@forgespace/core
Advanced tools
Shared configuration, workflows, and architectural patterns for the Forgespace ecosystem
Shared standards, patterns, and MCP context server for the Forge Space ecosystem.
Part of Forge Space โ the open full-stack AI workspace. This repo provides the foundation that all other Forge Space projects build on: code quality standards, security framework, CI/CD workflows, and a local MCP context server for IDE integration.
Forge-Space Core provides shared configurations, workflows, and architectural patterns for consistency across the ecosystem. Centralized feature toggles, reusable GitHub Actions workflows (95% reduction in maintenance overhead), and comprehensive security validation.
Forge-Space Core now defines an explicit tenant contract and enforces decoupling checks to keep platform code tenant-agnostic.
TenantProfile and validators from src/tenant/contract.tstenant_idgithub_ownersonar_orgnpm_scopequality_policyci_policynpm run check:tenant-decoupling
src, patterns, scripts, .github)rg when available and automatically falls back to grep on constrained runnersrg or grep fallbackPhase 0 is active in warn-only mode to guide contributors without blocking delivery:
.husky/pre-commit, .husky/pre-push) run forge-ai-init test-autogen only
when FORGE_TENANT_ID and FORGE_TENANT_PROFILE_REF are set, and always exit 0 in phase 0.test-autogen-warn using forge-ai-action with:
command: test-autogen-checktenant: acme-sandboxtenant_profile_ref: .forge-tenant-profiles/tenants/acme-sandbox/profile.yamltest_autogen_phase: warncomment: true, annotations: true)FORGE_TENANT_PROFILES_READ_TOKEN (fallback: GITHUB_TOKEN)This phase highlights missing tests early while preserving non-blocking developer flow.
Keep @typescript-eslint/eslint-plugin, @typescript-eslint/parser, and
typescript-eslint on the same minor version to avoid npm ci peer-dependency
resolution failures in CI.
This core repository provides the foundation for the entire Forge Space ecosystem:
Related Projects:
Documentation:
CLI tools for project governance, shipped as part of @forgespace/core:
| Tool | Command | Purpose |
|---|---|---|
| Scorecard | npx forge-scorecard | Evaluate project quality across security, quality, performance, compliance |
| Policy Engine | npx forge-policy | Enforce governance policies with block/warn/log actions |
| Init | npx forge-init | Bootstrap governance for any project |
| Feature Toggles | npx forge-features | Manage file-based feature toggles |
| Audit | npx forge-audit | Assess legacy codebase migration readiness |
Importing @forgespace/core is side-effect free. Governance scaffolding runs only when
forge-init is executed as a CLI command (npx forge-init or forge-init binary), not when the
package is imported in application runtime code.
forge-audit evaluates 6 categories: dependencies, architecture, security,
quality, migration-readiness, and ai-governance.
npx forge-init --template nextjs # Next.js project with SSR + bundle policies
npx forge-init --template react # React with accessibility + component coverage
npx forge-init --template node # Node.js with dependency audit + API validation
npx forge-init # Base governance (no framework-specific rules)
npx forge-audit --dir /path/to/legacy-app # Migration assessment
npx forge-audit --json --threshold 60 # CI gate mode
Security scanner outputs across Forge Space use the canonical v1 contract in
patterns/idp/security-spoke.
patterns/idp/security-spoke/schema/security-spoke-report-v1.schema.jsonpatterns/idp/security-spoke/rules/security-spoke-rules-v1.jsonpatterns/idp/security-spoke/fixtures/*.jsonReusable workflows are now centralized in Forge-Space/.github. This
repository (core) provides bootstrap orchestration and templates for new
projects.
New projects generated by scripts/bootstrap/project.sh default to the
limit-aware CI profile:
Bootstrap example:
./scripts/bootstrap/project.sh my-service node \
--org Forge-Space \
--actions-cap-minutes 20000
Initialize Actions budget variables for an org:
./scripts/bootstrap/actions-org-setup.sh \
--org Forge-Space \
--actions-cap-minutes 20000
For complete documentation, see our Documentation Hub which includes:
npm install @forgespace/core
Published on npm as
@forgespace/core.
