Argues against a security finding or a draft bug bounty report before you submit it.
Inferred from the transports this listing declares (streamable-http). A client not listed here hasn’t been ruled out — it just isn’t something Forge can confirm.
Verification confirms publisher identity (repo ownership), not code safety. The security scan covers known CVEs and suspicious install scripts.
Read out of the source npm actually ships, at scan time. The package was never executed. Tools registered dynamically at runtime, or hidden inside bundled or minified code, can be missed — so this is a floor on the tool surface, not a complete census of it.
challenge-reportChecks every claim in a draft report against the code it cites, then builds the evidence packet.Checks every claim in a draft report against the code it cites, then builds the evidence packet.
No input schema was published for this tool.
platformWhere the report will be submitted, such as Immunefi, Cantina, Sherlock or HackerOne.Where the report will be submitted, such as Immunefi, Cantina, Sherlock or HackerOne.
No input schema was published for this tool.
solidity-reviewMaps entry points and invariants in the contracts you name and reports what the code proves, with file and line.Maps entry points and invariants in the contracts you name and reports what the code proves, with file and line.
No input schema was published for this tool.
modeown-code for contracts you ship (default), bounty for a finding you plan to report.own-code for contracts you ship (default), bounty for a finding you plan to report.
No input schema was published for this tool.
gauntletNo description publishedThis tool published no description. Forge does not invent one.
list_profilesCall first when you do not know which review fits. Returns every review profile with what it checks, what files it needs and whether it is hosted, the gauntlet stage order, the verdicts per mode, and the provider and model ids run_review accepts. A hosted profile runs through run_review; a core one…Call first when you do not know which review fits. Returns every review profile with what it checks, what files it needs and whether it is hosted, the gauntlet stage order, the verdicts per mode, and the provider and model ids run_review accepts. A hosted profile runs through run_review; a core one…
No input schema was published for this tool.
prepare_reviewNo description publishedThis tool published no description. Forge does not invent one.
run_gauntlet_planNo description publishedThis tool published no description. Forge does not invent one.
build_packetCall after writing a review from prepare_review. Reads the review, checks every cited file and line against the manifest, and returns the verdict, the reference problems and the Markdown evidence packet with file hashes. No account needed.Call after writing a review from prepare_review. Reads the review, checks every cited file and line against the manifest, and returns the verdict, the reference problems and the Markdown evidence packet with file hashes. No account needed.
No input schema was published for this tool.
accountCall before run_review to check the allowance. Returns the plan, the hosted reviews used today, the number that run at once and the time the allowance resets. Needs the connection token in the Authorization header.Call before run_review to check the allowance. Returns the plan, the hosted reviews used today, the number that run at once and the time the allowance resets. Needs the connection token in the Authorization header.
No input schema was published for this tool.
run_reviewNo description publishedThis tool published no description. Forge does not invent one.
bounty-operatorBounty Operator: pre-submission review for bug bounty findings and draft reports.Bounty Operator: pre-submission review for bug bounty findings and draft reports.
No input schema was published for this tool.
8 of 12 tools published a description.
Tool names and descriptions are written by the publisher and shown verbatim as inert text. They are the strings an MCP client passes to a model, so Forge scans them for prompt-injection patterns — any finding appears with the security scan above. “Privileged” is a keyword match on the tool name, not an audit of what the tool does: a benign-sounding name can still do anything.
Argues against a security finding or a draft bug bounty report before you submit it.
Linked names open Forge’s index of every entry observed exposing that tool. Browse all indexed tools.
This entry publishes no npm package, so Forge has no dependency tree for it. That is a gap in coverage — not a statement that it has no dependencies.