Forge — GitHub coding agent that fixes issues and reviews PRs

GitHub coding agent that fixes issues into pull requests and reviews them with a security pass.

Read the guide · View on GitHub

Fixes, reviews and security — inside the workflow you already use.

• Issue to pull request: Label agent-fix or comment /fix. Forge investigates, writes the fix on a branch, runs the tests and opens a PR that closes the issue.
• Reviews that hold up: Inline comments and a summary verdict through quality and security lenses, scoped to the changed files. A second agent re-reads the code before any finding is posted.
• Scanners before the model: Committed credentials, infrastructure files and source code are checked deterministically first — no model call, no tokens.
• Secret scanning that doesn’t cry wolf: Thirty-one provider shapes, three passes against false positives, and dismissals you can audit.
• Token discipline: Prompt caching, a tool allowlist and context compaction. Every PR and comment carries a footer with tokens and cost.
• Built for teams: One install across an organization, GitHub Enterprise Server, FORGE.md and REVIEW.md as context, Dependabot and SARIF merged into one report.

Install once. Trigger it from any issue or PR.

1. Install: As a hosted GitHub App, a GitHub Action with no server, or the CLI.
2. Configure a provider: Run forge setup and pick from nine providers — keys stay yours.
3. Trigger: Label agent-fix, comment /fix, /review or /help, or request it as a reviewer.
4. Merge with confidence: A check run publishes the verdict, so a real finding can block the merge.

Details

Runs as

GitHub App · GitHub Action · CLI

Providers

Anthropic, OpenAI, Gemini, Vertex AI, AWS Bedrock, Groq, Together, Ollama, any OpenAI-compatible

Hosting

Render, Google Cloud Run, or any Docker host

Enterprise

GitHub Enterprise Server supported

License

MIT · TypeScript

More from ShipIt

• Vouchline — Research agents that cite and re-check every claim.
• Sentinel — Autonomous AI penetration testing with real proof.
• shipit-agent — The Python runtime under every ShipIt agent.
• Watchtower — Tracing, cost and PII masking for LLM apps.
• Relay — A self-hosted engineer on your Claude subscription.
• ShipIt Cloud — Multi-tenant console for white-label agents.
• ShipIt CLI — Terminal coding agent with two-way chat bots.
• Pentest skills — One /pentest command for Claude Code.
• ShipitQA — Goal-driven QA in real browsers, with evidence.
• KeyVault — Zero-knowledge password manager. No server.
• MacSweep — Clean, protect and understand your Mac.
• Snappilot — Free screen capture studio, fully on-device.
• shipit-ui-design — Senior UI/UX as a Claude Code plugin.
• ShipIt Palette — One hex to a full design system.