How Forge handles keys, context, and telemetry

Your OpenAI API key

Forge 0.1.2 uses your own OpenAI API key. You provide the key; Forge does not issue one. After you store it, Forge keeps it in VS Code Secret Storage. The key is never shown in the UI, and it is not written to the repository, .forge/, or settings.json.

Forge does not include hosted AI in this release. OpenAI bills API requests to your OpenAI account.

What can go to OpenAI

When you Ask or Review, Forge may send relevant repository-derived context to OpenAI using your key. That can include:

• your chat with Forge
• a bounded workspace overview
• Project Memory excerpts from .forge/memory.json
• instruction files such as AGENTS.md, CLAUDE.md, .cursorrules, and .cursor/rules when present
• results from read-only workspace tools (file reads, search, directory lists, git status)

Other workspace files can be sent if Forge reads them to answer your question. Do not use Forge on repositories you are not allowed to process with OpenAI.

Model requests leave your machine and go to OpenAI. Forge does not claim that nothing leaves your machine.

What stays on your machine

• Your OpenAI API key is stored in VS Code Secret Storage on this editor profile.
• Conversation history is stored locally in this editor’s workspace storage. It is not written to .forge/ or the repository, and it does not sync to the cloud.
• Project Memory is written locally under .forge/ in the workspace.
• Usage information (turns, requests, and token counts when reported) is stored locally in the editor profile. It is not a bill and is not uploaded.
• Forge does not send telemetry to DevFoundry.
• Contents of .env* files are not read.

Uninstalling Forge does not delete .forge/ folders. Clear a stored key with Forge: Clear OpenAI API Key if you want it removed from Secret Storage.

What this page does not claim

• Forge does not run the AI model locally.
• Project memory does not sync to the cloud or across a team today.
• Conversation history does not sync to the cloud.
• There is no hosted Forge account.
• Marketplace and Open VSX listings are not required to install Forge from this site.