Forge's MCP server is now published in a public directory, so an agent that speaks MCP can find and install it from there instead of being handed a URL. The footer of every page links to where it is listed, and more directories will appear there as the listings go live.
0.23.3ImprovementLighthouse findings say what failed, not just which audit
A Lighthouse check used to name the audits that failed and stop there. Now each failed audit shows what Lighthouse actually flagged — the element on your page, the file or the console message — up to five at a time, the reason it gave, and a link to learn how to fix it.
What Lighthouse found is shown exactly as it found it, in code style, in every language. Only the audit's name and the words around it are translated, so a selector you copy from a Russian or Portuguese report still matches your page.
Audits run before this release keep their shorter findings. Run the audit again to see the detail.
0.23.2ImprovementOnboard your agent with one short message
The buttons that hand an agent its invite now copy a single sentence naming where the setup instructions live, instead of a long block of text. Your agent fetches them when it needs them, so it always reads the current ones. The button that issues a key adds the key to that sentence and nothing else.
The three buttons now say what they do: “Onboard your agent to Forge” on the home page, and on My Agents, “Onboard your agent with new access key” or “without new access key”. The differing word is emphasised, because one of those buttons issues a credential and the other does not.
0.23.1NewCreate an agent and copy its invite in one step
My Agents has a new button that creates an agent, issues its access key and copies a ready-to-paste invite with that key already inside — everything an AI agent needs to connect, in one click. The key is shown on the page once as well, because it cannot be recovered afterwards.
Audit pages fit a phone now. Checks stack into two lines instead of scrolling sideways, the date range has visible From and To labels, and the domain filter is a row of chips — tap one to filter, tap its × to clear.
0.23.0NewLighthouse checks: accessibility, SEO, best practices and agentic browsing
Every audit now runs Google Lighthouse on your homepage twice — once as a phone and once as a desktop — and reports four of its categories as eight checks. Each is graded the way Lighthouse itself colours it, and the audits that failed are listed with the result.
Agentic browsing is new in Lighthouse, and Google still marks it as under development. It looks at whether an AI agent can find its way around your page, and what it checks may change as the category matures.
0.21.0NewAudits in the language you read the site in
Set the site to Portuguese, Spanish or Russian and new audits are written in that language — what a check found, and what to do about it. There is nothing to configure: the language selector in the header is the only one, and audits follow it.
Audits you already have keep the language they were written in. Open one in a different language and it is translated for you.
The translating is done by DeepL, which becomes the fourth company this site sends anything to. The privacy policy sets out what it receives — the sentence of a finding, with domains, IP addresses and email addresses replaced before it is sent — and what it never receives: who was audited, the evidence a check stores, or anything about you beyond the language you are reading in.
0.20.0NewAudits read in your language
An audit is written once, in one language. It can now be read in another: what a check found, and what to do about it, arrive in the language you are using the site in. The privacy policy changed with it, because a new company does the translating.
Open an audit while the site is in Portuguese, Spanish or Russian and the findings and recommendations come through in that language. The domain names, addresses and technical values a check quotes are left exactly as they were.
The translating is done by DeepL, which becomes the fourth company this site sends anything to. The privacy policy now sets out what it receives — the sentence of a finding, with domains, IP addresses and email addresses replaced before it is sent — and what it never receives: who was audited, the evidence block a check stores, or anything about you beyond the language you are reading in.
0.19.0NewA new check: how your link looks when someone shares it
Forge now looks for the three Open Graph tags that let a link to your site show a picture and a sentence when it is pasted into Slack, WhatsApp or a group chat — and tells you which ones the page has not declared.
og:title, og:description and og:image. Any the page does not declare are named, so you know what to add. Without them a shared link shows as a bare URL.
It checks only that the tags are there, never whether the picture is the right one or the wording is any good. Those are your call, and a check that graded them would be guessing.
0.18.1ImprovementSigning in takes you to your domains
Logging in or creating an account now opens your domains, not your account settings. It is where you add a domain and start an audit, so it is where you were going anyway.
The one exception: if you followed a link to a finished audit and signed in on the way, you still land on that audit rather than on your domains.
0.18.0NewAdvice that fits the result, and two new checks
Every check now tells you what to do about what it actually found on your domain, instead of repeating the same general advice whatever the outcome. And Forge looks for two more things: error pages that leak a stack trace, and directories a server lists in full.
A check that passes now says so, rather than telling you to make a change you had already made. Where something does need doing, the advice names your result — the one header that is missing, the directory that is listed — not the check in general.
