If you've worked on a modern codebase you know the pain. You push a small Pull Request and then you wait.

You wait for SonarQube to spin up a JVM container. You wait for Snyk to download 500MB of data. You wait for Black, Flake8, and Bandit to format your code. A 2 line code change suddenly turns into a 15minute coffee break that burns through your GitHub Actions billing.

I got completely sick of this. I didn't want to install 20 different services, manage 20 different API tokens, and pay $50/month per developer just to know if my code was secure.

So, I built CI Forge.

What is CI Forge

CI Forge is a single, incredibly fast, "zero-dependency" Python CLI that replaces almost your entire CI/CD toolchain. You don't need to install Docker. You don't need a JVM. It runs purely on standard libraries and completes its scans in milliseconds.

Here is what it does out of the box:

1. Instant Security Scanning (Powered by Google)

Most free security scanners are outdated and miss dangerous bugs. CI Forge is directly plugged into Google’s live vulnerability database. This means the second a new security threat is discovered on the internet, CI Forge already knows about it. It instantly finds dangerous code in Python, JavaScript, C++, and Rust without requiring any complicated setup or heavy installations.

2. AI That Actually Fixes Your Code

Telling a developer they have a vulnerability is annoying. Fixing it for them is magic. If you run CI Forge with the auto-fix flag, the tool uses AI to rewrite the broken code for you. But instead of blindly guessing it double checks its own work to guarantee the fix won't crash your app. Once it is sure the code is safe it automatically opens a Pull Request on GitHub for you to review.

3. It Never Breaks Your Build

Nothing is more frustrating than a security tool crashing and bringing down your entire deployment pipeline. CI Forge is built with a massive safety net. If the tool itself ever has an error or goes offline it simply steps out of the way. It will never block your team from launching their code to production.

4. The Developer Security Hub

If you manage multiple projects or open source libraries, checking every single one for security flaws is a huge waste of time. I just launched the CI Forge Cloud dashboard to fix this. Just add a single flag when you run the tool and it instantly beams all of your security alerts and wasted cloud costs into one web dashboard. Whether you're working solo or running a massive team you can now see the health of all your codebases in one place.

** Try it out in 5 seconds**

If you have Python installed you can scan your codebase locally right now:

pip install ciforge-cli

python -m ciforge.cli --repo . --vuln-scan --dead-code

If you are an open source maintainer, an indie hacker, or just someone who hates bloated CI pipelines I built this for you.

I'd love for you to check out the repository. drop a ⭐️ if you like the vision, and tell me what features you'd like to see next!

GitHub: Tahiram32/ciforge