Skip to main content

v3.0.0

The Forger's Guide

43+ commands, 20 skills, 12 agents. From idea to deploy, without friction.

01What is Forge?v3.0

We plan first. Not because we're slow — but because the time you 'save' by skipping planning you pay back ten times over in rework, architecture bugs, and code nobody understands.

Forge is a unified planning and construction system for building production-ready SaaS applications with Claude Code. It's a complete factory that takes you from idea to deployed code.

The Philosophy

🔨La Herreria
Plan before you build. A clear blueprint before the first git commit. Never write code without an approved plan.
🛡️Auto-Shielding
Every error is an opportunity to harden the factory. It gets fixed, documented, and never happens again.

The Complete Flow

💡 IDEA
/planBMCPDRTech SpecUXStoriesDesignSecurityBLUEPRINT
/crisolStrategic ValidationBuild Confidence Score
/buildLa PiezaPhasesYunque / ForjaDEPLOY
Tip: If it's your first time, start with /onboarding. It gives you a personalized route based on your experience and what you want to build.

02Installation & First Steps

Mac / Linux

Windows (WSL)

Step 0: What you need first

Before cloning Forge, you need three tools. If you already have them, skip to Step 1.

Claude Code (or Claude Desktop)

What is it? The AI agent you'll use to build. Claude Desktop is the version with a graphical interface — easiest to get started.

Option A — Claude Desktop (recommended if you're not technical):

Download it at claude.ai/download. Claude Code is included automatically.

claude.ai/download

Option B — CLI only (for advanced users):

npm install -g @anthropic-ai/claude-code

Verify it works:

claude --version

Node.js 18+

What is it? The engine that runs your app's code. Forge needs it to run Next.js.

Mac:

brew install node

Windows (inside Ubuntu/WSL):

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs

Verify it works:

node --version

GitHub Access (your Forge invite)

What is GitHub? A platform for storing and sharing code — think of it as a specialized Google Drive for software.

  1. 1Look in your email for a message from noreply@github.com with subject "You've been invited..."
  2. 2Click "View invitation" → then click "Accept invitation"
  3. 3If you bought Ultimate: repeat with the second email (Forge Arsenal)
Tip: Didn't get the invite? Check spam. If you still can't find it, email forge@getforja.com

Windows Users

Forge runs natively on macOS and Linux. On Windows, you need WSL 2 (Windows Subsystem for Linux). It takes about 5 minutes:

1

Open PowerShell as Administrator and run:

wsl --install
2

Restart your computer when prompted

Open Ubuntu from the Start menu and create your Linux username/password

3

Inside Ubuntu, install Node.js:

curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -
sudo apt-get install -y nodejs git
4

Continue with the setup steps above — all commands run inside Ubuntu/WSL

Tip: Use VS Code with the WSL extension for the best experience. It connects your editor directly to the Linux environment. Also note: in Claude Code on Windows, Shift+Enter sends the prompt instead of adding a new line. Use \n in your text or write longer prompts in a text file.

Setup in 4 Steps

1

Clone the repository

git clone https://github.com/getforja/forge-pro.git ~/forge
2

Create the forge alias

# For zsh (macOS default)
echo "alias forge='cp -r ~/forge/. .'" >> ~/.zshrc
source ~/.zshrc

# For bash
echo "alias forge='cp -r ~/forge/. .'" >> ~/.bashrc
source ~/.bashrc
3

Create your first project

mkdir mi-saas && cd mi-saas
forge                           # Copy all infrastructure
npm install                     # Install dependencies
cp example.mcp.json .mcp.json  # Configure MCPs (add your keys)
npm run dev                     # Start dev server
4

Start Claude Code

claude .                        # Open Claude Code in the project
/forge-check                    # Verify everything is configured
/onboarding                     # Personalized route to get started
Security: Edit .mcp.json with your real keys but never commit it. It's already in .gitignore.

What does forge install?

File / FolderPurpose
CLAUDE.mdFactory OS — The agent's brain (all the rules)
.claude/Commands, agents, skills, PRPs, AI templates, design systems
example.mcp.jsonPre-configured MCPs (you need your own keys)
src/Source code with Feature-First architecture
package.jsonGolden Path dependencies (Next.js 16, React 19, etc.)

