# Forge

Forge is an experimental **JavaScript runtime** built on Mozilla's SpiderMonkey engine. Everything beneath the engine (memory management, containers, the event loop, the filesystem layer) is custom C++17 with zero external dependencies.

JavaScript, armored: Forge is designed so every package runs with only the permissions it declares.

The project is in *early development*. Everything there is to know about it is linked, directly or indirectly, from this page.

Website: https://forgeruntime.org/ · Source: https://github.com/varadTheDeveloper/forge-runtime · License: MIT

## What is Forge?

The industry keeps layering faster APIs and better tooling on top of the same shared foundation. Forge starts from a different question: what if the runtime were built from scratch for this era, instead of inherited from one?

That is why Forge runs on SpiderMonkey instead of V8, and why its core is written from the ground up.

And this era has a new problem. Any package you install can read your files, steal your keys, and send them anywhere, and AI agents now install packages nobody has read. Forge is being built so that cannot happen. It is its own ecosystem, not another Node: its own runtime, standard library, and package registry.

Manifesto: https://forgeruntime.org/manifesto/

## Kavach

*Planned. In design.*

Kavach (कवच, "armor") is the security layer Forge is designed around. Every package declares the access it needs, and the runtime enforces it, per package, on by default.

- Per-package permissions for files, network, and environment
- New permissions in an update need your approval
- No install scripts. Nothing runs when you install.
- A package registry built for this from the start

A package's manifest would look like this:

```jsonc
// forge.json (planned design)
{
  "name": "@varad/weather",
  "permissions": {
    "net": ["api.weather.example"],
    "fs": false,
    "env": false
  }
}
```

## Current progress

- SpiderMonkey integration
- Forge Core foundation: Types, Error, Result, Assert, Allocator, UniquePtr, Vector, String, StringView, Span, Array, Queue, Stack, HashMap, HashSet
- Native Windows IOCP event loop
- Thread pool
- Timers: `setTimeout()`, `setInterval()`, `clearTimeout()`
- Microtask queue: `queueMicrotask()`
- Filesystem API: `fs.readFileSync()`, `fs.writeFileSync()`, `fs.appendFileSync()`, `fs.existsSync()`, `fs.mkdirSync()`, `fs.rmSync()`, `fs.statSync()`
- Async filesystem API, returning Promises: `fs.readFile()`, `fs.writeFile()`, `fs.appendFile()`, `fs.exists()`, `fs.mkdir()`, `fs.rm()`, `fs.stat()`
- Runtime self-tests (`forge --self-test`), including async tests that drive the real event loop
- Benchmark suite

Platform: Windows x64. Linux and macOS support are planned.

## Running Forge

Create a file called `hello.js`:

```js
print("Hello Forge!");
```

Run it:

```sh
forge.exe hello.js
```

Forge is currently built from source on Windows. See the README for build instructions. README: https://github.com/varadTheDeveloper/forge-runtime#readme

## Benchmarks

| Benchmark | Forge | Bun | Node | Winner |
|---|---:|---:|---:|---|
| Startup | 21.58 ms | 40.02 ms | 47.00 ms | Forge |
| JSON | 378.19 ms | 256.88 ms | 558.21 ms | Bun |
| Loop | 83.85 ms | 73.92 ms | 97.29 ms | Bun |
| Timers | 23.12 ms | 54.18 ms | 61.28 ms | Forge |
| Microtasks | 57.04 ms | 55.20 ms | 108.92 ms | Bun |
| Promise chains | 87.39 ms | 45.69 ms | 48.59 ms | Bun |
| Filesystem | 802.58 ms | 1,054.32 ms | 938.36 ms | Forge |
| Async filesystem | 935.39 ms | 1,239.99 ms | 1,413.65 ms | Forge |

Lower is better. Median of 5 runs per script on one Windows machine (2026-08-02). Full report: https://github.com/varadTheDeveloper/forge-runtime/blob/main/Forge_Benchmark_Report.md

## Roadmap

1. Module system (`import` / `export`)
2. Web-standard APIs: `fetch`, `URL`, streams
3. Networking API and HTTP server
4. Kavach: per-package permissions
5. The Forge package registry
6. One-binary toolchain: run, test, format, publish
7. Worker threads
8. Linux support
9. macOS support

## Blog

- [Hello, Forge](https://forgeruntime.org/blog/hello-forge/) (October 19, 2026): Why I'm building a JavaScript runtime from scratch on SpiderMonkey, what works today, and where Forge is going next.

---

Forge is built by Varad Modhekar (https://github.com/varadTheDeveloper). Released under the MIT License.