FORGE runs language models on your own computer and gives them real tools, each behind a permission you grant.
Free and open source, Apache-2.0. The whole app, not a teaser. ~20 MB installer
→ detected NVIDIA GeForce RTX 4070 (12 GB) → engine CUDA 12.4 · llama.cpp b10448 installed → model qwen3:8b Qwen/Qwen3-8B-GGUF · Q4_K_M · 4.9 GB fits on your GPU you summarise every TODO in this repo ↳ grep "TODO" · allowed by rule ↳ read_file src/api.ts · allowed ↳ write_file report.md · asks you first
No Python, no CUDA toolkit, no WSL, no Docker. FORGE brings its own inference engine and picks the build that matches your GPU.
It reads your VRAM and RAM before anything downloads, and tells you which model sizes fit, instead of letting you find out afterwards.
The model can edit files and run commands. It asks before each one, by rules you write, inside a folder it cannot escape.
Apache-2.0, top to bottom: the agent loop, the permission engine, the updater, the UI. Read every line before you trust it.
How it works
There is no step where you go and fetch a dependency yourself. That is the whole design.
FORGEqwen3:4b. FORGE
works out which repository publishes it and which quantisation suits
your machine.Before anything downloads, every quantisation is labelled against your actual hardware:
4.9 GB Q4_K_M the usual pick fits on your GPU 7.6 GB Q6_K near-lossless, big partly on GPU 14.2 GB Q8_0 effectively lossless too big for this machine
FORGE is not tied to one model or one vendor. It searches Hugging Face, hf-mirror, ModelScope and the Ollama library, measures which source is fastest from where you actually are, and resumes a download that breaks. Models you already have are found where they live: it reads LM Studio's folder and the Hugging Face cache too.
A 20 GB file arriving on an 8 GB card and then failing to load is the most common way people decide a local AI app is broken. This is the fix.
Chat is the smallest part. FORGE is an agent harness with the plumbing already done.
Reads, writes and edits files inside a workspace it cannot escape. Runs shell commands, searches, globs. Every tool has a permission: allow, ask or deny, and shell commands take regex rules where the last match wins.
"^git (status|diff|log)\b" allow "\brm\s+-[a-zA-Z]*[rf]" deny default ask
One prompt, up to four configurations answering side by side. Models, sampling, system prompts: race them.
Any Model Context Protocol server. Its tools appear to the model behind the same permission engine as everything else.
Instructions, not code. A skill shapes how the agent works and can never fetch or run anything itself. Verified ones are hash-pinned.
An OpenAI-compatible endpoint for your editor or scripts. It forwards prompts and nothing else. Token-guarded, off by default.
Skills and MCP plugins in two honest tiers. Verified means a maintainer reviewed it and pinned the file by sha256, so what installs is byte-for-byte what was reviewed. Community means nobody has, and FORGE says so before it installs anything.
Browse the library
The same live sources the app searches: GGUF models across Hugging Face and its mirrors, plus the public MCP registry. Browse here, install with one click inside FORGE.
Live from huggingface.co and registry.modelcontextprotocol.io
Search models and MCP serversSafety
An agent that can edit files and run commands is exactly as trustworthy as the gate in front of it. Here is the gate.
Allow, ask or deny. Reading is allowed by default; writing asks; destructive patterns are denied outright.
Every file tool is resolved against your workspace and refuses anything that escapes it. Not a convention: a check on every call.
The control API answers only your own machine and refuses requests a web page made on your behalf. Even with the model API opened to your network, the agent stays unreachable.
FORGE replaces its own code when it updates, so every byte is checked against a published SHA-256 first. A file that does not match is not written.
FORGE can drive a real browser and a real desktop. Those three groups are
off when it starts, need you to type I UNDERSTAND to enable,
are revoked when FORGE exits, and are invisible to the model until granted.
Read SECURITY.md
before you turn any of them on.
Most local AI apps are local until the business model needs them not to be. FORGE is built so leaving is easy, which is the only honest way to make staying worth it.
Being worked on now, shipping in the next releases. Nothing here is promised as current.
The agent loop, the permission engine and the tools are plain Python with no dependencies. The whole point is that you can check what it does.