fernforge

ach-conform

Static check for the Stripe ACH "succeeded isn't final" trap: webhook handlers that treat payment_intent.succeeded as terminal for us_bank_account charges without also handling the later payment_intent.payment_failed / charge.failed flip.

ai-catalog

Build, validate, discover, and resolve ai-catalog.json files for the Agentic Resource Discovery (ARD) spec. TypeScript, zero runtime deps.

allow-scripts-bot

Classify npm install/postinstall scripts as safe or suspicious and generate an npm v12 allowScripts config, with an optional PR.

ci-parity

Statically predict the common 'passes locally, fails in CI' failures before you push: version drift, stale lockfiles, missing env, OS-only shell steps, and npm 12's default-blocked install scripts/git deps/remote deps.

citeready-core

Audit whether an AI answer engine (ChatGPT, Perplexity, Google AI) would cite a web page: a two-stage retrieval-vs-quotability model plus an 'is this query even winnable for an independent site?' verdict.

erasablefy

Codemod that rewrites TypeScript enum, value-namespace, and constructor parameter-properties into erasable syntax so your .ts files run directly on Node's type stripping (no build step, no ERR_UNSUPPORTED_TYPESCRIPT_SYNTAX).

@fernforge/ai-signals-audit

Fetch a domain and flag contradictions across its AI-control signals: robots.txt (Disallow + Content-Signal), RSL License, AIPREF Content-Usage, X-Robots-Tag, and llms.txt.

@fernforge/alchemy

Turn AI prose into human-quality writing. A drop-in ruleset that tells your coding agent how to write docs, READMEs, commits, and replies without the tell-tale LLM patterns.

@fernforge/alchemy-mcp

MCP server that serves the Alchemy ruleset to any agent, so it writes human-quality prose instead of tell-tale LLM text.

@fernforge/mcp-conform

Author-side conformance, safety & spec-migration linter for MCP (Model Context Protocol) servers — eslint for your MCP server. Checks tool annotations, schema hygiene, tool-poisoning/injection patterns, registry/distribution metadata, and scans your sourc

lna-readiness

Static CI scanner that finds requests Chrome 142 Local Network Access will silently break — before they ship. CLI + ESLint plugin + GitHub Action.

mcp-tool-guard

Wrap an MCP client so a silently-skipped or discarded tool call throws instead of letting the agent report success on nothing.

openai-assistants-sunset

Scan JS/TS + Python for OpenAI Assistants & Threads API call-sites and gate CI on the Aug 26 2026 shutdown. Zero dependencies.

release-doctor

Read-only scanner that checks whether your npm/PyPI publish CI is ready for OIDC trusted publishing, after npm revoked classic tokens (Dec 9 2025). Prints the exact diff to fix.

rsl-licensing

Build, validate, and embed RSL (Really Simple Licensing) AI-licensing terms for JS/TS sites — robots.txt, HTTP Link, HTML, RSS, .well-known.

trusted-publish-check

Preflight your GitHub Actions workflow for npm OIDC trusted publishing before you hit the misleading 404/ENEEDAUTH at release time. Catches workflow filename mismatch, workflow_call indirection, missing id-token permission, stale npm/Node, and more.

tsgo-ready

Scan your TypeScript repo for what the move to the native Go compiler (tsgo / TypeScript 7.0) breaks — removed tsconfig flags, Compiler-API-dependent tooling that needs TS 6 side-by-side, and decorator/JSDoc behavior changes. Deterministic CLI + GitHub Ac

x402-conform

CLI that probes an x402 (HTTP 402 agentic-payment) endpoint for spec conformance and known facilitator gotchas