Security & Testing

forgeregistry.com

Provides trust registry tools to search and inspect MCP servers, AI skills, and packages for verification, vulnerability scanning, alternatives, and static tool extraction.

1 endpoint8 known toolsFirst detected October 2, 2026Last detected October 2, 2026

ENDPOINT 1

https://forgeregistry.com/api/mcp

No auth detected

MCP server metadata

Name: forge
Version: 0.4.0

Capabilities

tools.listChanged

Server instructions

Forge is a trust registry for MCP servers, A2A agents, and AI skills. Search it before recommending or installing anything: every entry carries a 0-100 trust score, a verification status, and a security scan. This hosted endpoint covers the registry itself. Tools that act on the user's own machine — auditing their MCP configs, installing a skill into their project, publishing a package they own — are not available here because this server cannot see their filesystem; they live in the local CLI (`npx -y @forge-registry/cli mcp`, or `forge audit` / `forge skills add` / `forge publish` in a terminal).

Known tools 8

forge_search

Find MCP servers, A2A agents, and AI skills in the Forge trust registry.

Inferred read-only

forge_get_package

Fetch the full trust profile for a package: Forge verification status, revocation, publisher identity, cached full scan results (tarball obfuscation, provenance, transitive deps, prompt injection), and (optionally) a live CVE scan via OSV plus npm lifecycle-script analysis.

Inferred read-only

forge_alternatives

Find MCP servers that could REPLACE a given entry — other servers observed to expose the same tools, ranked so a better-trusted one surfaces first.

Inferred read-only

forge_get_skill

Fetch an AI skill from the Forge registry: full prompt text, metadata, compatible clients, and version.

Inferred read-only

forge_inspect

Statically extract the MCP tool names a package declares, from its npm tarball source — the package is NEVER executed.

Inferred read-only

forge_install_plan

Get everything needed to install one registry entry in ONE call: ready-to-paste client config for each supported client, the credentials it will ask for (as placeholders), the trust score, and every warning that bears on installing it.

Inferred read-only

forge_submit_package

Point the Forge registry at an MCP server, A2A agent, or skill that isn't indexed yet.

Inferred read-only

forge_changes

Ask the Forge registry what has CHANGED for a list of packages since a given date: new npm maintainers, a new install script, obfuscated code that was not there before, a tool surface that grew a privileged capability, newly-applicable CVEs, lost build provenance, or a revoked publisher.

Inferred read-only

CONNECT WITH APPROVAL

Client installation

Review this server and its permissions before adding it. Secret placeholders must be set locally.

Codex

~/.codex/config.toml

[mcp_servers.forge]
url = "https://forgeregistry.com/api/mcp"
enabled = true

Claude Code

.mcp.json

{
  "mcpServers": {
    "forge": {
      "type": "http",
      "url": "https://forgeregistry.com/api/mcp"
    }
  }
}

Claude Desktop

Settings → Connectors → Add custom connector

Name: forge
Remote MCP URL: https://forgeregistry.com/api/mcp

Add this remote URL as a custom connector in Claude Desktop. Availability depends on the user plan and workspace policy.

Cursor

.cursor/mcp.json

{
  "mcpServers": {
    "forge": {
      "url": "https://forgeregistry.com/api/mcp"
    }
  }
}

Visual Studio Code

.vscode/mcp.json

Add to Visual Studio Code

{
  "servers": {
    "forge": {
      "type": "http",
      "url": "https://forgeregistry.com/api/mcp"
    }
  }
}

Generic MCP

Client-specific MCP configuration

{
  "name": "forge",
  "transport": "streamable-http",
  "url": "https://forgeregistry.com/api/mcp"
}

MCP Inspector

Run the official MCP Inspector locally and enter the indexed Streamable HTTP endpoint.

TRUST AND VERIFICATION EVIDENCE

Trust Data Available

BuiltWith Trust API v2 evidence for forgeregistry.com was fetched 2026-10-03T06:45:14.972Z.

Trust status Neutral

forgeregistry.com is assessed as Neutral: No suspicious signals found, but no strong positive signal either

Indexed

Evidence is source-attributed and does not guarantee that a third-party server is safe. Risk labels are conservative metadata heuristics.