Forge

Forge is an experimental JavaScript runtime built on Mozilla's SpiderMonkey engine. Everything beneath the engine (memory management, containers, the event loop, the filesystem layer) is custom C++17 with zero external dependencies.

JavaScript, armored: Forge is designed so every package runs with only the permissions it declares.

The project is in early development. Everything there is to know about it is linked, directly or indirectly, from this page.

What is Forge?

A summary of the project and why it exists.

Kavach

How Forge is designed to keep packages from stealing from you.

Current progress

What already works.

Running Forge

How to run your first script.

Benchmarks

How Forge compares with Bun and Node.

Roadmap

Where the project is going next.

Blog

Notes from building Forge. Also available as RSS.

Manifesto

Why Forge exists, and why it is built this way.

Source code

The repository on GitHub.

For AI agents

A plain-text summary of Forge for AI agents and language models. Every page is also available as Markdown.

What is Forge?

The industry keeps layering faster APIs and better tooling on top of the same shared foundation. Forge starts from a different question: what if the runtime were built from scratch for this era, instead of inherited from one?

That is why Forge runs on SpiderMonkey instead of V8, and why its core is written from the ground up.

And this era has a new problem. Any package you install can read your files, steal your keys, and send them anywhere, and AI agents now install packages nobody has read. Forge is being built so that cannot happen. It is its own ecosystem, not another Node: its own runtime, standard library, and package registry.

Read the full Manifesto.

Kavach

Planned. In design.

Kavach (कवच, "armor") is the security layer Forge is designed around. Every package declares the access it needs, and the runtime enforces it, per package, on by default.

• Per-package permissions for files, network, and environment
• New permissions in an update need your approval
• No install scripts. Nothing runs when you install.
• A package registry built for this from the start

A package's manifest would look like this:

// forge.json (planned design)
{
  "name": "@varad/weather",
  "permissions": {
    "net": ["api.weather.example"],
    "fs": false,
    "env": false
  }
}

Current progress

• SpiderMonkey integration
• Forge Core foundation: Types, Error, Result, Assert, Allocator, UniquePtr, Vector, String, StringView, Span, Array, Queue, Stack, HashMap, HashSet
• Native Windows IOCP event loop
• Thread pool
• Timers: setTimeout(), setInterval(), clearTimeout()
• Microtask queue: queueMicrotask()
• Filesystem API: fs.readFileSync(), fs.writeFileSync(), fs.appendFileSync(), fs.existsSync(), fs.mkdirSync(), fs.rmSync(), fs.statSync()
• Async filesystem API, returning Promises: fs.readFile(), fs.writeFile(), fs.appendFile(), fs.exists(), fs.mkdir(), fs.rm(), fs.stat()
• Runtime self-tests (forge --self-test), including async tests that drive the real event loop
• Benchmark suite

Platform: Windows x64. Linux and macOS support are planned.

Running Forge

Create a file called hello.js:

print("Hello Forge!");

Run it:

forge.exe hello.js

Forge is currently built from source on Windows. See the README for build instructions.

Benchmarks

Lower is better. Median of 5 runs per script on one Windows machine (2026-08-02). See the full benchmark report.

Roadmap

1. Module system (import / export)
2. Web-standard APIs: fetch, URL, streams
3. Networking API and HTTP server
4. Kavach: per-package permissions
5. The Forge package registry
6. One-binary toolchain: run, test, format, publish
7. Worker threads
8. Linux support
9. macOS support

See the complete roadmap.

News

• Hello, Forge (October 19, 2026)

All posts are on the blog.