ShipIT Forge · v2.3.0

An agent that works through pull requests.

Forge is an autonomous GitHub coding agent. It investigates issues and opens fixes, reviews pull requests across quality and security lenses, and runs deterministic scanners before it ever calls a model.

Get started with ForgeForge on GitHub

It never merges and never approves — every change is a PR you control.

shipiit/platform · PR #418
reviewing
Pipeline
Issue #412 labelled agent-fixcheckout returns 500 on staging
Deterministic scannerssecrets · infra · source — no model call
Agent reads the repository18 files · sandboxed clone · tool allowlist
Security pass1 high · CWE-918 SSRF · suggested fix
Pull request openedforge/fix-412 · tests green · never merged
Review findings inline + summary
waiting for the security pass…
HIGHCWE-918

Unvalidated URL passed to server-side fetch

src/checkout/webhook.ts:64

MEDCWE-532

Session token written to the request log

src/lib/logger.ts:22

LOWCWE-400

Retry loop lacks an upper bound

src/http/client.ts:118

forge/fix-412 opened

3 findings · check run neutral · nothing merged

scanners · free, pre-modelprompt caching · onnever merges · never approves
How it runs

Deterministic first, the model second.

The cheap, exact checks run before anything is sent to a provider — so the model spends its budget on the findings only a model can reach.

  1. 01

    A GitHub event arrives

    An issue label, a comment command, a new pull request, or a cron routine. Forge clones the repository into a disposable sandbox.

  2. 02

    Scanners run first

    Secrets, infrastructure, and source scanners execute before any model call — deterministic, instant, and free of token cost.

  3. 03

    The agent loop reasons

    A tool allowlist strips unused schemas from every turn, context compaction elides stale output, and prompt caching bills repeated context at roughly a tenth of the input rate.

  4. 04

    Tests verify the change

    The suite runs inside the sandbox. On forge/* branches, failing CI is read, corrected, and re-run as a ci-fix commit.

  5. 05

    Findings merge into one review

    Scanner output and model findings are deduplicated and grouped by rule, then posted as inline comments plus a single summary verdict.

Command surface

Every trigger, and what comes back.

Forge is driven from the places you already work — a label, a comment, a mention, or a key in agent.yml. Pick one to see the transcript it produces.

Pick a trigger01 / 8
Fix an issue/fix
you/fix
forgeReading the issue and mapping the repository…
forgegrep retry|backoff → src/http/client.ts:118
forgePatched on branch forge/fix-412 · 2 files changed
forgepytest -q → 340 passed
forgeOpened PR #418 — closes #412

The issue never gets a paragraph of advice. It gets a branch, a passing suite, and a pull request that closes it.

Also from ShipIt

Meet Forge, your agent on GitHub.

ShipIt Agent lives inside your project. Forge lives on your repository — an autonomous coding agent that fixes issues, opens pull requests, and reviews them with a security pass. Self-hosted, multi-provider, and vision-aware.

It never merges and never approves — every change is a PR you control.

Fix an issue, open a PR

Investigates the repository, writes the fix on a branch, runs the tests, and opens a pull request that closes the issue.

label agent-fix · /fix

Review a pull request

Inline comments plus a summary verdict, across quality and security lenses, scoped strictly to the files that changed.

/review · /review always

Security review

Flags SSRF, injection, secrets, and authz gaps — each with a severity, a CWE, and a suggested-fix block.

automatic on PRs · /security

Deterministic scanners

Secrets, infrastructure, and source scanners run before the model at no token cost, then merge into its findings.

automatic · /secrets

Whole-repo audit

Maps entry points, follows untrusted input through to dangerous sinks, and files one grouped report.

/audit

Routines and skills

Eight built-in prompt packs with enforced tool allowlists, plus saved routines on cron, on demand, or any repo event.

routines: in agent.yml · /run
401
tests passing
9
LLM providers
8
built-in skills
MIT
open source
Explore ForgeForge on GitHub