Skip to main content

Security Features

Forge implements a comprehensive security model that includes a restricted shell mode and several protective mechanisms designed to safeguard your system while providing full functionality. This documentation details the security architecture and implementation strategies for various operational contexts.

Restricted Shell Mode​

Forge offers a restricted shell mode (rbash) that limits potentially dangerous operations:

Enabling Restricted Mode​

To enable the restricted secure mode, use the -r flag when starting Forge:

# Standard mode (default)
forge

# Restricted secure mode
forge -r

Security Controls in Restricted Mode​

Restricted mode prevents several potentially risky operations:

  • Directory Navigation: Cannot change directories
  • Environment Modification: Cannot set or modify environment variables
  • Absolute Path Execution: Cannot execute commands with absolute paths
  • Shell Option Modification: Cannot modify shell options

These restrictions help prevent inadvertent or malicious actions that could affect your system beyond the current directory.

Direct API Connections​

Forge connects directly to AI providers without intermediate servers:

  • Local Processing: All non-AI tasks are processed locally on your machine
  • Direct API Calls: API calls go directly from your machine to the AI provider
  • No Intermediary Servers: Your queries and responses don't pass through third-party servers
  • Data Privacy: Your code and commands remain between your system and the AI provider

Additional Security Measures​

Local Terminal Operation​

Forge operates entirely within your local terminal:

  • Local Execution: All commands execute locally on your machine
  • No Remote Code Execution: No external servers can execute code on your system
  • Full Visibility: You can see every command before it executes
  • Interrupt Capability: You can interrupt any operation with Ctrl+C