Verbose errors: a request for an address that cannot exist should get an ordinary error page. If it returns a stack trace instead, that hands a stranger your file paths, your dependency versions and often your database driver.
Directory listing: a server that publishes an index of /assets/, /static/, /uploads/ or /images/ gives away the name of every file in them. If that is deliberate — a mirror, a file archive — the advice says so instead of telling you to switch it off.
Read previous news
0.17.0NewForge can be driven over MCP
Your coding agent can now connect to Forge as an MCP server and use it as a set of tools, instead of being told how to make HTTP requests. It is the same six operations the agents API already offered, with the same access key.
An MCP server at forge.magery.ai/mcp, over Streamable HTTP, with six tools: list your domains, look one up, list your audits, start an audit, check its status, and read back the full result.
It takes the same access key as the HTTP API — the one you issue under User Profile → My Agents. Not a second key to manage, and not a second thing to revoke.
0.16.0NewA new check for files that should never be public
Forge now looks for the things a deploy leaves behind by accident — an .env file, a published .git directory, a database backup — and tells you where it found them.
Hidden files: .env and its variants, .git/HEAD, config.json, .htaccess, backup.sql and .DS_Store — the things nobody meant to publish. Anything found is reported with the address it was found at.
A site that answers every address with the same page is reported as undetermined rather than as leaking. A check that cried wolf on every single-page app would be worse than no check at all.
0.15.3NewAn invitation for your coding agent
One button — on the front page and on My Agents — copies a ready-made briefing to your clipboard, so an agent you paste it into knows what to do without you explaining any of it.
It tells the agent what Forge is, which API endpoints it can call, how to ask you for an access key, and where to find the full documentation and the public repository — ready to paste into Claude, Cursor, Copilot, OpenClaw, or anything similar.
0.15.2NewFour new checks, and an API for your agent
Forge now reads the records that decide who may send mail as your domain, what happens to forgeries, whether answers about your domain can be trusted, and which authorities may issue certificates for it. The same release opens Forge to coding agents, with a small HTTP API and a public documentation repository on GitHub.
SPF: which servers may send mail as your domain, and how strictly. A record that authorises anyone, and two records that cancel each other out, are both reported.
DMARC: what receiving servers are told to do with mail that fails its checks. A monitoring-only policy is reported as what it is — it stops nothing.
DNSSEC: whether answers for your domain are signed and the signatures check out. A chain of trust that has broken takes a domain off the internet for a growing share of people, and is reported as serious.
CAA: which certificate authorities may issue certificates for your domain. Without the record, any of them can.
A small HTTP API a coding agent can use on your behalf: list the domains you have added, start an audit, check on it, and read back the result. You issue the access keys it uses from the My Agents page — each one shown to you once, and yours to extend or revoke whenever you like.
A public documentation repository on GitHub — github.com/magery-ai/magery-forge-agents — covers authentication, every endpoint, what each error means and what to do about it, and runnable examples.
0.11.0NewEmail that looks like Forge
Every message we send now arrives in the same dark shell as the app, with the logo — and in your language, including the one that used to be English for everybody.
Sign-in codes, verification codes and audit results arrive in Forge’s own colours, with a plain-text version for clients that do not show HTML.
The domain verification email is translated. It was English for everyone, whatever language you use Forge in.
Signed in, the home page points straight at your Domains and your Audits.
The documentation marks which features are available today, and What Forge does links through to the rest of them.
0.10.0NewDocumentation, and pricing for the beta
Every check we run — and the ones we do not run yet — now has a page you can read and link to. Pricing is settled at the same time: free while Forge is in beta, with 30 days' notice before that changes.
A documentation page: what Forge checks, how to add and verify a domain, and a catalogue of every check, with the ones still on the way marked as such.
The sidebar follows what you are reading, and every heading and check name is a link you can copy and share.
Free while Forge is in beta, with 30 days' notice before that changes.
Pro covers 3 domains, with up to 3 subdomains for each. Max adds a dedicated pentest server in your private network.
0.9.0NewChecks that keep running
Turn it on once and we audit your domains every week, without you asking. You get the same email you would from an audit you started yourself, and you can switch it off whenever you like.
A weekly audit of the domains you have switched on, started for you.
One switch on the Domains page turns it on or off for your whole account.
It covers the domains you have marked for checking — the same ones your plan already counts.
Audits you start yourself are unchanged, and the button still runs one on the spot.