03The Forge Flow (End-to-End)

Phase 1: Planning — /plan

The /plan command activates La Herreria, a pipeline of up to 10 skills that transform your idea into an executable Blueprint.

#SkillOutputTime
1Business Model CanvasBMC-[name].md~30 min
2Product Definition ReportPDR-[name].md~20 min
3Tech SpecTECH-SPEC-[name].md~15 min
4UX ResearchUX-RESEARCH-[name].md~40 min
5User StoriesUSER-STORIES-[name].md~30 min
6UX DesignUX-DESIGN-[name].md~45 min
7UI Design WireframesUI-WF-[name].md~45 min
8UI ImplementationDesign system + UI + DESIGN.md~30 min
9Security AuditSECURITY-AUDIT-[name].md~60 min
10Master BlueprintBLUEPRINT-[name].md~45 min

Total: 5-8 hours -> 10 professional documents. Times vary by idea complexity and user interactions.

Optional Skills

Depending on the Build Mode, the pipeline may include:

  • Lean Canvas — Quick BMC alternative for MVPs
  • Job Stories — Alternative to User Stories (When I... format)
  • Pre-Mortem — Risk analysis before building
  • Interview Script — Script for validating with real users

Phase 2: Construction — /build

The /build command takes the approved Blueprint and executes it. It asks how you want to build:

🔧Build Manual (El Yunque)

Phase by phase, with your approval at each step. Ideal if you want total control. El Yunque maps real context, generates subtasks, validates with Playwright, and documents learnings.

Delimit → Map → Execute → Shield → Transition

🔨Forge Mode (Parallel)

Launches N autonomous agents in parallel sandboxes. Each with a different personality (literal, creative, disruptive). You cherry-pick the best.

Faster but less granular control. Ideal for independent features.

BLUEPRINT
/crisolStrategic Validation
/buildLa PiezaPhases
Build Manual (El Yunque)Forge Mode (Parallel)
DEPLOY
Git tip: During the build, each subtask generates an atomic commit: feat(F1-T1): create auth service. If something fails, you can revert exactly that task.

04Planning — La Herreria

The /plan command activates La Herreria, a pipeline of up to 10 skills that transform your idea into an executable Blueprint. Each skill produces a professional document.

The 10 Skills

#SkillOutputTime
1Viability CheckGo / No-Go decision~10 min
2Business Model CanvasBMC-[name].md~30 min
3Product Definition ReportPDR-[name].md~20 min
4Tech SpecTECH-SPEC-[name].md~15 min
5UX ResearchUX-RESEARCH-[name].md~40 min
6User StoriesUSER-STORIES-[name].md~30 min
7UX DesignUX-DESIGN-[name].md~45 min
8UI ImplementationDesign system + UI + DESIGN.md~30 min
9Security AuditSECURITY-AUDIT-[name].md~60 min
10Master BlueprintBLUEPRINT-[name].md~45 min

Total: 5-8 hours → 10 professional documents. Times vary by project complexity.

Build Modes

La Herreria adapts to your project type:

Full SaaS

10+4 skills · 5-8h — Complete pipeline for production products

MVP to Validate

7 skills · 2-3h — Validate before investing more time

Internal Tool

10 skills · 4-6h — No business model needed

Landing Page

4 steps · ~1h — High-conversion landing page

AI Feature

7 steps · 2-4h — Features with Vercel AI SDK + OpenRouter

Project Personalizationv2.8

The /forge-init command personalizes CLAUDE.md for your specific project. It adds an Active Project section, generates a project-specific README, and deactivates irrelevant skills based on your project type.

/forge-init
Tip: If you need a skill that was deactivated, use /forge-activate to bring it back. Forge auto-detects when you need an inactive skill and asks if you want to reactivate it.

05El Crisol — Strategic Validationv2.5

El Crisol is an optional phase between /plan and /build. It runs 7 strategic analyses to validate your Blueprint before you invest time building. The output is an interactive HTML dashboard with a Build Confidence Score.

