How Forge handles keys, context, and telemetry

Your API keys

Forge 0.2.1 uses your own OpenAI or Anthropic API key, depending on the provider you select. You provide the keys; Forge does not issue them. Each key is stored separately in VS Code Secret Storage. Keys are never shown in the UI, and they are not written to the repository, .forge/, or settings.json.

Forge does not include a hosted model or a Forge account. The selected provider bills API requests to your account with that provider. Requests go directly to the provider you select.

What can go to the selected provider

When you Ask or Review, Forge sends the context required for the model request to the provider selected for that conversation — OpenAI or Anthropic — using your key for that provider. That can include:

• your chat with Forge
• a bounded workspace overview
• Project Memory excerpts from .forge/memory.json
• instruction files such as AGENTS.md, CLAUDE.md, .cursorrules, and .cursor/rules when present
• results from read-only workspace tools (read_file, grep, glob, list_dir, git_status, and git_diff)
• files you attach and include when you send a message. Those files stay on this machine until that send. Not every model accepts every file type.

Other workspace files can be sent if Forge reads them to answer your question. Do not use Forge on repositories you are not allowed to process with the selected provider.

Model requests leave your machine and go directly to the provider you selected. An OpenAI thread may also use OpenAI’s durable Conversations API. An Anthropic thread continues from the Forge transcript on this machine. Forge does not upload prompts, source, or attachments to DevFoundry, and it does not claim that nothing leaves your machine.

What stays on your machine

• Your OpenAI and Anthropic API keys are stored separately in VS Code Secret Storage on this editor profile.
• Conversations, folders, tags, associations, and attachments are stored in the Forge knowledge directory on this machine, outside editor extension storage. They are not written to .forge/ or the repository, and they do not sync to the cloud. Uninstalling the extension does not delete that directory.
• Project Memory is written locally under .forge/ in the workspace.
• Usage information, including provider and token breakdowns, is stored locally in the editor profile. It is not a bill and is not uploaded.
• Forge does not send telemetry to DevFoundry.
• Repository tools do not read contents of .env* files. A file you attach and send, including an .env* file you chose, can be sent to the selected provider.

The Forge knowledge directory is one folder per OS user: ~/Library/Application Support/Forge/knowledge on macOS, %APPDATA%\Forge\knowledge on Windows, and $XDG_DATA_HOME/forge/knowledge or ~/.local/share/forge/knowledge on Linux.

Uninstalling Forge does not delete that directory or .forge/ folders. Clear a stored key with Forge: Clear OpenAI API Key or Forge: Clear Anthropic API Key, or with /key, if you want it removed from Secret Storage.

What this page does not claim

• Forge does not run the AI model locally.
• Project memory does not sync to the cloud or across a team.
• Conversation history does not sync to the cloud.
• There is no hosted Forge account.
• Marketplace and Open VSX listings are not required to install Forge from this site.