
Product
Socket Threat Intel Now Shows Which Malware Campaigns Were Blocked or Detected
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.
@firatcand/forge
Advanced tools
A lightweight framework for shipping software products from idea to production with AI coding agents (Claude Code, Codex CLI, Cursor, Gemini)

A lightweight coding agent framework that takes you from idea to production with structure, not friction.
Forge is for solo founders and small teams who want to ship real products with coding agents — not just experiment with it. It gives you a structured workflow for the parts that matter (ideation, decomposition, phase gates, learning capture) and stays out of your way for the parts where Claude Code already shines (planning, implementing, reviewing).
Forge ships:
IDEA → /forge → spec/BRIEF.md
→ /draft-prd → spec/PRD.md
→ /draft-spec → spec/SPEC.md
→ /draft-design → spec/DESIGN.md (optional, for UI products)
→ /ingest-spec → spec/CONTEXT.md (validation pass)
→ /decompose → plans/phases.yaml
→ /setup-repo → GitHub repo wired
→ /push-to-tracker → tracker project + per-phase grouping + issues
TASK → /pickup-task → /plan-task → /implement
→ /review → /qa → /second-opinion → /ship → /learn
PHASE → /phase-gate → /retro → next phase
PROD ← /phase-gate phase-3 ← (release from main)
~90-120 minutes from raw idea to first task ready to implement.
The
/-prefixed names above are the Claude Code experience — typed slash commands. In other hosts (Codex CLI, Cursor, Gemini CLI), the same skills are available but invoked differently. See Cross-tool support below.
One command. No git clone, no setup script.
npx @firatcand/forge
This runs an interactive setup that:
# Install forge globally (one time)
npx @firatcand/forge
# Initialize a new project
mkdir my-product && cd my-product
npx @firatcand/forge init
# Add your tracker API key to the git-ignored .forge/.env (e.g. for Linear)
echo 'LINEAR_API_KEY=lin_api_...' >> .forge/.env
# Open your AI coding tool — see Cross-tool support below for per-host invocation
claude
> /forge # discovery interview → spec/BRIEF.md
> /draft-prd # → spec/PRD.md
> /draft-spec # → spec/SPEC.md
> /decompose # → plans/phases.yaml
> /setup-repo # GitHub repo wired
> /push-to-tracker # tracker project + per-phase grouping + issues
> /pickup-task # claim first task, worktree created
In Codex CLI, the same skills are installed but Codex doesn't expose user-defined slash commands — invoke them by description instead, e.g. Run forge's discovery interview for my project idea: .... Codex's model picks the skill up from ~/.codex/skills/forge/SKILL.md.
npx @firatcand/forge install # Install/reinstall forge skills + agents only
npx @firatcand/forge doctor # Audit installed skills + agents per detected tool
npx @firatcand/forge init [name] # Initialize a project in current directory
npx @firatcand/forge companions # Install founder-skills companions only
npx @firatcand/forge --help # Show all commands
npx @firatcand/forge --version # Show version
If a slash command stops triggering in one of your AI tools (e.g. you installed Codex CLI after running forge for the first time), run npx @firatcand/forge doctor to see exactly what's installed where, then npx @firatcand/forge install to sync.
The installer detects which tools you have and installs forge skills + subagents into each. The skills land in every host, but how you invoke them differs by host.
| Host | Install path | How to invoke a forge skill | Status |
|---|---|---|---|
| Claude Code | ~/.claude/skills/, ~/.claude/agents/ | Typed slash commands: /forge, /draft-prd, … | ✅ Verified |
| Codex CLI | ~/.codex/skills/, ~/.codex/subagents/ | Natural language — Codex doesn't expose user slash commands. Ask the model: "Run forge's discovery interview for …" | ✅ Skills load; no /forge syntax |
| Cursor | ~/.cursor/skills/, ~/.cursor/agents/ | Unverified — invocation mechanism not yet tested by maintainer | ⚠️ Unverified |
| Gemini CLI | ~/.gemini/extensions/ | Unverified — uses Gemini's extensions format, may need manual config | ⚠️ Unverified |
If you're on Codex/Cursor/Gemini and /forge doesn't trigger, that's expected — try the natural-language form. Run npx @firatcand/forge doctor to confirm the skills are physically present at the expected paths.
If you discover the right invocation pattern for Cursor or Gemini and it differs from natural language, please open an issue or PR — the maintainer is actively looking for confirmation on those two.
Forge is what you do when you have raw material (an idea) and want a finished tool (a product). The process is heat, pressure, shape, repeat. The framework's namesake skill /forge is a discovery interview that applies pressure to your raw idea until structure emerges.
Forge stands on the shoulders of:
What forge adds:
spec/DESIGN.md, with optional reference to an external brand asset as a generation guideline (no runtime inheritance)Forge is v0.4.0 — used in production by the maintainer for solo founder workflows. Stable enough to depend on, raw enough that you'll find sharp edges. Issues and PRs welcome.
MIT. See LICENSE.
See CONTRIBUTING.md. The contribution model is gstack-shaped: skills as markdown files, principles in ETHOS.md, no exotic dependencies.
FAQs
A lightweight framework for shipping software products from idea to production with AI coding agents (Claude Code, Codex CLI, Cursor, Gemini)
The npm package @firatcand/forge receives a total of 31 weekly downloads. As such, @firatcand/forge popularity was classified as not popular.
We found that @firatcand/forge demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.

Security News
Fixes for eMudhra and Brotli are out. Getting them everywhere they’re needed means tracking down bundled libraries, runtimes, and certificate stores.

Threat Research
/Security News
Socket uncovered secret-stealing workflows that ran in LiteLLM’s GitHub repository 11 days before the supply chain attack on PyPI and Docker.