Optional: El Crisol is not required. If you're confident in your plan, go straight to /build. Use El Crisol when you want data-backed validation before committing to a build.

The 7 Analyses

🧭Brujula
Product vision, positioning, and competitive moat analysis.
Estrella
North Star Metric — the single metric that guides everything.
⚔️Rivales
Competitive landscape analysis with battlecards.
💰Precio
Monetization model, pricing strategy, and unit economics.
📊ROI
Financial projections with interactive HTML dashboard.
🎯Metas
OKRs and outcome-based roadmap.
🚀Lanzamiento
Go-to-Market strategy and launch plan.

Build Confidence Score

A weighted score from 1-10 across all 7 dimensions. It tells you whether to proceed, adjust, or pivot before writing code.

ScoreVerdictAction
8-10GoProceed to /build with confidence.
5-7CautionReview weak areas before building.
1-4No-GoSignificant issues found. Revisit your plan.

Output

El Crisol produces an interactive HTML dashboard with Bento Grid layout, Liquid Glass effects, and Chart.js visualizations. All 7 analyses in a single, shareable file.

When to use: Use El Crisol for SaaS products, MVPs where you need investor validation, or any project where you want strategic clarity before committing engineering resources.

06Build Modes

When you run /plan, La Herreria asks what you want to build. Each mode activates an optimized pipeline:

🏗️Full SaaS

10+4 skills · 5-8h

Full pipeline with BMC, PDR, Tech Spec, UX Research, User Stories, UX/UI Design, Security Audit, and Blueprint. For products going to production with real users.
🚀MVP to Validate

7 skills · 2-3h

Reduced pipeline: Lean Canvas, fast PDR, Tech Spec, User Stories, Wireframes, and Blueprint. To validate the idea before investing more time.
🔧Internal Tool

10 skills · 4-6h

Similar to SaaS but without full BMC (no business model needed for internal tools). Focus on functional UX and efficiency.
🎯Landing Page

4 steps · ~1h

Express pipeline: copy strategy, section structure, design system, and deploy. For high-conversion landing pages.
🤖AI Feature

7 steps · 2-4h

Specialized pipeline for features using Vercel AI SDK + OpenRouter. Includes pre-configured LEGO templates in .claude/ai_templates/.

Mode Comparison

ModeSkills / StepsTimeUse case
Full SaaS10+4 skills · 5-8h5-8hProduction product with real users
MVP to Validate7 skills · 2-3h2-3hValidate before investing more time
Internal Tool10 skills · 4-6h4-6hNo business model needed
Landing Page4 steps · ~1h~1hHigh-conversion landing page
AI Feature7 steps · 2-4h2-4hAI-powered features
Tip: If you don't know which mode to pick, /onboarding guides you with questions to determine the right mode for your case.

Building Blocks

/add-login

Complete auth with Supabase (Email/Password + OAuth).

/add-insforge

InsForge setup — agents-first BaaS alternative.

/add-payments

Polar or Stripe payment integration.

/add-emails

Transactional emails with Resend + React Email.

/add-mobile

PWA + push notifications (iOS compatible).

5 Design Systems

Neobrutalism

Thick borders, vibrant colors, bold typography.

Bento Grid

Apple-style layout, asymmetric cards, whitespace.

Neumorphism

Soft shadows, extruded elements, tactile feel.

Liquid Glass

Transparencies, blur, elegant glassmorphism.

Gradient Mesh

Complex gradients, mesh backgrounds, depth.

07Command Reference

Main Pipeline

/plan

Complete planning pipeline. 10 skills -> executable Blueprint.

/build

Build from Blueprint. Choose Manual Build or Forge Mode.

/crisol

Strategic validation — 7 analyses + Build Confidence Score.

Setup & Orientation

/onboarding

Personalized route based on your experience and goal.

/forge-check

Environment diagnostic — MCPs, deps, hooks, credentials.

/avivar

Load project context from STATE.md. For resuming sessions.

/landing

Create high-conversion landing pages with copy and structure.

/add-login

Implement auth with Supabase (Email/Password) end-to-end.