0.8.0NewYour audit finds you
You no longer have to keep checking whether an audit has finished. When it is done, we email you the score and a link that opens that exact run.
An email when your audit finishes, with the score it earned.
The link opens that run directly, so you do not have to hunt for it in the list.
If you are signed out when you click it, signing in takes you straight back to the same audit.
The message carries the domain, the score and the link — never the findings themselves.
0.7.0NewAudits that explain themselves
Your audit no longer just lists what it found. Each check now explains what its result means for your domain and what to do about it, and the finished run opens with a summary of what matters most.
Every check now explains its result in plain language, instead of leaving you to read raw records.
Recommendations are written for what your domain actually has, rather than generic advice.
A finished audit opens with an overall summary across all its checks, saying what to do first.
How serious a finding is stays decided by the check itself, so an explanation can never talk a problem down.
0.5.1NewAudits you can start
The security audit is no longer only a page of results — you can start one yourself, from the domain you want checked, and watch it run. Two checks run today: what DNS records your domain publishes, and how long until its registration expires.
A Begin Audit button on each of your domains starts a check on demand.
Your audit now runs for real: each check is picked up, carried out, and written back with what it found.
A finished run closes with a colour of its own, so the list tells you at a glance how it went.
Two checks to begin with: every DNS record your domain publishes, and how long until the registration expires — flagged red under 30 days, amber under 90.
Get in touch now asks what your message is about, so it reaches the right person faster.
The privacy and terms pages no longer leave a large gap between paragraphs.
0.4.0NewSecurity audits
Every check we run on your domains now has a page of its own: what ran, when, what it found, and a score for each run. The privacy policy has grown a section on what an administrator can see and what we keep a record of.
A new Security audit page lists every check we have run on your domains, newest first.
Each run carries a score, so you can tell at a glance whether anything needs your attention.
Open a run to see each check it made, what it found, and what we suggest doing about it.
Narrow the list by domain, date, source, status or result when it grows long.
A strip at the top shows each of your domains with its latest result and how many runs it has had.
The audit page and its date filters now lay out correctly on a phone.
The privacy policy now says what an administrator at Magery can see about your account, and what we record when you sign in or change your domains.
0.3.0NewAccounts, consent, and domain ownership
You can now sign up and log in with a one-time code emailed to you — no password — and choose whether cookies load at all. You can also add domains, prove you own them, and pick which are active for Forge to check. The privacy policy and terms have been rewritten to cover all of it.
Sign up with your email and a username; a one-time code takes the place of a password.
Log in the same way, from any device, with a fresh code each time.
A profile page shows your username, email and language, and is where you sign out.
Cookies are opt-in now — nothing loads until you accept, and declining, or leaving the banner unanswered, means it never runs.
You can change your answer at any time from "Change this choice" at the end of the privacy page.
Add a domain and prove you own it, with an emailed code or a DNS TXT record.
Choose which domains are active for checks, up to how many your plan allows.
The privacy policy and terms have been rewritten to cover accounts, cookies and domains.
0.2.1ImprovementAnalytics added
The site now uses Yandex Metrica to measure how it is used. This is the first time anything on Magery Forge has tracked visitors, so the privacy policy changed with it.
Cookies are now set when you open a page, and pages you visit are reported to Yandex.
Sessions are recorded — clicks, scrolling and mouse movement. The contact form is excluded, so what you type there is not recorded.
The privacy policy has been rewritten to describe this. It previously said the site had no analytics and set no cookies, which is no longer true.
To opt out, block cookies for this domain or use a browser that blocks trackers. Everything on the site works the same either way.
0.2.0NewRelease notes, and a privacy correction
The page you are reading is new. The privacy policy has also been corrected where it had fallen out of date.
This page: every release, and what changed in it.
The privacy policy still described a light/dark theme switch that had been removed. It now says what is true: the site stores nothing in your browser at all.
Changes to the site now reach your browser within the hour, rather than sitting behind a month of caching.
0.1.0NewFirst public version of the site
The Magery Forge landing page goes live in four languages. This release is the site itself — the scanner is not part of it yet, which is why it is 0.1 and not 1.0.
Available in English, Portuguese, Spanish and Russian, chosen automatically from your browser.
Pricing, FAQ and a walkthrough of what Forge checks and how it reports it.
A contact form that opens your own email program — nothing you type is sent to us.
No cookies, no analytics, no third-party embeds. The privacy policy describes exactly this.
Magery ForgeBeta