How it works
There is no step where you go and fetch a dependency yourself. That is the whole design.
One file from this site. It brings the backend with it and adds FORGE to your PATH.
FORGE detects your graphics card and downloads the matching llama.cpp build: about 35 MB for Vulkan, more for CUDA. FORGE brings its own engine build; a CUDA toolkit already on your PC is not used and not needed.
Type a name like qwen3:4b. FORGE works
out which repository publishes it and which quantisation suits your
machine.
Or give it a task, and watch it read, think, ask permission, and act.
→ detected NVIDIA GeForce RTX 4070 (12 GB) → engine CUDA 12.4 · llama.cpp b10448 installed → model qwen3:8b Qwen/Qwen3-8B-GGUF · Q4_K_M · 4.9 GB fits on your GPU you summarise every TODO in this repo ↳ grep "TODO" · allowed by rule ↳ read_file src/api.ts · allowed ↳ write_file report.md · asks you first
FORGE searches Hugging Face, hf-mirror, ModelScope and the Ollama library, measures which source is fastest from where you are, and resumes a download that breaks. Models you already have are found where they live: LM Studio's folder and the Hugging Face cache too.
A 20 GB file arriving on an 8 GB card and then failing to load is the most common way people decide a local AI app is broken. This is the fix.
Chat is the smallest part. FORGE is an agent harness with the plumbing already done.
Reads, writes and edits files inside a workspace it cannot escape. Runs shell commands, searches, globs. Every tool has a permission: allow, ask or deny, and shell commands take regex rules where the last match wins.
"^git (status|diff|log)\b" allow "\brm\s+-[a-zA-Z]*[rf]" deny default ask
One prompt, up to four configurations answering side by side. Models, sampling, system prompts: race them.
Any Model Context Protocol server. Its tools appear to the model behind the same permission engine as everything else.
Instructions, not code. A skill shapes how the agent works and can never fetch or run anything itself. Verified ones are hash-pinned.
An OpenAI-compatible endpoint for your editor or scripts. It forwards prompts and nothing else. Token-guarded, off by default.
Skills and MCP plugins in two honest tiers: verified is reviewed and sha256-pinned, community says so out loud.
Browse the libraryThe same live sources the app searches: GGUF models across Hugging Face and its mirrors, plus the official MCP registry.
Search models and MCP serversSafety
An agent that can edit files and run commands is exactly as trustworthy as the gate in front of it. Here is the gate.
Allow, ask or deny. Reading is allowed by default; writing asks; destructive patterns are denied outright.
Every file tool is resolved against your workspace and refuses anything that escapes it. Not a convention: a check on every call.
The control API answers only your own machine and refuses requests a web page made on your behalf. Even with the model API opened to your network, the agent stays unreachable.
Every byte is checked against a published SHA-256 before it is written. A file that does not match is not written.
Nothing to sign into, nothing that can lock you out, nothing phoning home. The source is public, so this is checkable rather than a promise.
Config is JSON, models are ordinary GGUFs, everything lives in one documented folder. Apache-2.0: fork it, sell with it, leave with everything.
FORGE can drive a real browser and a real desktop. Those three groups are off when
it starts, need you to type I UNDERSTAND to enable, are revoked when
FORGE exits, and are invisible to the model until granted.
Read SECURITY.md
before you turn any of them on.
The agent loop, the permission engine and the tools are plain Python with no dependencies. The whole point is that you can check what it does.
