100 tests passing Go + SQLite MIT no cloud, no daemon

your agent needs an
operating system

forge is a local-first agent runtime. one binary. memory that survives restarts. sandboxing that strips secrets. observation that logs every tool call. MCP servers resolved and started automatically. you write a config file. forge handles the rest.

get started view source
forge run my-agent.toml
$ forge init my-agent created my-agent.toml edit it, then run: forge run my-agent.toml $ forge run my-agent.toml starting agent my-agent (id: my-agent-1721934521) model: claude-sonnet sandbox: true (fs overlay, env sanitized, 22 secret patterns stripped) memory: cairn (sqlite, temporal) mcp servers: 3 (filesystem, git, cairn) observe: log=true trace=true agent running. pid: 42817 press Ctrl+C to stop
THE PROBLEM
you're wiring agents by hand

today you edit json configs for MCP servers. you hope they're secure. you can't see what your agent does. you can't sandbox it. you can't give it memory that persists. you can't run two agents at once. every setup is bespoke, fragile, unobservable.

forge replaces all of that with one config file and one command.

THE DIFFERENCE
manual config vs forge
without forge
doing it yourself
edit json, hope it works
no memory across restarts
no sandboxing
console.log for debugging
manual MCP server setup
no security scanning
one agent at a time
notifications drown you
capability
start an agent
agent memory
sandboxing
observation
MCP management
security
multi-agent
notifications
with forge
forge run
forge run agent.toml
cairn (sqlite, temporal)
vault (fs, env, network)
observer (trace, search, stats)
smith (install, compose, secure)
mcprobe (injection, shadowing)
forge list, forge kill
pulse (filtered, prioritized)
UNDER THE HOOD
what happens when you type forge run
1

load config

parses your TOML. validates agent name, model, command. sets defaults for everything else.

2

sandbox setup

creates filesystem overlay. strips 22 secret patterns from env (GITHUB_TOKEN, AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, ...). blocks .ssh, .aws, .env, .gnupg. applies network allowlist.

3

memory init

opens sqlite store. one file per agent. facts persist across restarts. temporal -- remembers when facts were stored.

4

MCP resolution

resolves each server from config. npm packages via npx, git repos, local paths. logs resolution to observer.

5

agent starts

spawns the agent process. wires stdout/stderr to log files. process managed by forge -- forge list shows it, forge kill stops it.

6

observation wired

every tool call logged to sqlite. search by tool name, agent id, or input. stats per tool. trace replay for debugging.

THE MODULES
each tool is a kernel module

forge ties the Valtors ecosystem together. 8 tools, each standalone, all wired by forge.

cairn
rust
agent memory. temporal knowledge store in sqlite.
cargo install cairn-memory
vault
go
agent sandbox. fs overlay, env sanitizer, net policy.
go install github.com/valtors/vault
observer
go
tool call logging. trace tools, search history, stats.
go install github.com/valtors/observer
smith
rust
MCP package manager. install, compose, secure servers.
cargo install smith-mcp
mcprobe
go
MCP security scanner. injection, shadowing, baseline drift.
go install github.com/tamish560/mcprobe
pulse
go
notification agent. filtered, prioritized, remembered.
github.com/valtors/pulse
relay
go
one MCP server for files, web, PDFs, images.
npx userelay
reflow
ts
SSR-safe responsive toolkit for TypeScript.
npm install usereflow
GET STARTED
install in 30 seconds
terminal
# install go install github.com/valtors/forge@latest # create an agent config forge init my-agent # edit it vim my-agent.toml # run with all services wired forge run my-agent.toml # see running agents forge list # check status forge status

stop wiring agents by hand

one binary. one config file. everything else is automatic.

view on github install now