How to use Forge Guardian: what you can do with it

4 use cases

• Scan project dependencies for risks before release

  Run one local scan to list dependency findings with severity and fix versions, without sending data out.

  • REPO Mah3Sec/ForgeGuardian
  • Security and science
  • Beginner
  View prompt

  Using the repo Mah3Sec/ForgeGuardian, install the CLI and run `fgctl scan .` on <project-path>. Report the findings with severity and fix versions. Verify that the scan ran offline by confirming the output lists engine results for the project's packages.

  Share Email me this

• Fail CI builds on high-severity dependency findings

  Add a GitHub Actions step that scans on every run, fails at high severity, and uploads SARIF to GitHub Security.

  • REPO Mah3Sec/ForgeGuardian
  • Security and science
  • Intermediate
  View prompt

  For the repo Mah3Sec/ForgeGuardian, add the README's GitHub Actions snippet to the workflow file <workflow-path> in <target-repo>. Expected output is a workflow that runs `fgctl scan . --ci --fail-on=high --format=sarif` and uploads results.sarif. Verify the YAML parses and the upload step references results.sarif.

  Share Email me this

• Generate an SBOM for a project in the dashboard

  Use the local dashboard's Inventory page to produce CycloneDX or SPDX software bill of materials files.

  • REPO Mah3Sec/ForgeGuardian
  • Security and science
  • Intermediate
  View prompt

  Using the repo Mah3Sec/ForgeGuardian, start the dashboard with `fgctl serve`, then generate a CycloneDX 1.5 SBOM for <workspace-name> from the Inventory page. Expected output is a saved SBOM file. Verify the file is valid JSON and lists the project's dependencies.

  Share Email me this

• Write a detection signature for an internal risk

  Use the guided intel wizard to add a signature for a package or pattern your team wants blocked.

  • REPO Mah3Sec/ForgeGuardian
  • Security and science
  • Intermediate
  View prompt

  In the repo Mah3Sec/ForgeGuardian, create a detection signature for <package-or-pattern> using `fgctl intel new`, then run `fgctl intel validate .` and `fgctl intel test .`. Expected output is a passing validation and a test result for the target. Verify that validation passes before testing.

  Share Email me this

Quick start with Forge Guardian

1. Check you have what it needs: A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker; A project directory with dependencies to scan; Git and make only if building from source.
2. Open Mah3Sec/ForgeGuardian on GitHub and read the README and license.
3. Install Forge Guardian with curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash
4. Run fgctl update to refresh the community signatures
5. Change into your project folder and run fgctl scan .
6. Read the findings, noting severity and the fix version listed for each

These steps come from our top use case, Scan project dependencies for risks before release, which also has a copy-paste agent prompt.

Using the Deduped MCP, get the setup steps for Mah3Sec/ForgeGuardian

claude mcp add --transport http deduped https://dedupedai.com/mcp

Forge Guardian alternatives · Best AI repos for Security and science

About this repo

• Who it is forDevelopers and security engineers who need to check a project's dependencies for known CVEs and malicious packages before shipping.
• Why it is hot106 stars, launched 70 days ago
• LanguageGo
• Sourcegithub.com/Mah3Sec/ForgeGuardian · Back to Hot repos

Requirements

• A terminal (bash on Linux or macOS, or PowerShell on Windows), or Docker
• A project directory with dependencies to scan
• Git and make only if building from source

Related repos

• Trended earlier REPO Ch1nfo/RiftX RiftX RiftX is a local TypeScript workbench that combines AI agent chat, a Playwright browser, multi-agent task coordination, and evidence capture for explicitly authorized web security testing.
• Trended earlier REPO Elite588/Hacker Hacker Elite588/Hacker is a curated collection of cybersecurity references, scripts, tools, labs, and training material, maintained by Omar Santos as supplemental material for his books, courses, and live training.
• Trended earlier REPO inin-zou/codex-privacy-hud Codex Privacy Hud A local-first Codex plugin that records hook observations in a session ledger, shows a privacy HUD for each session, and can deny or rewrite tool input before it runs.