How it works
Why Git-native, not a hosted registry?
Some tools in this space host artifact or skill content in their own SaaS registry. Enterprise Forge does the opposite: a registry is an ordinary Git repository your company already hosts.
- No new place to trust with your source code or instructions.
- Publishing is a commit or pull request, reviewed the way you already review code. Anyone can
git diff, review a PR, or fork a registry on your Git host. - Registry credentials are configured once, centrally, in the web app, so your Git host's permissions govern what the web app can read.
- Telemetry and the web app are self-hosted, inside your own network: nothing about usage leaves it.
Your instructions live in your Git, not ours.
Does Forge need every developer to have Git access?
No. The web app is the only component that reads from Git, using credentials an admin adds once. A developer's machine authenticates to the web app with its own per-machine credential and receives already-resolved content. What a developer machine receives is governed by that credential, not by their personal Git access.
What happens if the web app is down?
New installs and updates wait until it is back. Artifacts already installed keep working, and telemetry goes to your own Supabase backend rather than the web app. This is an accepted tradeoff of having one place hold registry credentials. The web app also runs as a single instance today, with no high-availability option.
What does it take to run it?
Self-hosting with Docker Compose: Supabase (Postgres, edge functions, auth, storage), and an OpenTelemetry collector and sink for token and cost data. Dashboards are built into the web app. The web app runs as a separate Node process for now; a container image and compose service are planned, as is Kubernetes support. An admin setup script validates your secrets, configures the web app, creates the first admin account and can seed a starter registry.
Assistants and updates
Which AI coding assistants does it work with?
Claude Code today. Codex, Cursor and GitHub Copilot registries are catalogued and marked "not installable yet"; installing for them, and for Kiro, is next.
Each registry serves one coding tool. Skills use the portable Agent Skills format; agents, hooks and instruction files are specific to each tool.
Does it overwrite what developers have changed?
Never silently. New versions are offered, not applied without a choice, and local edits show up as drift for the developer to resolve.
Artifacts only touch their own marked block or entries in shared files such as CLAUDE.md and settings.json, never a developer's own content.
Data and security
What does it record about developers?
Inventory, versions in use, drift, adoption, and token and cost, never prompt or code content, and never a ranking of individual developers. Identities are pseudonymized before they reach the database. See Security and privacy for the full list.
Does it check skills for security problems?
Yes. Every skill is security-scanned with static analysis (SkillSpector) when its registry is indexed, and scan status is shown across the catalog. An admin can switch on a gate that withholds skills that fail. See Security scanning.
Fit and status
How does this compare to what I already run?
Enterprise Forge works at the artifact level: it delivers and keeps current the skills, agents and hooks on every machine (for Claude Code today), and measures their adoption and cost. It complements native vendor AI controls, AI governance suites, observability and eval tools, and shadow-AI discovery tools rather than replacing any of them. See where each one stops.
What doesn't Enterprise Forge do?
Some things are deliberate design choices: no multi-tenant hosting (it is always self-hosted, in your network), no public marketplace (registries are your own private Git repositories), and no storage of artifact content outside Git.
Some things are not built yet. Per-artifact health and suggestions are in design. Approval workflows, signed artifacts, change attribution and a publish history are on the roadmap.
How do I get started?
Design-partner pilots are open: one team pilots for 90 days, free during the design partnership, with preferred pricing at conversion. Get in touch.
Still have a question?
Email karthick@expericia.com or kavin@expericia.com, or read the Security and Features pages.