@forgespace/core
Advanced tools
Shared configuration, workflows, and architectural patterns for the Forgespace ecosystem
Shared standards, patterns, and MCP context server for the Forge Space ecosystem.
Part of Forge Space — the open full-stack AI workspace. This repo provides the foundation that all other Forge Space projects build on: code quality standards, security framework, CI/CD workflows, and a local MCP context server for IDE integration.
Forge-Space Core provides shared configurations, workflows, and architectural patterns for consistency across the ecosystem. Centralized feature toggles, reusable GitHub Actions workflows (95% reduction in maintenance overhead), and comprehensive security validation.
This core repository provides the foundation for the entire Forge Space ecosystem:
Related Projects:
Documentation:
CLI tools for project governance, shipped as part of @forgespace/core:
| Tool | Command | Purpose |
|---|---|---|
| Scorecard | npx forge-scorecard | Evaluate project quality across security, quality, performance, compliance |
| Policy Engine | npx forge-policy | Enforce governance policies with block/warn/log actions |
| Init | npx forge-init | Bootstrap governance for any project |
| Feature Toggles | npx forge-features | Manage file-based feature toggles |
npx forge-init --template nextjs # Next.js project with SSR + bundle policies
npx forge-init --template react # React with accessibility + component coverage
npx forge-init --template node # Node.js with dependency audit + API validation
npx forge-init # Base governance (no framework-specific rules)
Forge-Space Core now provides centralized reusable workflows that eliminate duplication across the Forge Space ecosystem:
# In your project's .github/workflows/ci.yml
jobs:
ci:
uses: Forge-Space/core/.github/workflows/reusable/ci-base.yml@main
with:
project-type: 'gateway' # or 'mcp', 'webapp', 'patterns'
node-version: '22'
python-version: '3.12'
enable-docker: true
enable-security: true
enable-coverage: true
-shared.yml filesFor complete documentation, see our Documentation Hub which includes:
npm install @forgespace/core
# Navigate to your project directory
cd /path/to/your-project
# Use the automated integration CLI
npx forge-patterns integrate
# Or use individual integration commands
npx forge-patterns integrate --project=mcp-gateway
npx forge-patterns integrate --project=siza-mcp
npx forge-patterns integrate --project=siza
forge-patterns/
├── .github/
│ ├── workflows/ # CI/CD workflow templates
│ └── templates/ # GitHub templates (PR, issues)
├── patterns/
│ ├── code-quality/ # ESLint, Prettier configurations
│ ├── config/ # Centralized configuration management
│ ├── docker/ # Docker and containerization patterns
│ ├── feature-toggles/ # 🎛️ Centralized feature toggle system
│ ├── git/ # Git hooks and workflows
│ ├── mcp-gateway/ # MCP Gateway patterns (security, performance)
│ ├── mcp-servers/ # MCP Server patterns (AI providers, streaming)
│ ├── security/ # Security patterns (authentication, middleware)
│ └── shared-infrastructure/ # Shared infrastructure patterns (optimization)
├── docs/ # 📚 Comprehensive documentation
│ ├── architecture/ # Architecture decisions and summaries
│ ├── architecture-decisions/ # ADRs for system design
│ ├── guides/ # User guides and deployment playbooks
│ ├── standards/ # Development and security standards
│ └── reports/ # Implementation and analysis reports
├── test/ # 🧪 Comprehensive test suites
│ ├── feature-toggle-validation.js # Feature toggle system tests
│ ├── cross-project-integration.js # Cross-project integration tests
│ └── performance-benchmark.js # Performance benchmarking
├── scripts/
│ ├── forge-features # 🎛️ CLI tool for feature management
│ ├── integrate.js # Automated integration script
│ ├── apply-readme-branding.sh # Forge Space README header (CDN wordmark)
│ ├── apply-readme-branding-all.sh # Run branding for all Forge Space projects
│ ├── security/ # Security validation scripts
│ └── bootstrap/ # Project bootstrap scripts
├── src/ # TypeScript source files
├── test/ # 🧪 Comprehensive test suites
├── package.json # Package configuration
└── README.md # This file
NEW: Cross-project feature management with unified control
# Enable global features
forge-features enable global.debug-mode
forge-features enable global.beta-features
# Enable project-specific features
forge-features enable mcp-gateway.rate-limiting
forge-features enable forge-space-ui.rate-limiting
forge-features enable forge-space-mcp.ai-chat
forge-features enable forge-space-ui.dark-mode
# Check feature status
forge-features status --global
forge-features status --project=mcp-gateway
Features:
// Base ESLint config for TypeScript projects
module.exports = {
root: true,
extends: ['eslint:recommended', '@typescript-eslint/recommended', 'prettier'],
// ... comprehensive rules
};
{
"semi": true,
"trailingComma": "es5",
"singleQuote": true,
"printWidth": 100,
"tabWidth": 2,
"useTabs": false,
"arrowParens": "always",
"endOfLine": "lf"
}
# Three-state service model with sleep/wake architecture
services:
[service-name]:
resources:
memory: "512M"
cpu: "0.5"
memory_reservation: "256M"
sleep_policy:
enabled: true
idle_timeout: 300
priority: "normal"
auto_start: false
# Build stage
FROM node:22-alpine AS builder
# ... build process
# Production stage
FROM node:22-alpine AS runtime
# ... optimized production image
version: '3.8'
services:
app:
build: .
