini CLI
- VS Code Copilot
- Windsurf
- Kilo Code
- Roo Code
- Google Antigravity
- Kimi Code
- Qwen Code
- Kiro IDE
- OpenClaw
- Trae IDE
- Hermes
- IBM Bob
- Amazon Q Developer CLI
- Amp
- Qoder CLI
- CodeBuddy CLI
- Auggie CLI
- SHAI
- Pi
Your agent says the tests pass.
Every agent narrates its own compliance, and an agent that can be advised can talk itself past the advice. Here are four places where that stops being a matter of style.
- “Tests pass.”
The suite never ran.
The verify circuit-breaker counts actual verdicts, and opens after three failures in a row instead of letting the loop grind on.
- “Almost done.”
It has been almost done for an hour.
The spend budget bounds the run in tokens, dollars, or tool calls, and escalates to a human at the ceiling.
- “Safe to commit.”
There is a live credential in a test fixture.
The secret and PII scan walks the tree before anything reaches a commit.
- “That command is fine.”
It is irreversible, and the path is not what it thinks it is.
The guardrails gate stands in front of the action rather than grading it afterwards.
None of these are model failures. They are missing gates. Agents write the code alone now. The gate is what makes that safe to ship.
One workflow. Depth that scales to the change.
A typo fast-forwards straight to implement and verify. A risky feature runs the whole spine. You do not pick the ceremony, the change does.
- 01exploreRead the code before deciding anything.
- 02proposeIntent and scope, written down.
- 03specifyRequirements and scenarios.
- 04clarifyResolve the ambiguity now, not mid-build.
- 05planArchitecture and approach.
- 06tasksAn ordered, checkable list.
- 07implementCode, following the spec.
- 08verifyTests and build, against the contract — in an isolated copy.
- 09archiveMerge the delta spec, close the change.
Gates that actually stop the loop.
Most agent tooling advises. These return a non-zero exit and end the run. That is the whole difference.
The guardrails gate
Blocks the edit before it lands. Non-zero exit, not a warning the agent can talk itself past.
Read moreVerify circuit-breaker
Three failed verifies and the implement loop stops, instead of grinding through your budget.
Read moreSpend budget
A hard ceiling on what a run may cost. It escalates to a human at the limit.
Read moreSecret and PII scan
Catches the credential the agent pasted into a fixture before it reaches a commit.
Read moreAn attributed timeline
Every gate decision, tool call, and spend event, on one per-change record you can read and diff.
Read moreYour code never leaves your machine.
Forge has no model of its own and is not a hosted service. It configures agents you already have and runs locally from a single static binary. It does send anonymous usage and error telemetry — command name, version, OS/arch, a random install ID, never your source or secrets — and FORGE_NO_TELEMETRY=1 turns that off.
Your specs, timeline, and spend records live on disk under .forge/, where you can read them, diff them, and commit them. State survives context compaction, agent restarts, and handoffs between people.
What it changed.
Forge is bought by developers, not procurement departments. What the enforced controls change, day to day.
A change failed verify 11 times overnight and burned a weekend of budget before anyone noticed. Now the loop stops at 3, and the spend ceiling stops the run before I have to. It paid for the license the first week.
The approach gets argued out in the spec file now, before a line is written. When a session dies or I switch agents, it picks up from the same spec and task list instead of me re-explaining the whole thing.
Secscan caught a live API key someone had dropped into a test fixture, before it got committed. That ended the debate about whether we needed this.
An agent went to force-push over our shared branch and the gate refused it outright. The part I did not expect was the log: every gate decision on one file I can actually read in the PR.
Trusted by engineers working at
