
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@harness-forge/cli
Advanced tools
Harness Forge: modular agentic AI workspace installer, catalog, and workflow runtime.
Deterministic AI workspace bootstrapping for Codex, Claude Code, and adjacent agentic runtimes.
Install skills, knowledge packs, workflows, validation gates, and repo intelligence into a real repository - without mixing package content with workspace state.
Quick Start · Project Activity · Why Harness Forge · How It Works · Supported Targets · Commands · Credits
[!TIP] First time here? Run
npx @harness-forge/clifrom the repository you want to equip. Harness Forge acts like a guided front door for onboarding on first run and a lightweight project hub after initialization.
Point-in-time signals: live stars, forks, issues, and npm download badges above, plus a historical star timeline chart here.
Harness Forge is a packaging-friendly agentic workspace kit for teams that want a repeatable, inspectable, and maintenance-safe AI runtime inside real repositories.
Instead of relying on one-off prompts or tribal setup knowledge, it gives you a deterministic way to:
| Area | What Harness Forge does | Why it matters |
|---|---|---|
| 🧠 Runtime surfaces | Materializes AGENTS.md, .agents/skills/, target runtimes, and a canonical hidden .hforge/ layer | Agents get a predictable operating contract instead of improvising from prose |
| 🔎 Repo intelligence | Scans, recommends, cartographs, classifies boundaries, and synthesizes instructions | Setup becomes evidence-backed rather than guess-based |
| 🧩 Composition | Combines targets, profiles, languages, frameworks, and capability bundles | Teams can standardize without hard-coding one stack |
| 🛡️ Validation | Ships doctor, audit, diff-install, review, and release gates | Support claims stay honest and installs stay measurable |
| 🔁 Lifecycle | Supports bootstrap, refresh, sync, prune, upgrade, export, backup, repair, and restore flows | The workspace can evolve without becoming a black box |
| 📊 Observability | Keeps local-first effectiveness summaries and signal files under .hforge/observability/ | Operators can inspect what is working without sending telemetry to a backend |
| Domain | Coverage |
|---|---|
| 🎯 Runtime targets | 4 target surfaces: Codex, Claude Code, Cursor, OpenCode |
| 🧠 Knowledge system | 14 language packs total: 5 seeded + 9 structured |
| 🧩 Framework coverage | 12 framework packs including React, Next.js, Vite, Express, FastAPI, Django, ASP.NET Core, Spring Boot, Laravel, Symfony, Gin, and Ktor |
| 🛠 Skills | 45 packaged skills across language engineering, workflow orchestration, operational helpers, and workload-specialized flows |
| 🔁 Flow support | .specify/ spec → plan → tasks → implement flow plus flow-state recovery |
| 🔬 Intelligence | scan, recommend, cartograph, classify-boundaries, and synthesize-instructions |
| 📊 Local observability | Effectiveness summaries, recommendation acceptance, hook runs, maintenance traces, and runtime summaries |
| 🧱 Hard-task support | Recursive runtime sessions, structured recursive analysis, parallel planning, merge-checks, and decision recording |
npx @harness-forge/cli
Best for first-time operators who want:
quick, recommended, or advancednpx @harness-forge/cli bootstrap --root . --yes
Ideal when you want Harness Forge to:
hforge on your PATHnpx @harness-forge/cli shell setup --yes
hforge status --root . --json
hforge doctor --root . --json
hforge audit --root . --json
Harness Forge works across four layers:
| Layer | Responsibility | Examples |
|---|---|---|
| 🔍 Understand | Inspect the repo and infer what matters | scan, recommend, cartograph, classify-boundaries |
| 🧩 Compose | Decide what should be installed | targets, profiles, language packs, framework packs, bundles |
| 🚀 Install | Materialize runtime surfaces into the workspace | init, install, bootstrap, catalog add |
| 🛡 Operate | Verify, maintain, and evolve the runtime | status, doctor, audit, refresh, review, export, diff-install |
Think: analyze → compose → install → validate → evolve
flowchart LR
A[Repository] --> B[hforge recommend / scan / cartograph]
B --> C[Select target + profile + packs + bundles]
C --> D[Install visible bridges]
C --> E[Install hidden canonical AI layer]
D --> F[AGENTS.md + .agents/skills + target runtimes]
E --> G[.hforge/library + .hforge/templates + .hforge/runtime]
G --> H[status / doctor / audit / review / export]
H --> I[long-term maintenance, observability, and flow recovery]
Harness Forge keeps agent-discoverable bridge files visible while the canonical runtime, knowledge, rules, templates, and generated state live under .hforge/.
