A local AI agent you fully own — agent loop, permissions, MCP, a multi-model fleet and a side-by-side arena. ~1500 lines of readable code. Zero cloud. Zero telemetry.
Not a wrapper around someone else's harness — the whole machine, in code you can read in one sitting.
Streaming reasoning + tool calls against your own model. Seven built-in tools: read, write, edit, bash, list, glob, grep — all path-jailed to a workspace.
Allow / ask / deny per tool, regex rules for shell commands. Ask pauses the agent mid-run until you approve. Deny rules hold even in auto-approve mode.
Full Model Context Protocol client with registry discovery. Connected servers' tools reach the agent behind an approval gate — never silently.
One prompt, up to four models answering side by side — GPU flagship next to CPU fleet models, each lane with its own sampling profile.
Search HuggingFace in-app, download any GGUF with progress, and it self-registers as a runnable server. Start and stop models like containers.
temperature, top_p, top_k, min_p, both penalties, seed, stop sequences, reasoning_effort, preserve_thinking — applied per message, live.
Real transcript from the test suite — the agent wrote the file, ran it, and verified its own output.
# task: write fizzbuzz.py, RUN it, confirm output [write_file] fizzbuzz.py (245 chars) ✓ ok [bash] python3 fizzbuzz.py ✓ exit 0 1 2 Fizz 4 Buzz Fizz 7 8 Fizz Buzz 11 Fizz 13 14 FizzBuzz … DONE turns=3 tools=2 ~24 tok/s local "Line 15 of the output is: FizzBuzz"
An agent that runs shell commands must be treated like what it is. FORGE binds to localhost only, jails every file path, and gates every risky action behind you.
Every file operation resolves through realpath and refuses to leave the workspace. Traversal and absolute-path escapes are unit-tested blocked.
rm -rf, sudo, disk tools, force-push, curl-pipe-to-shell — refused even with auto-approve on.
Third-party tools are namespaced, approval-gated by default, and server-initiated requests to drive your model are refused at the protocol level.