# AI use cases for Forge Guardian (Mah3Sec/ForgeGuardian)

Repo: [Mah3Sec/ForgeGuardian](https://github.com/Mah3Sec/ForgeGuardian) | Use cases: 4 | Page: https://dedupedai.com/use-cases/mah3sec-forgeguardian/

ForgeGuardian is a local-first, Go-based software supply chain security scanner that checks project dependencies across 9 ecosystems with 8 scan engines.

This file holds every use case of this repo. Each one starts with a "## " heading and ends with its URL.

- Scan project dependencies for risks before release: https://dedupedai.com/use-cases/mah3sec-forgeguardian/scan-project-dependencies-locally/
- Fail CI builds on high-severity dependency findings: https://dedupedai.com/use-cases/mah3sec-forgeguardian/gate-ci-builds-on-high-severity-findings/
- Generate an SBOM for a project in the dashboard: https://dedupedai.com/use-cases/mah3sec-forgeguardian/build-sbom-for-a-workspace/
- Write a detection signature for an internal risk: https://dedupedai.com/use-cases/mah3sec-forgeguardian/write-custom-detection-signature/

## How to scan project dependencies for risks before release with Forge Guardian

Repo: [Mah3Sec/ForgeGuardian](https://github.com/Mah3Sec/ForgeGuardian) | Difficulty: Beginner | Time: 15 minutes | Basis: From the README

Run one local scan to list dependency findings with severity and fix versions, without sending data out.

**Who it is for:** A developer preparing a release who wants to know which dependencies carry known CVEs or suspicious install scripts.

**The problem:** Dependency lists grow quietly, and it is hard to see which packages have known vulnerabilities or malicious behavior.

**The outcome:** A list of findings for the project with severity and fix versions, produced entirely on the local machine.

### Steps

1. Install Forge Guardian with `curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash`
2. Run `fgctl update` to refresh the community signatures
3. Change into your project folder and run `fgctl scan .`
4. Read the findings, noting severity and the fix version listed for each
5. If an optional engine such as Grype, Trivy, or Semgrep is missing, run `fgctl doctor --fix`, then scan again

### Prompt to paste into your agent

```text
Using the repo Mah3Sec/ForgeGuardian, install the CLI and run `fgctl scan .` on <project-path>. Report the findings with severity and fix versions. Verify that the scan ran offline by confirming the output lists engine results for the project's packages.
```

### Caveat

Grype, Trivy, and Semgrep are optional and only run when installed, so the default scan covers the five always-on engines.

Risk, remote script: The install command pipes a script from GitHub directly into bash, so review install.sh first if your policy requires it.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mah3sec-forgeguardian/scan-project-dependencies-locally/

## How to fail CI builds on high-severity dependency findings with Forge Guardian

Repo: [Mah3Sec/ForgeGuardian](https://github.com/Mah3Sec/ForgeGuardian) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Add a GitHub Actions step that scans on every run, fails at high severity, and uploads SARIF to GitHub Security.

**Who it is for:** A platform or DevOps engineer who maintains a GitHub Actions pipeline and must stop risky dependencies from merging.

**The problem:** Vulnerable or malicious dependencies reach main because no automated check runs on pull requests.

**The outcome:** Each CI run scans the project, blocks the build at high severity, and posts findings to the GitHub Security tab.

### Steps

1. Add a step that runs `curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash` and appends `$HOME/.local/bin` to `GITHUB_PATH`
2. Add a scan step with `fgctl scan . --ci --fail-on=high --format=sarif > results.sarif`
3. Add the `github/codeql-action/upload-sarif@v3` step with `sarif_file: results.sarif`
4. Commit the workflow and open a test pull request to confirm the scan runs
5. Check that the build fails when a high-severity finding is present

### Prompt to paste into your agent

```text
For the repo Mah3Sec/ForgeGuardian, add the README's GitHub Actions snippet to the workflow file <workflow-path> in <target-repo>. Expected output is a workflow that runs `fgctl scan . --ci --fail-on=high --format=sarif` and uploads results.sarif. Verify the YAML parses and the upload step references results.sarif.
```

### Caveat

The README shows the SARIF upload step but does not say which GitHub permissions it needs, so check your repository settings before the first run.

Risk, remote script: The CI step downloads and runs install.sh from the main branch, so pin a release or review the script if your pipeline requires it.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mah3sec-forgeguardian/gate-ci-builds-on-high-severity-findings/

## How to generate an SBOM for a project in the dashboard with Forge Guardian

Repo: [Mah3Sec/ForgeGuardian](https://github.com/Mah3Sec/ForgeGuardian) | Difficulty: Intermediate | Time: 30 minutes | Basis: From the README

Use the local dashboard's Inventory page to produce CycloneDX or SPDX software bill of materials files.

**Who it is for:** A compliance or security lead who must hand a software bill of materials to a customer or auditor.

**The problem:** Teams need a standard inventory of components in a release, and building one by hand takes days.

**The outcome:** An SBOM in CycloneDX 1.5 or SPDX 2.3 format for the project, ready to attach to a release or audit file.

### Steps

1. Start the dashboard with `fgctl serve`
2. Open http://localhost:8080 in a browser
3. Open the Inventory section and select the project's workspace
4. Choose SBOM generation and pick CycloneDX or SPDX
5. Download the generated file and store it with the release record

### Prompt to paste into your agent

```text
Using the repo Mah3Sec/ForgeGuardian, start the dashboard with `fgctl serve`, then generate a CycloneDX 1.5 SBOM for <workspace-name> from the Inventory page. Expected output is a saved SBOM file. Verify the file is valid JSON and lists the project's dependencies.
```

### Caveat

The README does not give a CLI command for SBOM export, so this flow uses the dashboard, and the exact menu labels may differ from the README wording.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mah3sec-forgeguardian/build-sbom-for-a-workspace/

## How to write a detection signature for an internal risk with Forge Guardian

Repo: [Mah3Sec/ForgeGuardian](https://github.com/Mah3Sec/ForgeGuardian) | Difficulty: Intermediate | Time: 45 minutes | Basis: From the README

Use the guided intel wizard to add a signature for a package or pattern your team wants blocked.

**Who it is for:** A security engineer who has seen a malicious package or pattern and wants the scanner to catch it without writing Go code.

**The problem:** Community signatures may not cover a package or pattern that matters to your organization.

**The outcome:** A validated, tested signature that the scanner applies to future scans.

### Steps

1. Run `fgctl intel new` and follow the guided wizard, which the README says takes about 10 minutes
2. Run `fgctl intel validate .` to check the signature schema
3. Run `fgctl intel test .` against a real package to confirm the signature matches
4. Run `fgctl scan .` on a project that includes the target to confirm the finding appears

### Prompt to paste into your agent

```text
In the repo Mah3Sec/ForgeGuardian, create a detection signature for <package-or-pattern> using `fgctl intel new`, then run `fgctl intel validate .` and `fgctl intel test .`. Expected output is a passing validation and a test result for the target. Verify that validation passes before testing.
```

### Caveat

The README says a signature needs no Go knowledge, but it does not describe the signature schema, so the wizard's prompts are the source of truth.

Disclaimer: Third-party repos we don't own or vouch for. AI-generated use cases can be wrong: review everything and run at your own risk. Full text: https://dedupedai.com/disclaimer/

URL: https://dedupedai.com/use-cases/mah3sec-forgeguardian/write-custom-detection-signature/