Open source · MIT · runs entirely offline

A local AI agent that asks first.

Forge drives a language model running on your own computer and lets it do real work — run terminal commands, edit files, call MCP tools. Every single action stops and waits for you. Nothing is sent anywhere.

Get it on GitHub See how it works

Every command becomes a work order

When the model wants to do something, the server stops and blocks. You see the exact command, the model's stated reason, and a risk level. Nothing runs until you click.

#002 run_command built-in High risk

Delete the temporary cache directory to clean up unused resources.

rm -rf ./cache

Approve & run Deny

Risk is graded

rm, Remove-Item, git push --force, curl | sh and friends are flagged high before you ever read the command.

Files are sandboxed

Read and write tools are confined to the workspace folder. Paths that try to escape it are rejected outright.

Denial is enforced server-side

The tool call blocks on a promise. A denial resolves it without ever reaching your shell.

It learns procedures

Skills are markdown files the model reads — and writes for itself — so the install gets more capable over time.

One honest caveat. Small models sometimes narrate wrongly — in testing, a 7B model denied a command and then wrote that it had succeeded. The work order cards reflect real server state; the chat text is commentary. When they disagree, trust the cards.

See what you are not spending

Forge counts the tokens you actually use and prices the same work against paid APIs, fetched live rather than hardcoded. Figures below are a real session.

Model	Vendor	In / M	Out / M	This session
GPT-5.5	OpenAI	$5.00	$30.00	$0.127
Claude Opus 5	Anthropic	$5.00	$25.00	$0.125
Gemini 3.1 Pro	Google	$2.00	$12.00	$0.051
Claude Sonnet 5	Anthropic	$2.00	$10.00	$0.050
granite4:7b — local	you	$0.00	$0.00	$0.00

Forge also measures tool-calling rather than trusting what a model advertises. One popular coding model claims tool support and is scored text only, because it prints the call as prose instead of emitting it — a difference that is invisible until an agent loop silently does nothing.

What Forge is not

It controls the computer it runs on. The web page is just the steering wheel.

Not a hosted service. Installing it on a web server gives the model a shell on that server, not your laptop.
Not something to put on a public URL. That publishes a shell to anyone who finds it.
Install it on each machine you want to drive, and open it locally.
To reach it from another device, use a private network — Tailscale, or an SSH port-forward.

Install

Needs Node 20+ and Ollama.

git clone https://github.com/siterepository/forge.git
cd forge
npm install
ollama pull granite4:7b-a1b-h
npm start

  Forge  →  http://127.0.0.1:4317

  ┌─ FIRST RUN — this password is shown once ─────────────
  │  xK7pQm2Rt9Wv4Nz-bYhF3sLd
  └─ stored hashed in auth.json (scrypt). Save it now. ──

Sign-in is required, sessions are scrypt-backed, and the server binds to loopback by default. Read the security notes →