/redesign

Audit existing project -> report -> fixes by impact order.

/forge-init

Personalize CLAUDE.md and filter skills by project type.

/forge-activate

Reactivate disabled skills from .claude/_inactive/.

/add-insforge

InsForge setup — agents-first BaaS alternative.

Design Quality

/critique

UX/UI evaluation across 10 dimensions + AI slop detection.

/polish

Visual quality micro-refinements. Final pass.

/normalize

Align UI with the defined design system.

/design

Generate, extract, or sync DESIGN.md — your project's design DNA.

/web-audit

150+ Lighthouse checks: Performance, A11y, SEO, Best Practices.

Product Strategy

/brujula

Product Vision + 9-section Strategy Canvas.

/precio

Pricing and monetization strategy.

/estrella

North Star Metric — the metric that guides everything.

/rivales

Competitive analysis + battlecards.

/lanzamiento

Complete Go-to-Market strategy.

/metas

OKRs + Outcome Roadmap.

Business Intelligence

/roi

HTML dashboard with SaaS metrics (MRR, CAC, LTV, ROI).

/graduate

Evaluate MVP -> graduation plan to production-ready SaaS.

/kanban

Visual Kanban board by User Story (HTML).

Engineering Workflow

/despachar

Auto ship: merge, test, review, commit, push, PR.

/inspeccionar

Pre-landing review: 11 Golden Path categories.

/fragua-review

Product review with founder mindset.

/retro

Retrospective: metrics, sessions, streaks, team-aware.

/adversarial-review

Security review with 4 attacking agents + Codex.

/audit-tokens

Token efficiency audit — 8 checks + score + top 5 fixes.

Lifecycle

/update-forge

Update Forge to the latest version.

/eject-forge

Remove Forge from the project — leave only your code.

08The Golden Path (Single Stack)

They can have any color they want, as long as it's black.
Henry Ford — No technology choices are made. The perfected stack is executed.
LayerTechnologyWhy
FrameworkNext.js 16 + React 19 + TypeScriptFull-stack, Turbopack 70x faster
StylesTailwind CSS 3.4Utility-first, no context switching
BackendSupabase OR InsForgeAuth + DB + RLS — choose your BaaS
AI EngineVercel AI SDK v5 + OpenRouterNative streaming, 300+ models
ValidationZodType-safe at runtime and compile-time
StateZustandMinimal, no Redux boilerplate
TestingPlaywright MCPAutomatic visual validation
DeployVercelZero-config, edge functions

Backend Choice

What backend do you need?

Supabase

  • +Mature ecosystem (6+ years)
  • +Enterprise SLAs
  • +Extensive documentation
  • +Best for human DX
/add-login

InsForge

NEW
  • +Agents-first design
  • +30% fewer tokens on MCP
  • +Built-in Model Gateway
  • +Self-hosting optimized
/add-insforge

Feature-First Architecture

All the context for a feature lives in one place. You don't jump between 5 folders.

src/
├── app/
│   ├── (auth)/
│   ├── (main)/
│   └── layout.tsx
│
├── features/
│   ├── auth/
│   │   ├── components/
│   │   ├── hooks/
│   │   ├── services/
│   │   ├── types/
│   │   └── store/
│   └── [feature]/
│
└── shared/
    ├── components/
    ├── hooks/
    ├── lib/
    └── types/

MCPs — Your Senses and Hands

🧠Next.js DevTools

Quality Control

Build/runtime errors in real time. init, nextjs_call, nextjs_docs.
👁️Playwright

Your Eyes

Navigate, capture, and interact with the browser for visual validation.
🖐️Supabase

Your Hands

SQL, migrations, RLS policies, table management without CLI.

09Specialized Agents

Forge includes 12 agents that activate based on context during the build.

