Everything Forge checks, and how it works

Forge is a security-audit tool built for people who ship code without a dedicated security team. Add a domain and Forge checks what is already visible from the outside — DNS records, certificates, HTTP headers — and turns every finding into a plain-language risk with a concrete fix, not just a red flag.

Add a domain from the Domains page. Adding it does not run any checks by itself — a domain has to be verified before Forge can check it, and marked active before it is included in scheduled audits.

Ownership can be verified two ways. Email verification sends a six-digit code to an address at the domain. TXT verification asks you to publish a record at the domain's apex.

Verification exists so that a deeper check only ever runs at the request of whoever actually controls the domain, never at someone else's.

Run an audit whenever you want — after a deploy, before a release, or just to see where a domain stands right now. An on-demand audit runs every check your plan includes and reports the result straight away.

Autopilot audits every active domain once a week without you asking. Switch it on from the Domains page, and Forge emails you the result each time it runs, so a slipping certificate or a changed DNS record does not wait for you to remember to look.

Forge emails you when a scheduled audit finishes, with a link straight to the result. The message carries the domain, the score and the link — never the findings themselves, so a report about your site does not sit exposed in an inbox.

A coding agent can drive Forge instead of a person clicking through the app: it can list your domains, start an audit and read back the result on its own, over the HTTP API or, if it speaks MCP, the MCP server.

Not every check counts the same. Each one declares what failing it costs, doubling at each step: critical 8, high 4, medium 2, low 1. The score is the share of that weight the domain passed — so failing one critical check costs more than failing a pair of high ones, which is the ordering anyone reading a report already assumes.

A check that came back yellow counts as half a pass, because yellow is a partial pass — counting it as a failure would collapse the three-state result the whole report is built on down to two. A check nothing has judged yet is left out of the sum entirely rather than counted as a pass, so a run where nothing has been judged has no score at all and the page shows a dash. A zero would read as a verdict — everything failed — when the truth is that nothing has been looked at.

Forge runs no checks on a domain until you have proved you control it. Most checks accept either proof, so confirming an email address at the domain or publishing the TXT record — whichever is easier — is enough to run them. A few of the deeper checks ask for the TXT record specifically.

The two proofs stay independent, and one is not a step up from the other. So a check that asks for the TXT record will not run on a domain where you have only confirmed an email address — Forge tells you which proof is missing and sends you to add it, rather than to the pricing page.

Forge also exposes a small HTTP API so a coding agent can act on your behalf — list the domains you have added, start an audit, and read back the result — without a person doing each step by hand. It is documented in a public repository at https://github.com/magery-ai/magery-forge-agents, which covers authentication, all six endpoints and runnable examples. The API is in beta.

Forge also runs an MCP server, at forge.magery.ai/mcp over Streamable HTTP, so an MCP-capable agent can call it with native tool calls instead of building HTTP requests by hand. It authenticates the same way as the HTTP API above — an Authorization: Bearer header carrying the same access key, not a second one to issue — and exposes the same six operations as MCP tools: list_domains, get_domain, list_audits, start_audit, get_audit_status and get_audit.