Using Forgecroft from a coding agent

An AI coding agent can check its own work against the Controls that govern what it changed — and fix the findings — before it ever opens a pull request. You wire Forgecroft in as an MCP (Model Context Protocol) server; the agent calls forgecroft_evaluate on its working diff mid-loop and gets back a safe-to-ship verdict with a fix hint on every finding. Only the diff leaves your environment; your full source tree stays where it is.

This is the same evaluation the CI Gate runs on a pull request, moved one step earlier — into the agent’s own loop, so a change is corrected before it is pushed rather than blocked after.

What you get back

forgecroft_evaluate returns a 4-state decision against your org’s Controls: go, conditional_go, no_go, or insufficient_context. Each no_go finding carries a fix_hint the agent can act on immediately. The evaluation is deterministic and carries no per-change cost — the same diff always produces the same verdict.

Coding agents this has been tested against: Claude Code, Codex, Cursor. Any agent with HTTP MCP support works — there is no agent-specific surface.

You need a Forgecroft API key with evaluate:read scope and the MCP server reachable from wherever the agent runs.

Prerequisites

Export your API key before starting the agent session:

export FORGECROFT_MCP_TOKEN=fc_live_...

This is the same key you use for FORGECROFT_API_KEY in CI. The token is sent as a Bearer credential; an unset variable will produce a visible auth failure rather than a silent empty request.

Add the MCP server

Claude Code

Copy examples/mcp/forgecroft.mcp.json to your project root as .mcp.json, or merge the forgecroft entry into an existing .mcp.json:

{
  "mcpServers": {
    "forgecroft": {
      "type": "http",
      "url": "https://api.forgecroft.com/mcp/v1",
      "headers": {
        "Authorization": "Bearer ${FORGECROFT_MCP_TOKEN}"
      }
    }
  }
}

Reload Claude Code after adding the file. Alternatively, register it at the user level:

claude mcp add --transport http forgecroft https://api.forgecroft.com/mcp/v1

Then set the header via your agent’s MCP config UI or by editing ~/.claude/mcp.json directly to add the Authorization header.

Cursor

Place the config at .cursor/mcp.json (project-scoped) or ~/.cursor/mcp.json (user-scoped). Cursor uses "transport" rather than "type":

{
  "mcpServers": {
    "forgecroft": {
      "transport": "http",
      "url": "https://api.forgecroft.com/mcp/v1",
      "headers": {
        "Authorization": "Bearer ${FORGECROFT_MCP_TOKEN}"
      }
    }
  }
}

Cursor’s HTTP MCP transport format may evolve — consult Cursor’s MCP documentation if the server does not appear in the tools list.

Other MCP-capable agents

Any agent with HTTP MCP support can connect using:

Endpoint: https://api.forgecroft.com/mcp/v1
Transport: HTTP (JSON-RPC over HTTP/SSE)
Auth: Authorization: Bearer $FORGECROFT_MCP_TOKEN

Consult your agent’s MCP configuration docs for the exact key names.

Self-correction workflow

Before pushing, ask your agent:

“Call forgecroft_evaluate with kind=pr_diff and the output of git diff origin/main...HEAD.”

The tool returns a decision, blast_radius, confidence, and coverage_notes. Fix any findings, then repeat until the result is go or conditional_go. Push when clear.

You can also add a standing instruction to your CLAUDE.md, AGENTS.md, or .cursorrules so the agent runs this check automatically before every push.

What forgecroft_evaluate checks

The tool matches changed file paths to the covering Components in your org’s graph, applies your org’s Controls (deterministic compiled checks, not an LLM judge), and returns the 4-state verdict with per-finding fix_hint fields. No model inference runs on the evaluation path.