SpecForge runs on your own machine — the client starts it, so there is no endpoint to ping. Last commit 2 Nov 2026.
Turn your team's rules into checks your AI agent can't skip. Deterministic, no AI inside.
What the code does
We read the source, 1 d ago · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
const fullDir = path.join(specDir, dir);
cp.execFile(
|| name.starts_with("id_rsa")
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Alternatives to SpecForge
same job, measured the same wayDeterministic intent preflight before your agent builds: six gates, keyless, no model call.
Deterministic pool and spa water test log. Checks readings against US CDC ranges. No AI.
Deterministic policy firewall for AI agent tool calls - YAML rules, not a fuzzy risk score.
Turn OpenAPI services into tools an agent can call under your rules.
Deterministic security layer your AI can't be. 639 rules, 39 tools, CLI + doctor + host audit.
Deterministic, zero-token security scanner your AI agent calls to find and re-verify issues.
Stop your agent before it runs rm -rf /etc or emails your .env. Deterministic preflight checks.
Scoped deterministic SRD 5.2.1 rules checks for agents — applied rules cited, boundaries explicit.
SpecForge — questions
Answers built from our own checks of this server.