# Navigate to your project directory
cd /path/to/your-project
# Use the automated integration CLI
npx forge-patterns integrate
# Or use individual integration commands
npx forge-patterns integrate --project=mcp-gateway
npx forge-patterns integrate --project=siza-mcp
npx forge-patterns integrate --project=siza
--project=siza-mcp is the current integration CLI alias for the ui-mcp
server in this repo.
This repository follows the shared Forge Space GitHub work-management baseline:
See Forge-Space/.github GOVERNANCE.md
for the org-wide contract.
The repo includes an NLnet packet generator for the mcp-gateway funding lane.
Project facts stay in ops/funding/nlnet/project.json, while personal/contact
details belong in the ignored ops/funding/nlnet/applicant.local.json.
cp ops/funding/nlnet/applicant.local.example.json ops/funding/nlnet/applicant.local.json
npm run funding:nlnet:render
npm run funding:nlnet:check
Generated artifacts land in ops/funding/nlnet/generated/ and stay redacted for
workflow-safe issue updates and browser-assisted handoff.
forge-patterns/
โโโ .github/
โ โโโ workflows/ # CI/CD workflow templates
โ โโโ templates/ # GitHub templates (PR, issues)
โโโ patterns/
โ โโโ code-quality/ # ESLint, Prettier configurations
โ โโโ config/ # Centralized configuration management
โ โโโ docker/ # Docker and containerization patterns
โ โโโ feature-toggles/ # ๐๏ธ Centralized feature toggle system
โ โโโ git/ # Git hooks and workflows
โ โโโ mcp-gateway/ # MCP Gateway patterns (security, performance)
โ โโโ mcp-servers/ # MCP Server patterns (AI providers, streaming)
โ โโโ security/ # Security patterns (authentication, middleware)
โ โโโ shared-infrastructure/ # Shared infrastructure patterns (optimization)
โโโ docs/ # ๐ Comprehensive documentation
โ โโโ architecture/ # Architecture decisions and summaries
โ โโโ architecture-decisions/ # ADRs for system design
โ โโโ guides/ # User guides and deployment playbooks
โ โโโ standards/ # Development and security standards
โ โโโ reports/ # Implementation and analysis reports
โโโ test/ # ๐งช Comprehensive test suites
โ โโโ feature-toggle-validation.js # Feature toggle system tests
โ โโโ cross-project-integration.js # Cross-project integration tests
โ โโโ performance-benchmark.js # Performance benchmarking
โโโ scripts/
โ โโโ forge-features # ๐๏ธ CLI tool for feature management
โ โโโ integrate.js # Automated integration script
โ โโโ apply-readme-branding.sh # Forge Space README header (CDN wordmark)
โ โโโ apply-readme-branding-all.sh # Run branding for all Forge Space projects
โ โโโ security/ # Security validation scripts
โ โโโ bootstrap/ # Project bootstrap scripts
โโโ src/ # TypeScript source files
โโโ test/ # ๐งช Comprehensive test suites
โโโ package.json # Package configuration
โโโ README.md # This file
NEW: Cross-project feature management with unified control
# Enable global features
forge-features enable global.debug-mode
forge-features enable global.beta-features
# Enable project-specific features
forge-features enable mcp-gateway.rate-limiting
forge-features enable forge-space-ui.rate-limiting
forge-features enable forge-space-mcp.ai-chat
forge-features enable forge-space-ui.dark-mode
# Check feature status
forge-features status --global
forge-features status --project=mcp-gateway
Features:
// Base ESLint config for TypeScript projects
module.exports = {
root: true,
extends: ['eslint:recommended', '@typescript-eslint/recommended', 'prettier'],
// ... comprehensive rules
};
{
"semi": true,
"trailingComma": "es5",
"singleQuote": true,
"printWidth": 100,
"tabWidth": 2,
"useTabs": false,
"arrowParens": "always",
"endOfLine": "lf"
}
# Three-state service model with sleep/wake architecture
services:
[service-name]:
resources:
memory: "512M"
cpu: "0.5"
memory_reservation: "256M"
sleep_policy:
enabled: true
idle_timeout: 300
priority: "normal"
auto_start: false
# Build stage
FROM node:22-alpine AS builder
# ... build process
# Production stage
FROM node:22-alpine AS runtime
# ... optimized production image
version: '3.8'
services:
app:
build: .