AgentSpecialtyWhen it activates
frontend-specialistUI/UX implementationBuilding interfaces and components
backend-specialistAPIs, DB, server logicBuilding backend and API routes
codebase-analystCode analysisDebugging, refactoring
supabase-adminDB, RLS, migrationsSupabase operations
db-architectSchema design, indexingBefore complex schemas
vercel-deployerDeploy, CI/CDDeployments to production
validacion-calidadTesting, general QAPre-deploy validation
testing-engineerUnit, integration testsPost-implementation
design-criticUX/UI evaluationPost-build design review
qa-auditorA11y + Performance + SecurityPre-deploy quality audit
observability-engineerLogging, Sentry, metricsPre-deploy to production
gestor-documentacionDocs, changelogsProject documentation

Included Design Systems

During UI Design (Skill #8), you can choose one of 5 pre-configured design systems:

Liquid Glass

Transparencies, blur, elegant glassmorphism.

Neobrutalism

Thick borders, vibrant colors, bold typography.

Neumorphism

Soft shadows, extruded elements, tactile feel.

Bento Grid

Apple-style layout, asymmetric cards, whitespace.

Gradient Mesh

Complex gradients, mesh backgrounds, depth.

20 Built-in Skills 20 skills

SkillPurpose
la-herreriaPlanning pipeline orchestrator (10 skills)
el-crisolStrategic validation (7 analyses + dashboard)
la-forjaParallel agent execution in sandboxes
impeccableDesign Quality Engine + AI slop detection
web-quality150+ Lighthouse checks
token-auditorToken efficiency analysis (8 checks + score)
karpathy-principles4 coding discipline principles
memory-managerGit-versioned memory in .claude/memory/
supabaseDatabase reference guide
insforgeInsForge reference + Model Gateway
add-emailsResend + React Email setup
add-paymentsPolar or Stripe decision tree
add-mobilePWA + push notifications
image-generationOpenRouter + Gemini text-to-image
website-3dCinematic landing with scroll-stop
video-visualsSketchnote branding visuals
autoresearchKarpathy-based auto-optimization
skill-creatorGuide for creating custom skills
forge-referenceExtended MCPs/hooks/agents reference
forge-tipsProgressive contextual tips

10Security & Auto-Shielding

Security is not an optional step at the end. It's the difference between a product and an attack vector.

Protection Layers

1

Automatic Hooks (Pre-commit)

The security-scan.sh hook scans every commit for: AWS keys, API tokens, hardcoded passwords, JWT tokens, console.log with sensitive data, wildcard CORS, and dangerouslySetInnerHTML.
2

Skill #9: Security Audit (during /plan)

Before the Blueprint, audits OWASP Top 10, vibe coding risks, scalability, and observability. Cross-references ~200 threats in threat-db.yaml. Critical vulnerabilities block the Blueprint.
3

Continuous Auto-Shielding (during /build)

Every error found is documented at 3 levels: the current Pieza, reusable prompts, and CLAUDE.md for universal rules. The system learns — the same error never happens twice.

7 Fail-Open Hooks

Principle: if a hook fails unexpectedly, it approves the action. It never traps the user.

HookTypeFunction
pre-commit-validationPreToolUseTypeScript typecheck before commit
security-scanPreToolUseDetects secrets, wildcard CORS, debug code
auto-formatPostToolUseAutomatic Prettier on file edit
test-runnerPostToolUseTests related to the edited file
cost-trackerPostToolUseUsage tracking per session
log-tool-usagePostToolUseAudit log of tools used
stop-hookStopReview Loop when session ends

claude config set hookMode auto

Adversarial Review v2.6

The /adversarial-review command launches 4 attacking agents that try to break your app from different angles: injection, auth bypass, data exposure, and supply chain. Codex provides a second opinion. Critical findings block deployment.

How it works: 4 specialized attackers probe your code in parallel. Each generates a findings report. Vulnerabilities are ranked by severity with concrete fix suggestions.

Critical Security Rules

RLS Required: Every table in Supabase needs Row Level Security. Without RLS, the anon key exposes all data to the public.
NEXT_PUBLIC_ carefully: Only the Supabase anon key goes with NEXT_PUBLIC_. Never service_role, private API keys, or secrets.
Secrets out of chat: Never paste API keys or passwords in the AI chat. Use references: the environment variable SUPABASE_KEY.
Ghost Packages: Verify every package suggested by AI exists on npmjs.com, has more than 1000 weekly downloads, and is actively maintained.

