What is Forgebench?
Forgebench sits between your agents and the models and tools they call. Every call is authenticated, checked against budget, sent with the provider credential, metered, and written to the audit log.
Every call is recorded with its model, tokens, cost, latency and full request and response.
Budgets are checked before the call goes out. A call over the cap is refused with a 402 and costs nothing.
The audit log is hash-chained, so any edit or deletion is detectable.
An agent can only call tools you allow. Anything else is blocked, whatever the model asked for.
Provider keys are stored encrypted and added at call time. Agents never hold them, so you revoke a key once.
Completed traces are scanned for PII, secrets and denylisted terms. An agent can be paused automatically once findings pass a threshold you set.
What you work with
| Concept | What it is |
|---|---|
| Workspace | An isolated environment. Agents, keys, budgets and audit records belong to exactly one workspace. |
| Agent | The unit you author: a name, the models it may use, the tools it may call, and the policy it runs under. |
| API key | How your code authenticates. Each key carries its own scopes, model allowlist and daily/monthly spend caps. |
| Budget | A spend cap checked before each call, per workspace and per key. |
| Guardrail | A content check run over completed traces, producing findings you review per agent. |
Full definitions in Core concepts.