ForgeGuardian

What it is

ForgeGuardian is an Apache 2.0 supply chain scanner with a CLI (fgctl) and a self-hosted dashboard. The page says the engine, CLI and community tools are free, and that a Pro tier adds team features. The summary covers the feature list. This document covers how to run it and wire it into CI.

What to do

Install options, as the page gives them:

curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash

irm https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.ps1 | iex

docker run -d --name forgeguardian -p 3000:3000 ghcr.io/mah3sec/forgeguardian

Building from source uses git clone https://github.com/Mah3Sec/ForgeGuardian.git, then cd ForgeGuardian && make build.

Basic use:

fgctl scan .        # findings with severity and fix versions
fgctl serve         # dashboard
fgctl doctor --fix  # auto-install missing optional engines
fgctl update        # update signatures

GitHub Actions workflow steps, which fail the build on high severity and upload SARIF to GitHub Security:

- name: Install ForgeGuardian
  run: |
    curl -sSfL https://raw.githubusercontent.com/Mah3Sec/ForgeGuardian/main/install.sh | bash
    echo "$HOME/.local/bin" >> $GITHUB_PATH
- name: Scan
  run: fgctl scan . --ci --fail-on=high --format=sarif > results.sarif
- name: Upload to GitHub Security
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Custom detection signatures need no Go code:

fgctl intel new        # guided wizard
fgctl intel validate . # validate schema
fgctl intel test .     # test against real package

Caveats

• The install steps pipe a script from the main branch into a shell, and the CI example does the same on every run. Pinning a release or checking the published provenance first is a decision for the adopter. The page claims SLSA Level 3 provenance and SBOMs for every release but gives no verification steps.
• The page is inconsistent on ports: the Docker command maps 3000, while fgctl serve is said to open http://localhost:8080.
• The page does not name the 8 engines (the list is missing from the fetched text), and it gives no detection rates, false-positive data or benchmarks.
• The "zero telemetry" and "offline" claims are the project's own statements. AI features are described as opt-in and multi-provider, including local LLMs.
• A live demo is listed at forgeguardian.dev.