Forge Magery
Magery Forge — security audits for shipped code, built for VibeCoders. Turns scanner noise into clear risks with fixes, delivered as a weekly report. Exposed over MCP so your agent (Cursor, Copilot, Claude, OpenClaw) can trigger scans and read reports.
Hosted MCP Server
npx add-mcp 'https://forge.magery.ai/mcp'Installs into Claude Code, Codex, Cursor and more
Documentation
Getting started
What Forge is
Forge is a security-audit tool built for people who ship code without a dedicated security team. Add a domain and Forge checks what is already visible from the outside — DNS records, certificates, HTTP headers — and turns every finding into a plain-language risk with a concrete fix, not just a red flag.
Adding a domain
Add a domain from the Domains page. Adding it does not run any checks by itself — a domain has to be verified before Forge can check it, and marked active before it is included in scheduled audits.
Verifying a domain
Ownership can be verified two ways. Email verification sends a six-digit code to an address at the domain. TXT verification asks you to publish a record at the domain's apex.
Verification exists so that a deeper check only ever runs at the request of whoever actually controls the domain, never at someone else's.
Features
On-demand audits
Available
Run an audit whenever you want — after a deploy, before a release, or just to see where a domain stands right now. An on-demand audit runs every check your plan includes and reports the result straight away.
Autopilot
Available
Autopilot audits every active domain once a week without you asking. Switch it on from the Domains page, and Forge emails you the result each time it runs, so a slipping certificate or a changed DNS record does not wait for you to remember to look.
Email notifications
Available
Forge emails you when a scheduled audit finishes, with a link straight to the result. The message carries the domain, the score and the link — never the findings themselves, so a report about your site does not sit exposed in an inbox.
API and MCP
Available
A coding agent can drive Forge instead of a person clicking through the app: it can list your domains, start an audit and read back the result on its own, over the HTTP API or, if it speaks MCP, the MCP server.
Scoring and verification
How the score is computed
Not every check counts the same. Each one declares what failing it costs, doubling at each step: critical 8, high 4, medium 2, low 1. The score is the share of that weight the domain passed — so failing one critical check costs more than failing a pair of high ones, which is the ordering anyone reading a report already assumes.
A check that came back yellow counts as half a pass, because yellow is a partial pass — counting it as a failure would collapse the three-state result the whole report is built on down to two. A check nothing has judged yet is left out of the sum entirely rather than counted as a pass, so a run where nothing has been judged has no score at all and the page shows a dash. A zero would read as a verdict — everything failed — when the truth is that nothing has been looked at.
Verification levels
Forge runs no checks on a domain until you have proved you control it. Most checks accept either proof, so confirming an email address at the domain or publishing the TXT record — whichever is easier — is enough to run them. A few of the deeper checks ask for the TXT record specifically.
The two proofs stay independent, and one is not a step up from the other. So a check that asks for the TXT record will not run on a domain where you have only confirmed an email address — Forge tells you which proof is missing and sends you to add it, rather than to the pricing page.
Agent API
Using Forge from an agent
Forge also exposes a small HTTP API so a coding agent can act on your behalf — list the domains you have added, start an audit, and read back the result — without a person doing each step by hand. It is documented in a public repository at https://github.com/magery-ai/magery-forge-agents, which covers authentication, all six endpoints and runnable examples. The API is in beta.
Connecting over MCP
Forge also runs an MCP server, at forge.magery.ai/mcp over Streamable HTTP, so an MCP-capable agent can call it with native tool calls instead of building HTTP requests by hand. It authenticates the same way as the HTTP API above — an Authorization: Bearer header carrying the same access key, not a second one to issue — and exposes the same six operations as MCP tools: list_domains, get_domain, list_audits, start_audit, get_audit_status and get_audit.
Checks
Every check Forge runs today, grouped by what it looks at — plus what is on the way.
Domain
Checks: 2 · Available: 1
Checks how long remains until the domain registration expires.
Available
Whether transfer protection is switched on at the registrar.
Coming soon
TLS
Checks: 4 · Available: 3
Follows a plain http:// request and reports where it ends up, and whether the page it reaches still references sub-resources over http://.
Available
Checks the certificate the host serves: how long it stays valid, whether it covers this hostname, and whether its chain verifies.
Available
Reports which TLS versions the host accepts. Protocol versions only — ciphers are not examined.
Available
Will report whether the host still accepts obsolete cipher suites such as RC4 or 3DES.
Coming soon
Security
Checks: 3 · Available: 3
Looks for an index of files served at /assets/, /static/, /uploads/ or /images/, against a generated path that cannot exist, so a site that answers every address the same way is reported as undetermined rather than as leaking.
Available
Looks for files a deploy should never publish —.git/HEAD,.env and its variants, config.json,.htaccess, backup.sql and.DS_Store — against a generated path that cannot exist, so a site that answers every address the same way is reported as undetermined rather than as leaking.
Available
Content
Checks: 1 · Available: 1
Looks for the three tags that let a shared link show a picture and a sentence instead of a bare URL — og:title, og:description and og:image — and names whichever the page has not declared.
Available
Lighthouse
Checks: 8 · Available: 8
Mobile
Runs Lighthouse’s accessibility audits on the homepage — text alternatives for images, colour contrast, form labels, the page language and more. A score of 90 or above passes, 50 to 89 is rated medium and below 50 high, and every failing audit is named.
Available
Runs Lighthouse’s agentic browsing audits, which Google still marks as under development: whether an AI agent can read the page, whether its layout holds still, whether an llms.txt is published and, only on sites that register WebMCP tools, whether those tools are well formed. All passing is a pass, one failure is rated low and two or more medium.
Available
Runs Lighthouse’s best-practice audits on the homepage — errors in the browser console, deprecated browser features, images shown at the wrong size or shape and more. A score of 90 or above passes, 50 to 89 is rated medium and below 50 high, and every failing audit is named.
Available
Runs Lighthouse’s SEO audits on the homepage — a title and meta description, a page search engines may crawl, descriptive links, a usable viewport and more. A score of 90 or above passes, 50 to 89 is rated medium and below 50 high, and every failing audit is named.
Available
Desktop
Runs Lighthouse’s accessibility audits on the homepage — text alternatives for images, colour contrast, form labels, the page language and more. A score of 90 or above passes, 50 to 89 is rated medium and below 50 high, and every failing audit is named.
Available
Runs Lighthouse’s agentic browsing audits, which Google still marks as under development: whether an AI agent can read the page, whether its layout holds still, whether an llms.txt is published and, only on sites that register WebMCP tools, whether those tools are well formed. All passing is a pass, one failure is rated low and two or more medium.
Available
Runs Lighthouse’s best-practice audits on the homepage — errors in the browser console, deprecated browser features, images shown at the wrong size or shape and more. A score of 90 or above passes, 50 to 89 is rated medium and below 50 high, and every failing audit is named.
Available
Runs Lighthouse’s SEO audits on the homepage — a title and meta description, a page search engines may crawl, descriptive links, a usable viewport and more. A score of 90 or above passes, 50 to 89 is rated medium and below 50 high, and every failing audit is named.
Available