The Forge CLI

forge mcp

Runs the Forge CLI as an MCP server over stdio. Once configured, AI clients like Claude Code and Cursor can search the registry, vet packages, audit your MCP configs, install skills, and publish — all inline in conversation, without you switching to a terminal.

Setup — add to your client config

{
  "mcpServers": {
    "forge": {
      "command": "npx",
      "args": ["-y", "@forge-registry/cli", "mcp"]
    }
  }
}

{
  "mcpServers": {
    "forge": {
      "command": "npx",
      "args": ["-y", "@forge-registry/cli", "mcp"]
    }
  }
}

{
  "servers": {
    "forge": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@forge-registry/cli", "mcp"]
    }
  }
}

{
  "mcpServers": {
    "forge": {
      "command": "npx",
      "args": ["-y", "@forge-registry/cli", "mcp"]
    }
  }
}

In Antigravity, open the agent panel's … menu → Manage MCP Servers → View raw config to edit this file; it reloads automatically on save.

Tools exposed

Example workflow

Ask your AI client: "I need a web scraping MCP — find something trustworthy and set it up." The client chains three calls without you leaving the conversation:

1. forge_search — finds verified web scraping servers, ranked by trust and downloads
2. forge_get_package — fetches the live trust profile of the top result: verified publisher, zero CVEs, clean install scripts
3. forge_audit — re-audits the project config after adding it to confirm nothing is now flagged

Supply-chain checking stops being a step you remember to do and becomes something your AI client does by default every time a new tool enters the project.

forge verify

Checks a package before you use it. Queries the Forge registry for trust status and publisher identity, runs a live OSV vulnerability scan against the exact version, and inspects npm lifecycle scripts for suspicious patterns.

forge verify <package>
forge verify @modelcontextprotocol/server-memory
forge verify @upstash/context7-mcp
forge verify sam-rivera/my-mcp-server     # GitHub shorthand

Example output

  $ forge verify @modelcontextprotocol/server-memory

  @modelcontextprotocol/server-memory · v2026.1.26
  ──────────────────────────────────────────────────────

  PACKAGE
    Author            Anthropic, PBC
    License           MIT

  REGISTRY
    Forge index       ✓  Listed
    Publisher         ✓  @modelcontextprotocol  (verified)
    forge.json        ·  Not present
    Signature         ✓  Valid  @modelcontextprotocol · Ed25519

  SECURITY  (scanned 2026-05-27)
    Vulnerabilities   ✓  None found
    Scripts           ✓  No suspicious lifecycle scripts

  ──────────────────────────────────────────────────────
  ✓  CLEAN & VERIFIED
  ──────────────────────────────────────────────────────

Options

Exit codes

forge install

A trust-aware wrapper around npm install. Runs the same checks as forge verify, then blocks on critical vulnerabilities and prompts before installing unverified packages. Accepts npm package names and GitHub URLs.

forge install <package>

# npm packages
forge install @modelcontextprotocol/server-memory
forge install @upstash/context7-mcp --save-dev

# GitHub sources (all equivalent)
forge install sam-rivera/my-mcp-server
forge install github.com/sam-rivera/my-mcp-server
forge install https://github.com/sam-rivera/my-mcp-server

Options

forge publish

Registers a package in the Forge registry under your GitHub identity. Generates an Ed25519 keypair on first run, signs the package manifest, and submits to the registry. The server verifies you are the repo owner or collaborator before listing the package.

# Run from your package directory
forge publish

# Preview — validates and signs but does not submit
forge publish --dry-run

# Different directory
forge publish --dir ./packages/my-mcp-server

What it does

1. Reads package.json and forge.json from the package directory
2. Generates an Ed25519 keypair at ~/.forge/keys/ if one doesn't exist
3. Signs the (packageName, githubUrl, publisherLogin) triple
4. Submits to the Forge registry — server runs the GitHub collaborator check
5. Auto-verified if you are the repo owner or collaborator. Otherwise queued for review.

Requirements

Your package.json must have a repository field pointing to a GitHub URL, and you must be logged in via forge login.

{
  "name": "@your-scope/my-mcp-server",
  "version": "1.0.0",
  "repository": {
    "url": "https://github.com/your-username/my-mcp-server"
  }
}

forge login

Authenticates with GitHub using the device flow. Saves your token to ~/.forge/config.json. Required before running forge publish.

forge login            # authenticate
forge login --logout   # remove stored credentials

  $ forge login

  Forge uses GitHub to verify publisher identity.

  AUTHORIZE
    URL     https://github.com/login/device
    Code    ABCD-1234

  Open the URL above and enter the code to continue.

  ──────────────────────────────────────────────────────
  ✓  Logged in as @sam-rivera
  ──────────────────────────────────────────────────────

Installing the CLI

The CLI can be used without installing via npx, or installed globally for the forge shorthand.

npx (no install)

npx @forge-registry/cli verify @modelcontextprotocol/server-memory
npx @forge-registry/cli install @upstash/context7-mcp

Global install

npm install -g @forge-registry/cli

# then use the forge shorthand
forge verify @modelcontextprotocol/server-memory
forge login
forge publish

Requirements

Node.js 18 or later.

Configuration

The CLI stores credentials and settings in ~/.forge/config.json, written by forge login. All values can be overridden with environment variables.

{
  "githubToken":  "gho_...",
  "githubLogin":  "sam-rivera",
  "registryUrl":  "https://forgeregistry.com"
}

Environment variables

Publisher keys

An Ed25519 keypair is generated on your first forge publish and stored at ~/.forge/keys/. The private key (private.pem) is written with mode 0600 — readable only by you. The public key is registered in the Forge registry and used to verify your signature whenever anyone runs forge verifyon your package.