JSPM

English · Español

Set up any project to work with AI agents in a single command

One agent team, every runtime — 19 runtimes (4 native + 15 rules-based editors) from a single project.yaml.

Landing   •   Documentation   •   npm   •   Issues

npx @cristiancorreau/forge init

_{The forge interactive panel (forge panel) requires Bun (OpenTUI) — explore agents, skills, hooks and profiles without leaving the terminal.}

What is forge?

forge is a multi-runtime agentic development framework. A single command analyzes your project, installs a team of specialized agents, wires up security guardrails, and leaves a project.yaml as the single source of truth from which each AI runtime's native configuration is regenerated.

Instead of copy-pasting agent rules across projects and across tools, you define the team once and forge materializes it for all 19 supported runtimes.

• 🤖 Multi-runtime agent teams — 7 universal agents + 19 stack profiles
• 📐 Spec-first SDD flow — no code task without an APPROVED spec
• 🪝 Guardrail hooks in pure JS — branch-guard, debug, secrets and prod-safety, zero Python
• 🔁 One project.yaml, every CLI — 19 runtimes: 4 native + 15 rules-based
• ⚖️ Compliance with binding veto — GDPR/LGPD/CCPA reviewer that blocks the merge
• 🔄 Reversible operations — SHA-256 manifest + --dry-run to audit every change
• 📚 Project knowledge base — wiki that ingests, lints and answers with citations

Why forge?

vs. hand-made agent rules

• One project.yaml, four runtimes — you write the team once, not four times.
• Spec-first by default — the orchestrator refuses to spawn agents without an approved spec.
• Guardrails already wired — security hooks ready to go, no Python to install.
• Regenerable — forge generate rebuilds the entire team from the source of truth.

vs. copy-pasting agents across projects

• Composable TIERs — universal → stack → domain, with predictable collision resolution.
• 19 stack profiles ready to go — Next.js, FastAPI, Django, Rails, Laravel, Go, Rust, Flutter…
• Reversible operations — SHA-256 manifest detects drift; forge teardown uninstalls cleanly.
• Drift under control — forge update re-syncs with the catalog while preserving your edits.

Installation

forge runs on Node.js 20+. With Bun you unlock the full-screen panel (OpenTUI, @opentui/core); on Node it falls back to @clack prompts; on legacy consoles, to ASCII.

Try without installing:

npx @cristiancorreau/forge init

Install the global forge command:

npm install -g @cristiancorreau/forge

pnpm add -g @cristiancorreau/forge     # pnpm  (requiere `pnpm setup` una vez)
bun add -g @cristiancorreau/forge      # bun   (requiere ~/.bun/bin en el PATH)

Quickstart (30 s)

# 1. Inicializa forge en tu proyecto
#    (wizard: detecta stack, instala agentes + hooks, escribe el manifest)
npx @cristiancorreau/forge init

# 2. Verifica el entorno y la conformidad
forge doctor
forge validate

# 3. Regenera la configuración nativa de cada runtime desde project.yaml
forge generate

Already have a codebase up and running? Integrate it without starting from scratch:

forge adopt        # analiza el repo existente + auto-wiki

The 5 layers

forge is organized into five layers that go from the source of truth to per-runtime materialization.

TIER system

Three composable levels, from the general to the specific. Each tier inherits and specializes the previous one; on a collision, the most concrete one wins.

Full detail in docs/en/tiers.md.

Commands

The 16 CLI commands.

Interactive panel. With Bun, forge panel (and the post-init dashboard) opens a navigable OpenTUI panel to explore agents, skills, hooks and profiles without leaving the terminal. With Node it falls back to the standard prompt flow.

Stacks / Profiles (19)

Tier 2 profiles ready to activate. Each one brings architecture rules, code conventions and framework patterns.

Runtimes

A single forge project adapts to four runtimes, each with its native output.

Per-runtime detail in docs/en/runtimes/.

VS Code extension

The forge Agent Framework extension (cristiancorreau.forge-agent-framework) surfaces the CLI inside VS Code: run init, audit, doctor, generate and other commands from the Command Palette and the sidebar panel, without leaving the editor.

Status: v0.6.0 is packaged but pending publication to the Marketplace (the current live version is 0.5.0). Publishing requires a valid VSCE_PAT secret loaded in the repository.

Trigger the publish: push tag vscode-v0.6.0 or dispatch the publish-vscode workflow manually — both require the VSCE_PAT secret (Azure DevOps PAT, scope Marketplace › Manage).

Full development and publishing instructions: vscode-extension/README.md.

Skills

12 general skills that encapsulate complete flows, mapped per runtime and triggerable as slash commands (/spec, /new-feature, /db-migrate…), plus per-stack skills.

In addition, session-start and session-close are available as CLI commands.

Per-stack skills. The Laravel profile adds 5 Laravel 13-oriented skills: /laravel-eloquent, /laravel-pest, /laravel-security, /laravel-verify and /laravel-mcp (Boost, laravel/mcp, AI SDK, embeddings/pgvector).

Full catalog in docs/en/skills.md.

SDD: spec-first, not optional

forge enforces Spec-Driven Development with a real gate, not a suggestion:

• No code task starts without a spec in the APPROVED state inside docs/specs/.
• The orchestrator vetoes spawning implementation agents if there is no approved spec.
• The /spec skill drafts the spec; /new-feature takes it from plan to deploy.

The result: the agent team doesn't improvise code on top of ambiguous requirements — first the what is agreed upon, then the how is generated.

Compliance with binding veto

The compliance-reviewer agent (Tier 1, model opus) reviews every PR against the active compliance frameworks — GDPR / LGPD / CCPA — with binding veto power before merging.

On top of the guardrail hooks in pure JavaScript (zero Python):

• 🚫 branch-guard — prevents direct commits on protected branches.
• 🐛 debug detection — blocks console.log / print debug statements.
• 🔐 secret detection — stops hardcoded secrets before the commit.
• 🚀 prod-safety — protects sensitive operations against production.

Comparison

Documentation

• 🌐 Landing — the pitch on one page.
• 📖 Full guide
• 🧩 Skills
• 🏗️ TIERs
• 📚 Wiki / knowledge base
• 📡 Runtimes

npx @cristiancorreau/forge init

License

Apache-2.0 — Copyright © 2026 Cristian Correa.