ports:
- "3000:3000"
volumes:
- .:/app
command: npm run dev
module.exports = {
collectCoverageFrom: ['src/**/*.ts'],
coverageThreshold: {
global: {
branches: 80,
functions: 80,
lines: 80,
statements: 80
}
}
};
codecov:
coverage:
status:
project:
default:
target: 80%
threshold: 1%
#!/bin/bash
# Comprehensive pre-commit validation
echo "🚀 Running Forge Space pre-commit validations..."
# Security validation, linting, testing, etc.
# Enforces conventional commit format
# feat, fix, docs, style, refactor, test, chore, etc.
# SECURITY NOTICE: PUBLIC REPOSITORY TEMPLATE
JWT_SECRET_KEY=REPLACE_WITH_STRONG_SECRET
DATABASE_URL=REPLACE_WITH_DATABASE_URL
API_KEY=REPLACE_WITH_API_KEY
# Automated secret detection and validation
./scripts/security/validate-no-secrets.sh
./scripts/security/validate-placeholders.sh
# Start development environment
docker-compose up -d
# View logs
docker-compose logs -f app
# Stop environment
docker-compose down
# Build production image
docker build -t my-app .
# Run production container
docker run -p 3000:3000 my-app
# Or use production compose
docker-compose -f docker-compose.prod.yml up -d
This repository is designed to be completely public with zero secrets:
REPLACE_WITH_[TYPE] format# Run comprehensive security scan
./scripts/security/scan-for-secrets.sh
# Validate no secrets
./scripts/security/validate-no-secrets.sh
# Validate placeholder formats
./scripts/security/validate-placeholders.sh
# Create new project with full patterns
./scripts/bootstrap/project.sh my-project node
# Bootstrap specific project types
./scripts/bootstrap/gateway.sh # mcp-gateway style
./scripts/bootstrap/webapp.sh # uiforge-webapp style
./scripts/bootstrap/mcp.sh # uiforge-mcp style
# Sync patterns to all projects
./scripts/sync/patterns.sh
# Sync configurations
./scripts/sync/configs.sh
# Sync templates
./scripts/sync/templates.sh
Apply the Forge Space README header (CDN wordmark) to any repo. See brand-guide/docs/REPOSITORY_BRANDING.md. Logo assets: SVG, PNG, WEBP at https://brand.forgespace.co/logos/ (e.g. wordmark.svg, wordmark.png, wordmark.webp).
# Single repo
./scripts/apply-readme-branding.sh path/to/repo [TITLE] [DESCRIPTION]
# All Forge Space projects (from monorepo root)
./scripts/apply-readme-branding-all.sh --dry-run # preview
./scripts/apply-readme-branding-all.sh # apply
# Validate pattern consistency
./scripts/validate/patterns.sh
# Validate security configs
./scripts/validate/security.sh
# Validate code quality
./scripts/validate/quality.sh
# Security scanning (automated)
- name: Security Scan
uses: trufflesecurity/trufflehog@v3.93.3
- name: Gitleaks Secret Scan
uses: gitleaks/gitleaks-action@v2
# Quality checks
- name: Lint and Format
- name: Type Check
- name: Test with Coverage
- name: Security Audit
We welcome contributions to Forge Space Patterns! Please see our Contributing Guide for details.
MIT License - see LICENSE file for details.
For questions, issues, or suggestions:
Forge Space Patterns - Consistency, Security, Quality, Automation, Docker 🚀
FAQs
Shared configuration, workflows, and architectural patterns for the Forgespace ecosystem
The npm package @forgespace/core receives a total of 18 weekly downloads. As such, @forgespace/core popularity was classified as not popular.
We found that @forgespace/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.
Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.