@forgespace/core
Advanced tools
Shared configuration, workflows, and architectural patterns for the Forgespace ecosystem
Shared standards, patterns, and MCP context server for the Forge Space ecosystem.
Part of Forge Space — the open full-stack AI workspace. This repo provides the foundation that all other Forge Space projects build on: code quality standards, security framework, CI/CD workflows, and a local MCP context server for IDE integration.
Forge-Space Core provides shared configurations, workflows, and architectural patterns for consistency across the ecosystem. Centralized feature toggles, reusable GitHub Actions workflows (95% reduction in maintenance overhead), and comprehensive security validation.
Forge-Space Core now defines an explicit tenant contract and enforces decoupling checks to keep platform code tenant-agnostic.
TenantProfile and validators from src/tenant/contract.tstenant_idgithub_ownersonar_orgnpm_scopequality_policyci_policynpm run check:tenant-decoupling
src, patterns, scripts, .github)rg when available and automatically falls back to grep on constrained runnersrg or grep fallbackPhase 0 is active in warn-only mode to guide contributors without blocking delivery:
.husky/pre-commit, .husky/pre-push) run forge-ai-init test-autogen only
when FORGE_TENANT_ID and FORGE_TENANT_PROFILE_REF are set, and always exit 0 in phase 0.test-autogen-warn using forge-ai-action with:
command: test-autogen-checktenant: acme-sandboxtenant_profile_ref: .forge-tenant-profiles/tenants/acme-sandbox/profile.yamltest_autogen_phase: warncomment: true, annotations: true)FORGE_TENANT_PROFILES_READ_TOKEN (fallback: GITHUB_TOKEN)This phase highlights missing tests early while preserving non-blocking developer flow.
Keep @typescript-eslint/eslint-plugin, @typescript-eslint/parser, and
typescript-eslint on the same minor version to avoid npm ci peer-dependency
resolution failures in CI.
This core repository provides the foundation for the entire Forge Space ecosystem:
Related Projects:
Documentation:
CLI tools for project governance, shipped as part of @forgespace/core:
| Tool | Command | Purpose |
|---|---|---|
| Scorecard | npx forge-scorecard | Evaluate project quality across security, quality, performance, compliance |
| Policy Engine | npx forge-policy | Enforce governance policies with block/warn/log actions |
| Init | npx forge-init | Bootstrap governance for any project |
| Feature Toggles | npx forge-features | Manage file-based feature toggles |
| Audit | npx forge-audit | Assess legacy codebase migration readiness |
Importing @forgespace/core is side-effect free. Governance scaffolding runs only when
forge-init is executed as a CLI command (npx forge-init or forge-init binary), not when the
package is imported in application runtime code.
forge-audit evaluates 6 categories: dependencies, architecture, security,
quality, migration-readiness, and ai-governance.
npx forge-init --template nextjs # Next.js project with SSR + bundle policies
npx forge-init --template react # React with accessibility + component coverage
npx forge-init --template node # Node.js with dependency audit + API validation
npx forge-init # Base governance (no framework-specific rules)
npx forge-audit --dir /path/to/legacy-app # Migration assessment
npx forge-audit --json --threshold 60 # CI gate mode
Security scanner outputs across Forge Space use the canonical v1 contract in
patterns/idp/security-spoke.
patterns/idp/security-spoke/schema/security-spoke-report-v1.schema.jsonpatterns/idp/security-spoke/rules/security-spoke-rules-v1.jsonpatterns/idp/security-spoke/fixtures/*.jsonReusable workflows are now centralized in Forge-Space/.github. This
repository (core) provides bootstrap orchestration and templates for new
projects.
New projects generated by scripts/bootstrap/project.sh default to the
limit-aware CI profile:
Bootstrap example:
./scripts/bootstrap/project.sh my-service node \
--org Forge-Space \
--actions-cap-minutes 20000
Initialize Actions budget variables for an org:
./scripts/bootstrap/actions-org-setup.sh \
--org Forge-Space \
--actions-cap-minutes 20000
For complete documentation, see our Documentation Hub which includes:
npm install @forgespace/core
# Navigate to your project directory
cd /path/to/your-project
# Use the automated integration CLI
npx forge-patterns integrate
# Or use individual integration commands
npx forge-patterns integrate --project=mcp-gateway
npx forge-patterns integrate --project=siza-mcp
npx forge-patterns integrate --project=siza
forge-patterns/
├── .github/
│ ├── workflows/ # CI/CD workflow templates
│ └── templates/ # GitHub templates (PR, issues)
├── patterns/
│ ├── code-quality/ # ESLint, Prettier configurations
│ ├── config/ # Centralized configuration management
│ ├── docker/ # Docker and containerization patterns
│ ├── feature-toggles/ # 🎛️ Centralized feature toggle system
│ ├── git/ # Git hooks and workflows
│ ├── mcp-gateway/ # MCP Gateway patterns (security, performance)
│ ├── mcp-servers/ # MCP Server patterns (AI providers, streaming)
│ ├── security/ # Security patterns (authentication, middleware)
│ └── shared-infrastructure/ # Shared infrastructure patterns (optimization)
├── docs/ # 📚 Comprehensive documentation
│ ├── architecture/ # Architecture decisions and summaries
│ ├── architecture-decisions/ # ADRs for system design
│ ├── guides/ # User guides and deployment playbooks
│ ├── standards/ # Development and security standards
│ └── reports/ # Implementation and analysis reports
├── test/ # 🧪 Comprehensive test suites
│ ├── feature-toggle-validation.js # Feature toggle system tests
