Forge is a JavaScript runtime built from scratch on Mozilla's SpiderMonkey engine, designed so every package runs with only the permissions it declares.https://forgeruntime.org/en-ushttps://forgeruntime.org/blog/hello-forge/https://forgeruntime.org/blog/hello-forge/Why I'm building a JavaScript runtime from scratch on SpiderMonkey, what works today, and where Forge is going next.Mon, 19 Oct 2026 00:00:00 GMT<p>A couple of months ago I looked at libuv and Tokio and thought: I want to understand this deeply enough to build my own. So I did. Forge started as an event loop, a thread pool, a file system layer, and sockets, all written from scratch in C++, running Mozilla’s SpiderMonkey engine instead of V8.</p> <h2 id="what-works-today">What works today</h2> <ul> <li>A native event loop built directly on Windows I/O completion ports</li> <li>A thread pool, so real file I/O runs off the main thread</li> <li>Timers and a microtask queue</li> <li>Seven <code>fs</code> methods, each in a blocking and a Promise-based version</li> <li>A built-in <code>forge --self-test</code> suite</li> </ul> <p>Forge starts faster than both Node and Bun in my benchmarks, and it loses some too. Promise chains are the biggest gap. The full numbers are on the <a href="../../">home page</a> and in the <a href="https://github.com/varadTheDeveloper/forge-runtime/blob/main/Forge_Benchmark_Report.md">benchmark report</a>.</p> <h2 id="where-its-going">Where it’s going</h2> <p>Any package you install today can read your files, steal your keys, and send them anywhere, and AI agents now install packages nobody has read. Forge is being built so that can’t happen. With <strong>Kavach</strong>, every package will declare what it needs and run with only those permissions, on by default.</p> <p>Next up: an ES module system, then web-standard APIs, and then Kavach itself.</p> <p>I’ll write here as I build. Follow along on <a href="https://github.com/varadTheDeveloper/forge-runtime">GitHub</a> or <a href="https://x.com/opentestudox">X</a>.</p> <p>— Varad</p> forgejavascriptspidermonkeysecurityVarad Modhekar