@forge-registry/cli

MCP@jokin-bereciartu
v0.2.0jokin-bereciartuMITUpdated 2mo agonpmGitHub

Verify, install, and publish MCP servers, A2A agents, and AI skills via the Forge trust registry.

Verify, install, and publish MCP servers, A2A agents, and AI skills. Checks a package before you install it: Forge registry — is it listed? verified? who published it? OSV scan — known CVEs for the exact version from the OSV database Script analysis — lifecycle scripts (, , etc.) checked for suspicious patterns ------|-------------| | Output raw JSON (useful for scripting) | Exit codes: =…

@jokin-bereciartu
Identity-verified publisher GitHub@jokin-bereciartu
Verified Jun 13, 2026
2mo agoLast update
Package
Authorjokin-bereciartu
LicenseMIT
Version0.2.0
Sourcenpm
npm@forge-registry/cli
GitHubforgeregistry/website
Trust Status
A
85/100Trusted
✓Listed in Forge index+10/10
✓Publisher identity verified+20/20
✓Ed25519 publish signature+5/5
—Domain verification+0/5
→ Publisher: host /.well-known/forge.json on the package homepage with { "publisher": "<github-login>" }
—npm Trusted Publishing (Sigstore)+0/5
→ Publish from GitHub Actions with --provenance so the attestation binds this package to this repo
—npm maintainer match+0/5
→ Publisher: add the verified GitHub login to the npm package's maintainers (npm owner add <login>)
✓CVE scan · clean+30/30
✓Static analysis · clean+20/20
Paste into Claude Code, Cursor, or any AI assistant to fix all gaps
StatusIdentity verified
Publisher@jokin-bereciartu
Signature✓ Signed · Ed25519
Domain—
Provenance—
Dependencies60 resolved · 1 with advisories
Tool surface8 tools · 2 privileged
Security scan✓ Cleanv0.2.0 · 8d ago
MODERATE@hono/node-server@1.19.17Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encoded backslash (`%5C`) · transitive
EvalsNone
IndexedJun 13, 2026

Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts — it cannot prove the absence of malicious code.

About

Verify, install, and publish MCP servers, A2A agents, and AI skills. Checks a package before you install it: Forge registry — is it listed? verified? who published it? OSV scan — known CVEs for the exact version from the OSV database Script analysis — lifecycle scripts (, , etc.) checked for suspicious patterns ------|-------------| | Output raw JSON (useful for scripting) | Exit codes: = clean/verified, = critical vulnerabilities found Trust-aware wrapper around : 2. Blocks on critical/high…

Keywords
forgemcpa2acliai-toolssecurityverify