│ ├── cross-project-integration.js # Cross-project integration tests
│ └── performance-benchmark.js # Performance benchmarking
├── scripts/
│ ├── forge-features # 🎛️ CLI tool for feature management
│ ├── integrate.js # Automated integration script
│ ├── apply-readme-branding.sh # Forge Space README header (CDN wordmark)
│ ├── apply-readme-branding-all.sh # Run branding for all Forge Space projects
│ ├── security/ # Security validation scripts
│ └── bootstrap/ # Project bootstrap scripts
├── src/ # TypeScript source files
├── test/ # 🧪 Comprehensive test suites
├── package.json # Package configuration
└── README.md # This file
NEW: Cross-project feature management with unified control
# Enable global features
forge-features enable global.debug-mode
forge-features enable global.beta-features
# Enable project-specific features
forge-features enable mcp-gateway.rate-limiting
forge-features enable forge-space-ui.rate-limiting
forge-features enable forge-space-mcp.ai-chat
forge-features enable forge-space-ui.dark-mode
# Check feature status
forge-features status --global
forge-features status --project=mcp-gateway
Features:
// Base ESLint config for TypeScript projects
module.exports = {
root: true,
extends: ['eslint:recommended', '@typescript-eslint/recommended', 'prettier'],
// ... comprehensive rules
};
{
"semi": true,
"trailingComma": "es5",
"singleQuote": true,
"printWidth": 100,
"tabWidth": 2,
"useTabs": false,
"arrowParens": "always",
"endOfLine": "lf"
}
# Three-state service model with sleep/wake architecture
services:
[service-name]:
resources:
memory: "512M"
cpu: "0.5"
memory_reservation: "256M"
sleep_policy:
enabled: true
idle_timeout: 300
priority: "normal"
auto_start: false
# Build stage
FROM node:22-alpine AS builder
# ... build process
# Production stage
FROM node:22-alpine AS runtime
# ... optimized production image
version: '3.8'
services:
app:
build: .
ports:
- "3000:3000"
volumes:
- .:/app
command: npm run dev
module.exports = {
collectCoverageFrom: ['src/**/*.ts'],
coverageThreshold: {
global: {
branches: 80,
functions: 80,
lines: 80,
statements: 80
}
}
};
codecov:
coverage:
status:
project:
default:
target: 80%
threshold: 1%
#!/bin/bash
# Comprehensive pre-commit validation
echo "🚀 Running Forge Space pre-commit validations..."
# Security validation, linting, testing, etc.
# Enforces conventional commit format
# feat, fix, docs, style, refactor, test, chore, etc.
# SECURITY NOTICE: PUBLIC REPOSITORY TEMPLATE
JWT_SECRET_KEY=REPLACE_WITH_STRONG_SECRET
DATABASE_URL=REPLACE_WITH_DATABASE_URL
API_KEY=REPLACE_WITH_API_KEY
# Automated secret detection and validation
./scripts/security/validate-no-secrets.sh
./scripts/security/validate-placeholders.sh
# Start development environment
docker-compose up -d
# View logs
docker-compose logs -f app
# Stop environment
docker-compose down
# Build production image
docker build -t my-app .
# Run production container
docker run -p 3000:3000 my-app
# Or use production compose
docker-compose -f docker-compose.prod.yml up -d
This repository is designed to be completely public with zero secrets:
REPLACE_WITH_[TYPE] format# Run comprehensive security scan
./scripts/security/scan-for-secrets.sh
# Validate no secrets
./scripts/security/validate-no-secrets.sh
# Validate placeholder formats
./scripts/security/validate-placeholders.sh
validate-no-secrets.sh excludes .forge, .serena, and .agents so policy and
assistant metadata do not produce false positives.
# Create new project with full patterns
./scripts/bootstrap/project.sh my-project node
# Bootstrap specific project types
./scripts/bootstrap/gateway.sh # mcp-gateway style
./scripts/bootstrap/webapp.sh # uiforge-webapp style
./scripts/bootstrap/mcp.sh # uiforge-mcp style
# Sync patterns to all projects
./scripts/sync/patterns.sh
# Sync configurations
./scripts/sync/configs.sh
# Sync templates
./scripts/sync/templates.sh
Apply the Forge Space README header (CDN wordmark) to any repo. See brand-guide/docs/REPOSITORY_BRANDING.md. Logo assets: SVG, PNG, WEBP at https://brand.forgespace.co/logos/ (e.g. wordmark.svg, wordmark.png, wordmark.webp).
# Single repo
./scripts/apply-readme-branding.sh path/to/repo [TITLE] [DESCRIPTION]
# All Forge Space projects (from monorepo root)
./scripts/apply-readme-branding-all.sh --dry-run # preview
./scripts/apply-readme-branding-all.sh # apply
# Validate pattern consistency
./scripts/validate/patterns.sh
# Validate security configs
./scripts/validate/security.sh
# Validate code quality
./scripts/validate/quality.sh
# Security scanning (automated)
- name: Security Scan
uses: trufflesecurity/trufflehog@v3.93.3
- name: Gitleaks Secret Scan
uses: gitleaks/gitleaks-action@v2
# Quality checks
- name: Lint and Format
- name: Type Check
- name: Test with Coverage
- name: Security Audit
We welcome contributions to Forge Space Patterns! Please see our Contributing Guide for details. For repository-specific agent workflow and operational gotchas, see AGENTS.md.
MIT License - see LICENSE file for details.
For questions, issues, or suggestions:
Forge Space Patterns - Consistency, Security, Quality, Automation, Docker 🚀
FAQs
Shared configuration, workflows, and architectural patterns for the Forgespace ecosystem
The npm package @forgespace/core receives a total of 18 weekly downloads. As such, @forgespace/core popularity was classified as not popular.
We found that @forgespace/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.
Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.
Research
/Security News
Benign-looking npm packages split malicious functionality across a dependency chain that deploys a cross-platform RAT targeting Alibaba developers.