| Surface | Purpose |
|---|---|
AGENTS.md | Human and agent-visible root contract |
.agents/skills/ | Thin, discoverable wrappers for supported runtimes |
.hforge/library/skills/ | Canonical installed skill library |
.hforge/library/rules/ | Canonical installed rules |
.hforge/library/knowledge/ | Canonical installed knowledge packs |
.hforge/templates/ | Canonical installed templates and workflow artifacts |
.hforge/runtime/ | Shared runtime state, repo intelligence, findings, and decision indexes |
.hforge/generated/agent-command-catalog.json | Machine-readable command catalog for agents |
.hforge/agent-manifest.json | Stable custom-agent contract |
.hforge/generated/bin/ | Workspace-local launchers for PowerShell, CMD, and POSIX |
.specify/ | Structured spec-driven delivery flow |
.codex/ / .claude/ | Target-specific runtime payloads and bridge files |
| Dimension | Expected impact |
|---|---|
| Task consistency | High improvement |
| Install reproducibility | High improvement |
| Runtime correctness | Medium to high improvement |
| Cross-agent consistency | High improvement |
| Failure recovery | Medium to high improvement |
Yes - but as externalized operational memory, not model memory Harness Forge does not make the model itself smarter or increase intrinsic memory. What it does is create a persistent repo memory system and "runtime env" around the project.
Instead of the agent re-deriving everything on every task, the workspace can retain:
This helps with:
Yes - mostly by constraining bad choices and improving context quality AI agents make worse decisions when they have:
Harness Forge can lower token burn because it gives the agent:
.hforge/agent-manifest.json instead of scraping prose.agents/skills/ while execution points to canonical packaged surfacesFeatures like scan/cartograph/classify/recommend help the agent answer:
The spec/plan/tasks flow pushes the agent toward:
Indexes and runtime artifacts allow the workspace to retain:
That makes later decisions less myopic.
The agent can act differently for Codex vs Claude Code vs partial runtimes instead of pretending all environments are equal.
| Decision area | Expected impact |
|---|---|
| Choosing the right workflow | High improvement |
| Choosing packs/bundles | High improvement |
| Architectural consistency | Medium to high improvement |
| Recovery from failed work | Medium improvement |
| Avoiding unsupported behavior | High improvement |
Agents get a structured runtime instead of improvising from the root folder.
The workspace retains maps, state, and machine-readable guidance.
Humans can inspect what was installed, what decisions were made, and what state exists.
Multiple engineers and multiple agents can operate against the same contract.
Validation and maintenance commands make AI-assisted changes easier to verify.
Codex, Claude Code, and partial runtimes can be treated differently instead of flattened into one mental model.
Harness Forge is strongest with Codex and Claude Code today.
| Target | Runtime support | Hooks | Flow recovery | Recommended use |
|---|---|---|---|---|
| Codex | First-class | Partial, documentation-driven | First-class | Default choice when you want full install, recommendation, maintenance, and flow support |
| Claude Code | First-class | First-class | First-class | Best choice when native hook support matters |
| Cursor | Partial | Partial | Partial | Use for docs, manifests, and recommendation output |
| OpenCode | Partial | Partial | Partial | Use for docs, manifests, and recommendation output |
[!NOTE] Canonical support truth lives in
manifests/catalog/harness-capability-matrix.json. The broader compatibility view is derived intomanifests/catalog/compatibility-matrix.json, anddocs/target-support-matrix.mdis the operator-facing summary.
