Skip to main content
Cloud artifact scanning finds AI software, MCP configuration, skills, models, packages, and workload evidence inside immutable container images and opt-in cloud filesystem snapshots.

​
Supported sources

OCI images are acquired by registry, repository, platform, and digest. Multiple tags or workloads that resolve to the same immutable artifact share one current scan result. Snapshot scanning currently supports Linux amd64 and arm64 filesystems.

​
What Forge inspects

The scanner reads bounded package databases, dependency manifests, OCI config, executables, MCP declarations, SKILL.md files, and recognized model files. It emits paths, hashes, safe metadata, confidence, parser revision, and coverage gaps. It does not return secret values or unrestricted file contents. An MCP SDK dependency is evidence, not proof of a running MCP server. A parseable skill manifest produces a skill identity linked to the image or workload occurrence.

​
Safety and cleanup

Image scans are digest-pinned. Snapshot scans create only deterministically named, Forge-tagged temporary resources in the configured provider scope. The one-off scanner receives no Forge database credential or saved cloud-connection credential, and result upload uses a single-use job-and-attempt capability. After scanning, Forge detaches and deletes temporary resources and verifies their absence. A separate cleanup worker reconciles expired tagged resources after worker or container replacement. Forge does not delete untagged customer resources.

​
Limits and partial coverage

Artifact discovery and scanning are bounded by page, item, byte, layer, file-count, archive-depth, duration, evidence-size, attempt, and concurrency limits. Discovery cursors resume later syncs instead of requiring one unbounded provider walk. When a scan reaches a bound, Forge keeps the evidence already collected and marks the result partial with the exact coverage gap. Partial coverage never claims that an artifact is clean or that a component is absent.

​
Setup and verification

  1. Open the AWS, Azure, or Google Cloud integration and select Guided setup.
  2. Apply the current inventory artifact for registry discovery and pull access.
  3. Enable filesystem snapshot scanning only for approved source scopes and apply its additional setup artifact.
  4. Run Test, then Sync.
  5. Confirm discovered digests, scan coverage, workload links, and cleanup state.
Registry scanning requires queue-capable control-plane workers in the Forge deployment. Snapshot setup also requires exact scanner AMIs and regions on AWS, scanner networks on Google Cloud, or source subscription and resource group on Azure.