FORGE CLI

AI Software Bill of Materials (AI-SBOM) for AI-Generated Code


Create cryptographically-signed audit trails for AI-generated code. Track what was generated, by which AI model, when, and verify it hasn't been tampered with.

Why FORGE CLI?

As AI-assisted coding becomes ubiquitous, regulated industries need answers to critical questions:

- "Which code in our codebase was AI-generated?"
- "What AI model generated this function?"
- "Has this AI-generated code been modified since creation?"
- "Can we prove our AI coding practices meet SOC2/HIPAA requirements?"

FORGE CLI provides cryptographic proof of AI code provenance through AI-SBOMs.

Quick Start

``bash


Install globally

npm install -g @forge-framework/cli

Generate a signing key (once per project/organization)

forge-cli keygen --output forge-key.json

Create an SBOM for AI-generated code

forge-cli generate src/login.ts \
--provider anthropic \
--model claude-3.5-sonnet \
--key-file forge-key.json

Verify the SBOM hasn't been tampered with

forge-cli verify src/login.sbom.json

Check compliance against SOC2 policies

forge-cli policy check src/login.sbom.json --policy soc2
`

Commands

$3

Create an AI-SBOM for existing code.

`bash
forge-cli generate mycode.ts \
--provider anthropic \
--model claude-3.5-sonnet \
--key-file forge-key.json \
--output mycode.sbom.json
`

Options:
| Flag | Description | Default |
|------|-------------|---------|
| -p, --provider | AI provider (anthropic, openai, gemini) | unknown |
| -m, --model | Model ID (claude-3.5-sonnet, gpt-4, etc.) | unknown |
| -k, --key-file | Path to signing key | Ephemeral key |
| -o, --output | Output SBOM path | .sbom.json |
| -t, --type | Artifact type (function, component, test) | Auto-detected |
| -c, --classification | Data classification | internal |

$3

Generate an Ed25519 key pair for signing.

`bash
forge-cli keygen --output ~/.forge/company-key.json
`

Options:
| Flag | Description | Default |
|------|-------------|---------|
| -o, --output | Output key file path | forge-key.json |
| -f, --force | Overwrite existing file | false |

$3

Verify SBOM cryptographic signature.

`bash
forge-cli verify artifact.sbom.json --verbose
`

Exit Codes:
- 0 - Signature valid
- 1 - Signature invalid or verification error

$3

Scan directory and generate audit report.

`bash
forge-cli audit ./sboms/
`

Output includes:
- Total SBOMs found
- Model/provider distribution
- Validation pass rate
- Signature validity summary

$3

Evaluate SBOM against compliance policies.

`bash


Basic security check

forge-cli policy check artifact.sbom.json

SOC2 compliance

forge-cli policy check artifact.sbom.json --policy soc2

HIPAA compliance

forge-cli policy check artifact.sbom.json --policy hipaa
`

Available Policies:
| Policy | Description |
|--------|-------------|
| security-basic | TypeScript validation, signatures required |
| soc2 | SOC2 Type II requirements + review approval |
| hipaa | HIPAA-compliant providers only (Anthropic, Azure) |

$3

Export SBOM to different formats.

`bash


Markdown report for stakeholders

forge-cli export artifact.sbom.json report.md --format markdown

CSV for spreadsheet analysis

forge-cli export artifact.sbom.json data.csv --format csv

YAML for configuration management

forge-cli export artifact.sbom.json config.yaml --format yaml
`

CI/CD Integration

$3

`yaml
name: AI Code Compliance
on: [push, pull_request]

jobs:
verify-sboms:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4

- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: '20'

- name: Install FORGE CLI
run: npm install -g @forge-framework/cli

- name: Verify All SBOMs
run: |
for sbom in $(find . -name "*.sbom.json"); do
forge-cli verify "$sbom"
done

- name: Policy Compliance Check
run: |
for sbom in $(find . -name "*.sbom.json"); do
forge-cli policy check "$sbom" --policy soc2
done

- name: Generate Audit Report
run: forge-cli audit . > audit-report.txt
`

$3

`yaml
verify-ai-code:
image: node:20
script:
- npm install -g @forge-framework/cli
- forge-cli audit ./sboms/
- forge-cli policy check ./sboms/*.sbom.json --policy soc2
`

$3

`bash
#!/bin/bash


.git/hooks/pre-commit

Verify all SBOMs before commit


for sbom in $(git diff --cached --name-only | grep '\.sbom\.json$'); do
forge-cli verify "$sbom" || exit 1
done
`

What's in an AI-SBOM?

`json
{
"sbomVersion": "1.0",
"specVersion": "forge-ai-sbom-1.0",
"created": "2025-01-15T10:30:00.000Z",
"artifact": {
"tCodeId": "T-FUNCTION-abc123",
"type": "function",
"name": "authenticateUser",
"contentHash": "36ab341d2feedefc...",
"signature": "ed25519_signature...",
"publicKey": "da57fd3de3bee3d4..."
},
"generation": {
"model": {
"provider": "anthropic",
"modelId": "claude-3.5-sonnet",
"temperature": 0.7
},
"prompt": {
"hash": "prompt_hash_not_content",
"tokenCount": 1500
}
},
"validation": {
"static": {
"typescript": { "passed": true, "errorCount": 0 },
"security": { "passed": true, "errorCount": 0 }
},
"review": {
"agent": "AUDITOR",
"decision": "approved"
}
},
"provenance": {
"merkleRoot": "merkle_root_hash...",
"chainPosition": 1
},
"compliance": {
"dataClassification": "internal",
"licenses": [{ "spdxId": "MIT" }]
}
}
`

Security

$3

- Never commit key files to version control
- Add forge-key.json to .gitignore
- Store production keys in secure vaults (AWS Secrets Manager, HashiCorp Vault)
- Use separate keys for development, staging, and production

$3

- Signing Algorithm: Ed25519 (EdDSA)
- Hashing Algorithm: BLAKE3
- Signature Size: 64 bytes
- Public Key Size: 32 bytes

$3

If anyone modifies the code after SBOM generation, verification will fail:

`bash
$ forge-cli verify modified-code.sbom.json
✗ SBOM Signature INVALID
Reason: signature_mismatch

This SBOM may have been tampered with!
The content does not match the cryptographic signature.
`

Use Cases

$3

Track AI-generated trading algorithms, prove code provenance for auditors.

$3

Ensure AI-generated code processing PHI uses only HIPAA-compliant providers.

$3

Maintain continuous monitoring of AI-generated code changes.

$3

Demonstrate security maturity to enterprise customers during vendor assessments.

Roadmap

- [ ] TypeScript validation during generate
- [ ] Test runner integration for coverage metrics
- [ ] Security scanner integration
- [ ] Batch processing (forge-cli generate ./src/*/.ts`)
- [ ] GitHub Action (pre-packaged)
- [ ] VS Code extension

Contributing

Contributions are welcome! Please read our contributing guidelines before submitting PRs.

License

MIT License - see LICENSE for details.

Support

- Documentation: https://forge-framework.dev/docs
- Issues: GitHub Issues
- Email: support@forge-framework.dev