Hello, Forge

By Varad Modhekar, October 19, 2026.

A couple of months ago I looked at libuv and Tokio and thought: I want to understand this deeply enough to build my own. So I did. Forge started as an event loop, a thread pool, a file system layer, and sockets, all written from scratch in C++, running Mozilla’s SpiderMonkey engine instead of V8.

What works today

A native event loop built directly on Windows I/O completion ports
A thread pool, so real file I/O runs off the main thread
Timers and a microtask queue
Seven fs methods, each in a blocking and a Promise-based version
A built-in forge --self-test suite

Forge starts faster than both Node and Bun in my benchmarks, and it loses some too. Promise chains are the biggest gap. The full numbers are on the home page and in the benchmark report.

Where it’s going

Any package you install today can read your files, steal your keys, and send them anywhere, and AI agents now install packages nobody has read. Forge is being built so that can’t happen. With Kavach, every package will declare what it needs and run with only those permissions, on by default.

Next up: an ES module system, then web-standard APIs, and then Kavach itself.

I’ll write here as I build. Follow along on GitHub or X.

— Varad

Tags: forge, javascript, spidermonkey, security.

All posts · RSS · This post as Markdown

Written by Varad Modhekar. Back to the Forge Project.