A ForgeMeter product · Free & open source

Stop agent exfil after the session is tainted

Your coding agent can read private data, then post it to Slack. ForgeFence sits in the middle and blocks that second step — even if the model was tricked.

Watch the 90-second demo →Install locally

Self-hosted MCP proxy · Pair with ForgeMeter for AI spend visibility

See it in one story

Same attack path every time: read confidential → try to publish. ForgeFence allows the read, marks the session, then denies the leak.

Demo video coming soon

Record with the script in docs/DEMO_SCRIPT.md, then paste the YouTube/Loom embed URL into packages/site/lib/demo-video.ts.

1
Clean session
Agent can post publicly — nothing sensitive was read yet.
2
Read private
demo__read_private returns a fake SSN / API key. Session is now tainted.
3
Public post denied
demo__post_public returns ForgeFence DENY — the fence closed.

What it actually does

Not another chatbot filter. A rule engine on tool calls.

PinRemember each tool’s description. If it silently changes (rug-pull), hide it.
TaintWhen a tool returns sensitive data, stamp that on the session.
FenceBlock email, HTTP, shell, Slack-style posts while that stamp is present.

Run the proof yourself

No Cursor required for this check — thirty seconds in a terminal.

$ npm run demo

OK  clean session → post_public ALLOW
OK  read_private → taint ["confidential","untrusted"]
OK  tainted session → post_public DENY
OK  allow_always → demo__ping ALLOW

ForgeFence exfil-block demo passed.

Install in Cursor

Self-hosted. Free. Point MCP at ForgeFence instead of raw servers.

git clone https://github.com/ashfaqonai/ForgeFence
cd ForgeFence && npm install

# mcp.json
{
  "mcpServers": {
    "forgefence": {
      "command": "npx",
      "args": [
        "tsx",
        "packages/proxy/src/cli.ts",
        "--config",
        "forgefence.config.yaml"
      ],
      "cwd": "C:/source/ForgeFence"
    }
  }
}

Edit policies/default.yaml for your sinks. Pair with ForgeMeter for AI spend visibility.

Why not a prompt firewall?

Jailbreak filters try to police what the model says. ForgeFence polices what tools are allowed to do after sensitive data entered the session — the gap most agent breaches actually use.