11Tips System

Forge reveals its capabilities progressively. Instead of showing you 30+ commands at once, it gives you relevant tips based on what you're doing.

Karpathy Principles v2.8

🧠Think Before Coding
Surface assumptions, present tradeoffs, ask for clarifications before writing a single line.
✂️Simplicity First
Write the minimum code for today's problem. Don't abstract prematurely.
🔬Surgical Changes
Touch ONLY what's necessary. No drive-by refactoring, no cosmetic changes.
🎯Goal-Oriented Execution
Define success criteria before implementing. Know when you're done.

Token Auditor v2.7

The /audit-tokens command analyzes your Forge configuration for token efficiency. It runs 8 checks, generates a 0-100 score, and provides the top 5 fixes to reduce token usage.

Tip: Run /audit-tokens after /forge-init to optimize your configuration before starting the build.

3 Types of Tips

Tip: Feature discovery. Helps you discover Forge commands and capabilities that are relevant at that moment.Example: Use /kanban to see a visual board of each User Story's progress.
Security: Security alerts and recommendations based on the threat database (~200 threats), OWASP, and vibe coding risks.Example: Every new table needs RLS from day one. Without RLS, the anon key exposes data.
Git: Workflow best practices — atomic commits, branches, PRs, push, and error recovery.Example: Commit after each subtask. One atomic commit = one clean rollback.

System Rules

  • Frequency: every 3-5 messages, not every response
  • Maximum 1 tip per response (of any type)
  • Priority: Security > Git > Tip
  • Don't repeat tips already shown in the session
  • Always actionable — includes the concrete command
  • Read the tone — if you're in a hurry, the tip is omitted

When They Appear

MomentTypical TypeExample
First messagesTip/onboarding gives you a personalized route
Between /plan skillsTipSecurity Audit coming with ~200 threats
Creating DB tablesSecurityRLS required from day one
Subtask completedGitGood time for an atomic commit
UI implementedTip/critique evaluates in 10 dimensions
Installing packageSecurityVerify the package on npmjs.com
Feature completeGitCreate a PR to document the change
Long contextTipConsider /avivar for a fresh session

12Cheat Sheet

Your First Project (Quick Start)

# 1. Setup (once)
git clone https://github.com/getforja/forge-pro.git ~/forge
echo "alias forge='cp -r ~/forge/. .'" >> ~/.zshrc && source ~/.zshrc

# 2. New project
mkdir my-app && cd my-app
forge && npm install
cp example.mcp.json .mcp.json  # Add your keys

# 3. Start with Claude
claude .
/forge-check    # Verify environment
/plan           # Plan (or /onboarding if first time)
/crisol         # Strategic validation (optional)
/build          # Build from Blueprint

Commands by Phase

PhaseCommands
Orientation/onboarding, /forge-check
Strategy/brujula, /precio, /estrella, /rivales
Planning/plan
Construction/build, /add-login, /add-insforge, /add-payments, /add-emails, /add-mobile, /landing
Design Quality/critique, /polish, /normalize, /design
Web Quality/web-audit
Engineering/inspeccionar, /despachar, /fragua-review, /retro
Business Intelligence/roi, /graduate, /kanban, /metas, /lanzamiento
Lifecycle/update-forge, /eject-forge, /avivar
Strategic Validation/crisol

Claude Code Keyboard Shortcuts

ShortcutAction
Ctrl+UClear current input
@Mention a file to include it in context
Shift+EnterNew line without sending
Esc EscCancel current operation
/forkCreate a parallel task

Git Conventions

# Atomic commit format
feat(F1-T1): create auth service with signUp and signIn
fix(F1-T3): fix RLS policy for profiles table
refactor(F2-T1): extract validation utils
test(F3-T2): add permission middleware tests
style(F2-T4): align spacing in dashboard

# Valid types
feat | fix | refactor | test | style | docs | chore
Your next project.
Forged, not generated. Plan first. Forge always.

Ready to start forging?

Get instant access to all 43+ commands, the full planning pipeline, El Crisol strategic validation, and lifetime updates.

Buy Forge — $149