Seeded packs
Structured packs
flowchart TD
A[Run npx @harness-forge/cli] --> B[Choose folder]
B --> C[Choose one or more targets]
C --> D[Select setup depth]
D --> E[Add optional modules]
E --> F[Review planned writes]
F --> G[Apply install]
G --> H[Run status / doctor / audit]
quick, recommended, or advanced.status, doctor, and audit.| Mode | Entry point | When to use it |
|---|---|---|
| Guided onboarding | npx @harness-forge/cli | First-time setup, interactive review, and a polished onboarding experience |
| Direct setup | hforge init --root . --agent codex --setup-profile recommended --yes | CI, scripts, automation, or operators who already know the target choices |
| Dry-run planning | hforge init --root . --agent codex --dry-run | Preview writes before modifying a repo |
| Bootstrap | npx @harness-forge/cli bootstrap --root . --yes | Auto-detect runtimes and install a sensible target stack in one pass |
| Catalog expansion | hforge catalog add ... | Add languages, frameworks, or bundles as the repository evolves |
node dist/cli/index.js install \
--target codex \
--profile core \
--lang typescript \
--framework react \
--with workflow-quality \
--root /path/to/your/workspace \
--yes
node dist/cli/index.js install \
--target claude-code \
--profile core \
--lang python \
--framework fastapi \
--with workflow-quality \
--root /path/to/your/workspace \
--yes
Harness Forge can inspect a repository and recommend packs, profiles, skills, and missing validation surfaces with evidence.
hforge recommend tests/fixtures/benchmarks/typescript-web-app --json
hforge cartograph tests/fixtures/benchmarks/monorepo --json
hforge classify-boundaries tests/fixtures/benchmarks/monorepo --json
hforge synthesize-instructions tests/fixtures/benchmarks/monorepo --target codex --json
This is one of the strongest parts of the project:
For difficult work, Harness Forge can escalate into a durable recursive session under:
.hforge/runtime/recursive/sessions/RS-XXX/
That gives you:
Harness Forge also supports shard planning and merge-readiness checks:
hforge parallel plan specs/<feature>/tasks.md --json
hforge parallel status --json
hforge parallel merge-check --json
Observability is designed to remain local, inspectable, and diagnostic:
.hforge/observability/effectiveness-signals.json.hforge/observability/summary.jsonhforge observability summarize --jsonhforge observability report . --jsonHarness Forge is designed to be inspectable, deterministic, and operator-friendly.
.hforge/In practice, that means teams can understand:
Recursive structured analysis also stays intentionally honest about support:
.hforge/runtime/recursive/language-capabilities.jsonRun these after installation:
npx @harness-forge/cli shell setup --yes
hforge status --root /path/to/your/workspace --json
hforge refresh --root /path/to/your/workspace --json
hforge doctor --root /path/to/your/workspace --json
hforge audit --root /path/to/your/workspace --json
hforge review --root /path/to/your/workspace --json
| Check | Signal |
|---|---|
| Install state | Installed targets, bundles, timestamps, and file writes are present |
| Agent command catalog | .hforge/generated/agent-command-catalog.json exists |
| Custom-agent manifest | .hforge/agent-manifest.json exists |
| Skill discovery layer | .agents/skills/ is present |
| Canonical AI layer | .hforge/library/skills/, rules/, and knowledge/ are populated |
| Runtime state | .hforge/runtime/index.json and related findings and decision files exist |
| Target runtime | .codex/ or .claude/ exists in the workspace |
| Local launchers | .hforge/generated/bin/hforge, .ps1, or .cmd exists |
Agents should not assume bare hforge is on PATH. In installed workspaces,
resolve commands in this order:
.hforge/generated/bin/hforge.cmd or .ps1 on Windows, or ./.hforge/generated/bin/hforge on POSIXhforgenpx @harness-forge/cli| Goal | Command |
|---|---|
| Initialize the hidden runtime in a repo | npx @harness-forge/cli init --root /path/to/your/workspace --json |
Enable bare hforge on PATH | npx @harness-forge/cli shell setup --yes |
| Auto-detect targets and bootstrap | npx @harness-forge/cli bootstrap --root /path/to/your/workspace --yes |
| Inspect the catalog | hforge catalog --json |
| List commands agents can use | hforge commands --json |
| Inspect what is installed | hforge status --root /path/to/your/workspace --json |
| Refresh runtime summaries | hforge refresh --root /path/to/your/workspace --json |
| Update Harness Forge safely in place | hforge update --root /path/to/your/workspace --yes |
