GROUP_ID, SESSION_ID, and POLICY_ID are opaque Forge IDs unless
the command explicitly accepts a readable selector.
Read commands
Core
capabilities list returns authorization metadata for the active actor.
Session, entity, and finding commands require an organization.
Search and list commands return a bounded page rather than an implicit full
export. Follow the response’s cursor, offset, or page fields until its
continuation indicator is empty. Totals returned by aggregate operations are
computed across the complete matching scope; their dimension breakdowns remain
bounded to the limits declared by the operation.
Inventory
inventory list searches grouped inventory. components expands one group.
The MCP inventory commands query discovered configuration files, servers, or
tools rather than registry definitions.
Audit and compliance
audit export-jsonl writes JSON Lines, not a JSON array. Compliance export
defaults to json.
Devices and configuration
The CLI retainsfleet as the command group for device operations.
Policies and violations
--finding-linked accepts all, true, false, or linked.
policies export writes only the saved definition. Use --revision
to pin the exact immutable revision that produced a policy hit; omit it to pull
the current revision into Git. A policy definition can be backtested before
deployment with forge policies backtests run --family FAMILY --file POLICY.json --mode quick.
Policy-as-code validation and packaging:
rego-format runs locally using Rego v1. Other Rego commands submit the bounded
module and optional input to Forge’s policy-code validation contract.
The package commands support fixture-backed regression tests through
tests.json. See the repository’s examples/detection-as-code directory for
a minimal GitHub Actions workflow.
Governance and approvals
Resources
curl, psql, mysql, or redis-cli command can consume it directly. Use
--json to include tokenType and expiresAt. Service accounts use the
headless Resource direct-access API instead of interactive CLI identity.
Registry commands
MCP servers
SERVER accepts the registry item slug or ID. Install modifies only the
selected client’s MCP entry and records the installation in the active Forge
profile. run provides a local stdio bridge for clients that cannot use the
remote gateway directly.
Upstream OAuth administration:
Skills
Deployments
init creates the server-side deployment draft and writes its starter
forge.yaml with mode 0600; it refuses to overwrite an existing file unless
--force is present. Validation expands ${VAR} references from --env-file
and then the process environment. Deployment validates before submitting and
defaults to the local_docker runtime adapter.
Write commands
The following signatures show their required safety inputs. A command can still require additional domain values.forge mcp tokens SERVER to find token IDs and review non-secret
credential metadata. Gateway token secrets are returned only when created or
rotated.
Governance mutations:
apply creates when --revision is zero or omitted. A positive revision
performs an optimistic update of the policy ID inside the JSON document.
restore creates a new current revision from the selected historical revision;
it does not rewrite revision history.
Script parsing
Treat JSON fields as a versioned API response, not formatted terminal text:1 and writes a
redacted error message to stderr.