forge-cli · Included with Forge

Embeddings and corpus operations, straight from the terminal.

One static binary. Embed a string, a file, or a whole directory; ingest and query a corpus; issue an mTLS identity. No SDK to install, no Python environment to maintain — and it drops into a container or a Kubernetes Job without modification.

Request access See the Forge API →
What it does

Everything the API does, without writing a client. Bulk backfills are the common case: point it at a directory, get JSONL, resume where it stopped if the job dies.

  • embeda string, a file, a directory → JSONL, with --resume for interrupted runs
  • answersingest a document into a corpus, or query it and get a cited answer
  • authissue and inspect an Enterprise mTLS certificate
  • configshow the resolved configuration — flags, env, then ~/.forge/config.toml
# one string
forge-cli embed --text "hello world"

# a corpus backfill, resumable
forge-cli embed --dir ./corpus/ \
  --model pro --output vectors.jsonl --resume

# ask your own documents
forge-cli answers handbook \
  --query "what is the refund window?"
Runs where your pipeline runs

A single statically linked Go binary with no runtime dependencies — which makes the deployment story short.

Docker

Copy it into any image

No interpreter, no shared libraries. COPY forge-cli /usr/local/bin/ into a scratch or distroless image and it runs.

Kubernetes

A Job or a CronJob

Nightly re-embed as a CronJob, one-shot backfill as a Job. Credentials come from env vars, so a Secret is all the wiring it needs.

Coming

Published image and Helm chart

A pre-built container image and a Helm chart are planned for a future release. Today you build the image; the binary and the manifests are the same either way. 

# nightly corpus refresh as a Kubernetes CronJob
apiVersion: batch/v1
kind: CronJob
metadata: { name: forge-embed-nightly }
spec:
  schedule: "0 2 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          restartPolicy: OnFailure
          containers:
            - name: forge-cli
              image: your-registry/forge-cli:latest
              args: ["embed", "--dir", "/data/corpus", "--model", "pro",
                     "--output", "/data/vectors.jsonl", "--resume"]
              env:
                - name: FORGE_API_KEY
                  valueFrom: { secretKeyRef: { name: forge, key: api-key } }
Authentication

API key

Set FORGE_API_KEY and you're working. The same key as the HTTP API, so a container inherits it from a Secret like any other credential.

Enterprise mTLS

forge-cli auth init generates an Ed25519 keypair, submits a CSR, and installs a short-lived client certificate. Cryptographic identity on every connection — no bearer token to leak.

forge-cli is distributed to Forge customers rather than as a public download today. Ask us for a build — macOS, Linux and Windows, amd64 and arm64.