Skip to main content

Self-hosted, Git-backed, and never your prompts or code

Built for enterprise security review. What Enterprise Forge stores, what it records, who can see it, and where it stops.

No prompts or codePrompt, code and file contents are never collected.Self-hostedWeb app, telemetry and dashboards run in your network.Pseudonymous identitiesActor ids are hashed on the machine, never ranked.Updates offered, never forcedArtifacts touch only their own block; local edits show as drift.

Where your data lives​

  • Artifact content: lives only in your Git repositories. Forge stores no copy and has no upload API.
  • Hosting: the web app, telemetry backend and dashboards run on your own network, in your own region. Nothing about usage leaves it.
  • Telemetry: goes to a Supabase backend you host. Dashboards are built into the web app.

What is recorded​

  • Inventory: artifact names and types, versions, registries, file counts, total sizes and a drifted-file count.
  • Versions in use: which artifact versions are installed on which machines, and when.
  • Adoption and drift: how many machines and teams have each artifact, and whether local copies have diverged.
  • Machines: last-seen time and app version.
  • Token and cost: from Claude Code's own OpenTelemetry export, sent to a collector you host. Every figure carries its source and dashboards show coverage %, so a partial number never reads as a complete one.

Events are written to a local, human-readable buffer and flushed every 15 minutes to your backend. If telemetry fails, the thing it observes keeps working.

What is never recorded​

  • Content: prompt content, code content or file contents.
  • Paths and hashes: inventory sends names, types, counts and sizes only.
  • Free text: errors are recorded as a class and component, never a message.
  • Rankings: any per-developer productivity ranking or comparison. This is a stated, held position: attribution is to versions and models, never ranking of people.

Identity and consent​

  • Actor ids: pseudonymous. An HMAC computed on the machine with a per-machine salt that never leaves it. They are pseudonyms, not verified identities. Org and team names are sent as plain names.
  • Hostname and IP: a machine's hostname and last IP address are visible to admins only.
  • Consent: there is no per-developer consent prompt. This is internal tooling an employer deploys, and telemetry is on once your organization configures a telemetry endpoint.
  • Local buffer: a readable file that a developer can inspect or delete at any time. It is capped at 5 MB, oldest events first.

Access and credentials​

  • Registry credentials: HTTPS with a stored credential (SSH deploy keys are not supported), held centrally by the web app and admin-only.
  • Machines: a developer machine connects with a one-time setup token that is single-use and expires. Connecting mints a per-machine credential, stored only as a hash, and reconnecting rotates it.
  • Web app sign-in: through Supabase Auth, with three roles: viewer, curator and admin.

Security scanning​

  • Every skill is scanned: static analysis (SkillSpector) runs in the web app whenever a registry is indexed.
  • Results are visible: scan status is shown across the catalog, and risky versions are ranked by how many machines have them installed.
  • An optional gate: an admin can switch a gate on so that skills that fail the scan are withheld.
  • On the roadmap: approval workflows enforced at delivery, and signed artifacts verified before install.

What reaches a machine​

  • Marked blocks only: artifacts only ever change their own marked block or entries in shared files such as CLAUDE.md and settings.json, never a developer's own content.
  • Offered, never forced: new versions are offered, not applied without a choice, and local edits are flagged as drift for the developer to resolve.

Questions

Email karthick@expericia.com or kavin@expericia.com, see the FAQ, or read what the product does on the Features page.

Join early access