// management · Python harness + MCP tools
Forge
Incident commander with the brakes wired in
An on-call operations agent that triages an alert, correlates logs and metrics, forms a hypothesis and proposes a fix, then stops dead at an approval gate before it touches production. Read actions are automatic; write actions are never.
- tool
- rollback_deploy
- service
- cart-api
- toRelease
- 2026.9.4
forge: execute rollback_deploy service=cart-api toRelease=2026.9.4? [y/N]
What makes it special
4 signatures- authorize()gated
Stops dead before it touches production
Reads run on their own; writes never do. The moment Forge proposes
scale_serviceorrollback_deploy, the loop halts on a confirm prompt and waits for a human, and so does the demo. - _meta["forge/risk"]destructive
The risk tier is code, not a prompt
Each MCP tool carries its tier over the wire, and
authorize()checks it before dispatch. An unlabelled tool counts as destructive, and only an approval that returns the literalTruegets through, so a model talked into a rollback still has no path past the gate. - denied_by_operatordenied
A “no” is final, so it pivots
A denied destructive action never runs, and Forge is told not to retry it, split it, or reach the same end state another way. In the demo it switches to a non-destructive mitigation (16 → 40 replicas, itself gated) and logs the denial in the incident timeline.
- confidence0.74 → 0.91
A hypothesis with a number on it
No cause is committed to until two independent signals agree, and confidence is stated as a number: 0.74 after triage, 0.91 after one more read, 0.88 when a dead log shard narrows the evidence to 48 hours.
Inside the demo
3 runs- TRIAGE · cart-api 503s
Two automatic reads, one correlation, a hypothesis with a number on it.
- GATE · rollback (destructive)
Forge proposes a rollback and then cannot execute it. The gate is code, not a prompt.
- DENIED · pivot to mitigation
A log shard is down, then the operator says no. Forge takes both answers without arguing.
Watch for The approval gate. Forge will happily read every log in the cluster, but the rollback blocks on a human and the page will not advance until you choose.
Under the hood
python- stack
- Python harness + MCP tools
- pattern
- Tool-gated agent loop with risk-tiered approvals
- source
agents/forge-sre/forge/commander.py
A thin harness over MCP tool servers keeps the dangerous surface small and auditable: every tool declares a risk tier, and the loop refuses to execute a destructive tier without an explicit human decision. The gate is code, not a prompt instruction.
Tool registry · risk tiers
| tool | tier | exec |
|---|---|---|
| query_logsQuery service logs over a time window. | SAFE | AUTO |
| read_metricsRead a metric series for a service. | SAFE | AUTO |
| scale_serviceChange the replica count of a service. Requires approval. | CAUTION | GATED |
| rollback_deployRoll a service back to a previous release. Requires approval. | DESTRUCTIVE | GATED |
You hold the approval.
Pick one of three incidents. When a run reaches a gate, it stops and waits for you to approve or deny.