ports:
- "3000:3000"
volumes:
- .:/app
command: npm run dev
module.exports = {
collectCoverageFrom: ['src/**/*.ts'],
coverageThreshold: {
global: {
branches: 80,
functions: 80,
lines: 80,
statements: 80
}
}
};
codecov:
coverage:
status:
project:
default:
target: 80%
threshold: 1%
#!/bin/bash
# Comprehensive pre-commit validation
echo "๐ Running Forge Space pre-commit validations..."
# Security validation, linting, testing, etc.
# Enforces conventional commit format
# feat, fix, docs, style, refactor, test, chore, etc.
# SECURITY NOTICE: PUBLIC REPOSITORY TEMPLATE
JWT_SECRET_KEY=REPLACE_WITH_STRONG_SECRET
DATABASE_URL=REPLACE_WITH_DATABASE_URL
API_KEY=REPLACE_WITH_API_KEY
# Automated secret detection and validation
./scripts/security/validate-no-secrets.sh
./scripts/security/validate-placeholders.sh
# Start development environment
docker-compose up -d
# View logs
docker-compose logs -f app
# Stop environment
docker-compose down
# Build production image
docker build -t my-app .
# Run production container
docker run -p 3000:3000 my-app
# Or use production compose
docker-compose -f docker-compose.prod.yml up -d
This repository is designed to be completely public with zero secrets:
REPLACE_WITH_[TYPE] format# Run comprehensive security scan
./scripts/security/scan-for-secrets.sh
# Validate no secrets
./scripts/security/validate-no-secrets.sh
# Validate placeholder formats
./scripts/security/validate-placeholders.sh
validate-no-secrets.sh excludes .forge, .serena, and .agents so policy and
assistant metadata do not produce false positives.
# Create new project with full patterns
./scripts/bootstrap/project.sh my-project node
# Bootstrap specific project types
./scripts/bootstrap/gateway.sh # mcp-gateway style
./scripts/bootstrap/webapp.sh # uiforge-webapp style
./scripts/bootstrap/mcp.sh # uiforge-mcp style
# Sync patterns to all projects
./scripts/sync/patterns.sh
# Sync configurations
./scripts/sync/configs.sh
# Sync templates
./scripts/sync/templates.sh
Apply the Forge Space README header (CDN wordmark) to any repo. See brand-guide/docs/REPOSITORY_BRANDING.md. Logo assets: SVG, PNG, WEBP at https://brand.forgespace.co/logos/ (e.g. wordmark.svg, wordmark.png, wordmark.webp).
# Single repo
./scripts/apply-readme-branding.sh path/to/repo [TITLE] [DESCRIPTION]
# All Forge Space projects (from monorepo root)
./scripts/apply-readme-branding-all.sh --dry-run # preview
./scripts/apply-readme-branding-all.sh # apply
# Validate pattern consistency
./scripts/validate/patterns.sh
# Validate security configs
./scripts/validate/security.sh
# Validate code quality
./scripts/validate/quality.sh
# Security scanning (automated)
- name: Security Scan
uses: trufflesecurity/trufflehog@v3.93.3
- name: Gitleaks Secret Scan
uses: gitleaks/gitleaks-action@v2
# Quality checks
- name: Lint and Format
- name: Type Check
- name: Test with Coverage
- name: Security Audit
We welcome contributions to Forge Space Patterns! Please see our Contributing Guide for details. For repository-specific agent workflow and operational gotchas, see AGENTS.md.
MIT License - see LICENSE file for details.
For questions, issues, or suggestions:
Forge Space Patterns - Consistency, Security, Quality, Automation, Docker ๐
FAQs
Shared configuration, workflows, and architectural patterns for the Forgespace ecosystem
The npm package @forgespace/core receives a total of 18 weekly downloads. As such, @forgespace/core popularity was classified as not popular.
We found that @forgespace/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.
Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.