Dev & Engineering slash-commandssecurity-hooksplaywrighttddcode-reviewmcp

Claude Forge

A Claude Code toolkit that prewires specialist workflows, slash commands, and safety hooks.

FollowAgents review · FARS-2.0
Not yet reviewed
See the full review method →

What does this agent do, and when should you use it?

Claude Forge is a development-environment extension for Claude Code, delivered through either a plugin install or a fuller local installation. The full install provides 11 specialist agents, 34 slash commands, 26 skills, 15 built-in hooks, 10 rule files, and four default MCP connections. Its installer links repository configuration into ~/.claude/ on macOS and Linux so Claude Code can load the definitions, commands, rules, and hooks; Windows uses copied files instead. The documented primary workflow is /plan → /tdd → /code-review → /handoff-verify → /commit-push-pr. It fits Claude Code users who want a standardized plan-to-verification workflow, rather than teams seeking a standalone, provider-neutral agent API.

The installer connects agents/, commands/, skills/, rules/, hooks/, and MCP configuration to Claude Code. /plan creates an implementation plan and waits for approval; /tdd follows a failing-test, passing-test, refactor cycle; /code-review performs quality and security checks; and /handoff-verify runs build, test, and lint verification. Its agent definitions include planner, architect, security-reviewer, tdd-guide, database-reviewer, e2e-runner, and verify-agent. Built-in hooks run around Bash commands, database commands, file edits, and MCP use, including remote-command-guard.sh, db-guard.sh, and output-secret-filter.sh. The default MCP servers are playwright, context7, jina-reader, and chrome-devtools.

  1. A team building a feature in Claude Code that wants an approved implementation plan from /plan before starting test-first work with /tdd.
  2. A TypeScript maintainer who needs /build-fix or build-error-resolver to address build errors with minimal surrounding changes.
  3. An engineer preparing a release who wants /security-review and security-reviewer to check OWASP Top 10 issues, injection risks, and leaked secrets.
  4. A web developer who needs /e2e and e2e-runner to generate and run Playwright end-to-end tests.
  5. A team that wants a separate verification step to run build, tests, and lint through /handoff-verify before handoff.
  6. A Claude Code user repeating the same operation who wants /loop-forge to turn it into a reusable slash command with automatic verification and a hardstop.

What are this agent's strengths and limitations?

Pros
  • The full install bundles agents, commands, skills, rules, hooks, and four MCP connections as one prewired configuration rather than a single workflow.
  • It documents a connected workflow spanning planning, test-first development, review, fresh-context verification, and commit/PR creation.
  • Its hooks target unsafe remote pipelines, destructive SQL, secret leakage in output, and MCP usage, with additional opt-in lifecycle examples.
  • macOS/Linux symlinks into ~/.claude/, allowing repository updates to take effect after git pull without reinstalling.
Limitations
  • Its core operation depends on Claude Code; no standalone adapter for ChatGPT, Codex, the OpenAI API, or the Claude API is documented.
  • Plugin installation is intentionally incomplete: agents, hooks, rules, and MCP connections require the full installer.
  • The default tool set includes Playwright, Context7, Jina Reader, and Chrome DevTools, so using those integrations requires network access and an MCP-capable environment.
  • Windows uses file copies instead of symlinks, requiring install.ps1 to be rerun after each git pull.

How do you install or deploy this agent?

Prerequisite: Claude Code; the README badges Claude Code >=2.1.110. For the quick, partial plugin installation, run these inside a Claude Code session:
/plugin marketplace add sangrokjung/claude-forge
/plugin install claude-forge
This provides commands and most skills; agents, hooks, rules, and MCP connections require the full install. On macOS/Linux, run:
curl -fsSL https://raw.githubusercontent.com/sangrokjung/claude-forge/main/install.sh | bash
Alternatively, run git clone --recurse-submodules https://github.com/sangrokjung/claude-forge.git, enter the directory, and run ./install.sh. On Windows, run .\install.ps1 in PowerShell as Administrator. The supplied material does not document additional credentials.

How do you use this agent?

After a full install, start with /guide for an interactive tour. For a feature workflow, run /plan → /tdd → /code-review → /handoff-verify → /commit-push-pr; /auto login page is a documented example of starting an automated plan-to-PR flow. On macOS/Linux, run git pull in the claude-forge repository to update linked configuration; on Windows, rerun install.ps1 after pulling. To override settings without editing tracked files, copy setup/settings.local.template.json to ~/.claude/settings.local.json and edit it.

How does this agent compare with similar options?

Against a basic .claude/ setup, Claude Forge supplies preconfigured specialist agents, commands, skills, hooks, and MCP connections. Against installing individual plugins, it positions /plan, /tdd, /code-review, /handoff-verify, and /commit-push-pr as a connected workflow.

FAQ

Does the Claude Code plugin installation include every component?
No. The plugin path provides commands and most skills; the README states that agents, hooks, rules, and MCP connections need the full installation.
What local locations does it modify or use?
On macOS/Linux, the installer creates symbolic links from the claude-forge directory into ~/.claude/. On Windows it uses file copies. Settings can be overridden in ~/.claude/settings.local.json.
What do the security hooks actually block?
Documented examples include unsafe curl/wget pipelines, destructive SQL, and API keys, tokens, or passwords exposed in tool output. A hook also triggers security checks after file edits.
Can the additional lifecycle hook examples be enabled selectively?
Yes. The documented process is to rename a .example file in hooks/examples/ to .sh and register it in settings.json.

Related agents