| Summarize runtime health | hforge review --root /path/to/your/workspace --json |
| Export runtime state | hforge export --root /path/to/your/workspace --json |
| Generate repo-aware recommendations | hforge recommend /path/to/your/workspace --json |
| Build a repo map | hforge cartograph /path/to/your/workspace --json |
| Inspect target capabilities | hforge target inspect codex --json |
| Validate templates | hforge template validate --json |
| Compare install state vs workspace | hforge diff-install --root /path/to/your/workspace --json |
| Inspect flow recovery state | hforge flow status --json |
| Review observability effectiveness | hforge observability summarize --json |
| Inspect recursive structured-analysis support | hforge recursive capabilities --root /path/to/your/workspace --json |
| Submit one structured recursive analysis run | hforge recursive run <sessionId> --file /path/to/snippet.mjs --root /path/to/your/workspace --json |
| List prior structured recursive runs | hforge recursive runs <sessionId> --root /path/to/your/workspace --json |
| Inspect one structured recursive run | hforge recursive inspect-run <sessionId> <runId> --root /path/to/your/workspace --json |
npm run validate:local
npm run release:dry-run
npm run build
npm run validate:local
npm run smoke:cli
npm run commands:catalog
npm run bootstrap:current
npm run recommend:current
npm run cartograph:current
npm run instructions:codex
npm run target:codex
npm run target:claude-code
npm run target:opencode
npm run validate:release
npm run validate:compatibility
npm run validate:skill-depth
npm run validate:framework-coverage
npm run validate:doc-command-alignment
npm run validate:runtime-consistency
npm run observability:summary
npm run knowledge:coverage
npm run knowledge:drift
[!IMPORTANT]
npm run validate:releaseis the front-door release gate for shipped changes.
| Folder | Purpose |
|---|---|
.agents/ | Auto-discoverable skill wrappers and target-facing bridge surfaces |
.hforge/ | Hidden canonical AI layer, runtime state, templates, observability, and generated outputs |
.specify/ | Structured delivery flow assets (spec -> plan -> tasks -> implement) |
dist/ | Built CLI output from the TypeScript source tree |
docs/ | Front-door documentation, catalogs, target guidance, and lifecycle docs |
knowledge-bases/ | Source-authored seeded and structured knowledge packs |
manifests/ | Catalogs, bundles, profiles, target definitions, and package metadata |
scripts/ | CI, runtime, knowledge, intelligence, validation, and maintenance scripts |
skills/ | Source-authored canonical packaged skills and reference packs |
src/ | TypeScript implementation of the CLI and supporting layers |
targets/ | Target adapters and runtime payloads for supported harnesses |
templates/ | Reusable task, instruction, and workflow templates |
tests/ | Contract, integration, and fixture coverage |
When integrating a custom agent, start here:
AGENTS.md.hforge/agent-manifest.json.hforge/runtime/index.json.hforge/generated/agent-command-catalog.json.agents/skills/<skill>/SKILL.md.hforge/library/skills/<skill>/SKILL.mdIf you want Claude Code, Codex, or another custom agent to use Harness Forge
more explicitly instead of merely coexisting with it, use
docs/agent-usage-playbook.md.
That playbook includes:
hforge is not on PATHIn runtimes that expose packaged markdown commands, Harness Forge can also ship
triggerable command docs such as /hforge-init, /hforge-analyze,
/hforge-review, /hforge-refresh, /hforge-decide, /hforge-status,
/hforge-commands, /hforge-recommend, /hforge-cartograph,
/hforge-task, /hforge-recursive, and /hforge-update, alongside
supporting command surfaces like commands/plan.md and commands/test.md.
Harness Forge was inspired by github/spec-kit.
A lot of the thinking around structured specification flow, disciplined planning, and operator-friendly delivery benefited from that inspiration. Big credit to the GitHub team for helping shape a cleaner workflow model.
This project is licensed under GPL-3.0. See LICENSE.md.
Built for teams who want their agent workflows to be repeatable, inspectable, and release-safe.
FAQs
Harness Forge: modular agentic AI workspace installer, catalog, and workflow runtime.
The npm package @harness-forge/cli receives a total of 36 weekly downloads. As such, @harness-forge/cli popularity was classified as not popular.
We found that @harness-forge/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.