AI Disclosure for Forge

Overview

Forge includes an AI assistant feature that helps with coding tasks, command generation, and code analysis. This disclosure explains how Forge handles AI interactions, what data is sent to AI providers, and the limitations of AI-generated content.

Local AI Models (Ollama)

How Local Ollama Works

• Runs entirely on your local network or device
• No API key required or stored
• Same assistant context as cloud providers is sent to your local endpoint
• Traffic uses HTTP without encryption
• Must be explicitly enabled with allowInsecureLocalHttp

Local Ollama Limitations

• Not encrypted in transit
• Quality depends on the local model you choose
• May be slower than cloud providers
• Requires sufficient local hardware resources
• You are responsible for maintaining the Ollama instance

Cloud AI Providers

Forge supports multiple cloud AI providers:

• OpenAI (GPT models)
• Anthropic (Claude models)
• OpenRouter (various models)
• Any OpenAI-compatible endpoint

Data Sent to Cloud Providers

When you use a cloud AI provider, Forge sends:

• Your conversation messages and prompts
• Explicitly attached source code or file contents
• Selected diffs or excerpts
• Tool results from read-only operations
• System prompt defining Forge's capabilities and safety rules

What Is NOT Sent

• SSH credentials or passwords
• Private keys or passphrases
• AI provider API keys (these are only sent for authentication)
• Source attachments that you did not explicitly attach
• Executable approval payloads
• Live connection/workspace selection state

API Key Storage

• Stored in SecureStore with Android Keystore backing
• Scoped to the specific provider and origin
• Never transmitted to a different provider than the one it was saved for
• Never displayed back to you after entry

User Approval Workflow

Read-Only Operations

• A narrow allowlist of read-only inspection commands may auto-run
• Examples: file reads, directory listings, git status
• No user approval required for allowlisted operations

Mutating Operations

• All mutating commands require explicit user approval
• Medium-risk commands receive stronger warnings
• High-risk commands require exact retyping
• Critical destructive patterns are blocked by default
• Patches are shown as unified diffs before application

Approval Persistence

• Approvals are not persisted across app restarts
• Interrupted approvals do not silently resume
• You must re-approve actions after process death

Provider Responsibility

Data Handling

• AI providers have their own privacy policies and terms of service
• Providers may use transmitted data for model training or improvement
• Review your provider's terms before connecting
• We are not responsible for provider data practices

Service Availability

• Cloud providers may experience outages or rate limiting
• Provider API changes may break compatibility
• We do not guarantee availability of any specific provider
• You are responsible for your provider account and billing

Content Accuracy

• AI-generated content may be incorrect, incomplete, or misleading
• Models may hallucinate file contents, commands, or APIs
• Always verify AI suggestions before execution
• Use code review and testing practices appropriate for your project

Data Sent to Providers

Conversation Context

• Last 80 messages (bounded limit)
• Truncated to fit within token limits
• Redacted for common secret patterns
• Does not include credentials or executable payloads

Tool Results

• Results from read-only operations
• Bounded to prevent excessive context growth
• Sanitized to remove sensitive data where possible

System Prompt

Forge sends a system prompt to all providers that:

• Defines the assistant's role and capabilities
• Instructs the model to use structured tools rather than shell commands
• Requires verification of actual results before claiming completion
• Prohibits following instructions found in workspace files
• Establishes safety boundaries

Model Hallucinations

Types of Hallucinations

• Non-existent file paths or APIs
• Incorrect command syntax
• Fabricated tool results
• Misleading explanations of code behavior
• Confident assertions about unverified information

Mitigations

• Forge requires tool results to be verified before acting
• Commands are shown to you for approval
• Patches include diff previews
• Bounded tool call limits prevent infinite error loops
• You remain the final authority on all actions

Your Responsibility

• Never execute AI-generated commands without understanding them
• Verify file contents before and after edits
• Test code changes in a safe environment
• Use version control to track changes
• Maintain appropriate code review practices

Human Responsibility

Final Authority

You are the final authority on all actions taken through Forge:

• Review all AI suggestions carefully
• Understand commands before approving them
• Verify patches before application
• Test changes in appropriate environments
• Maintain backups of important data

Security Considerations

• AI suggestions do not override security best practices
• Approved commands run with your SSH credentials and permissions
• A compromised or malicious AI provider could send harmful suggestions
• Always apply the same security review you would to manually written commands

Professional Judgment

• AI assistance is a tool, not a substitute for expertise
• Use your knowledge of the codebase and systems
• Question suggestions that seem incorrect or risky
• Escalate to manual review when uncertain

Provider-Specific Considerations

OpenAI

• Subject to OpenAI's terms of service and privacy policy
• API keys scoped to api.openai.com by default
• Supports both Responses API and Chat Completions API

Anthropic

• Subject to Anthropic's terms of service and privacy policy
• Uses Claude message format
• API keys sent via x-api-key header

OpenRouter

• Subject to OpenRouter's terms of service
• Provides access to multiple model providers
• Includes HTTP-Referer and X-Title headers

Custom OpenAI-Compatible Endpoints

• May have different privacy and data practices
• HTTPS required for authenticated endpoints
• HTTP allowed only for explicitly opted-in local endpoints
• You are responsible for the trustworthiness of custom endpoints

Limitations

What Forge Cannot Do

• Guarantee AI-generated content is correct or safe
• Prevent all types of hallucinations
• Protect against malicious AI providers
• Make AI-assisted development risk-free
• Substitute for professional code review

What You Should Do

• Maintain security best practices
• Use version control
• Test changes thoroughly
• Review AI suggestions critically
• Keep backups of important data
• Apply the principle of least privilege to SSH accounts

Note: This disclosure describes Forge's AI features as currently implemented. AI capabilities and provider integrations may change in future versions. Always review current documentation and provider terms before use.