Extensions — Reusable Guardrail Packages

🔍

Browse

pforge ext search

📋

Details

pforge ext info <name>

⬇️

Install

pforge ext add <name>

Catalog fetches from local extensions/catalog.json first, falls back to GitHub. Publish your own →

Bundled Extensions

🔐

SaaS Multi-Tenancy

Row-level security policies, tenant isolation middleware, cross-tenant query prevention. Full agent for tenant isolation audits.

multi-tenancy.instructions.md

rls-patterns.instructions.md

tenant-isolation-reviewer.agent.md

pforge ext add saas-multi-tenancy

🧠

Plan Forge Memory

OpenBrain integration across 106 files. Pipeline prompts search memory before acting and capture decisions after. MCP + REST API configuration.

persistent-memory.instructions.md

memory-reviewer.agent.md

mcp.json MCP server config

pforge ext add plan-forge-memory

☁️

Azure Infrastructure

Bicep, Terraform, azd patterns. CAF naming conventions, security hardening, infra reviewer agent. For repos with infra/ alongside app code.

5 instruction files (Bicep, Terraform, azd, naming, security)

infra-reviewer.agent.md

3 prompt templates

pforge ext add azure-infrastructure

Spec Kit Compatible Extensions

Community

Popular Spec Kit community extensions that pair well with Plan Forge's hardening pipeline. Plan Forge's catalog uses the same format — these extensions work in both tools.

🔍

Verify Extension

Post-implementation quality gate that validates code against specification artifacts. Catches spec drift after execution.

code Read-only

Pairs with: Step 5 (Review Gate)

🧹

Cleanup Extension

Post-implementation quality gate — reviews changes, fixes small issues (scout rule), creates tasks for medium issues, generates analysis for large issues.

code Read+Write

Pairs with: Step 4 (Completeness Sweep)

👨‍💻

Staff Review Extension

Staff-engineer-level code review that validates implementation against spec, checks security, performance, and test coverage.

code Read-only

Pairs with: Reviewer agents

🔄

Reconcile Extension

Reconcile implementation drift by surgically updating feature artifacts. Detects when code diverges from spec and syncs them.

docs Read+Write

Pairs with: Step 5 (Drift detection)

📊

Retrospective Extension

Post-implementation retrospective with spec adherence scoring, drift analysis, and human-gated spec updates.

docs Read+Write

Pairs with: Step 6 (Ship — postmortem)

🏗️

AIDE Workflow

A structured 7-step workflow for building new projects from scratch with AI assistants — from vision through implementation.

process Read+Write

Alternative to: Plan Forge pipeline

These extensions are maintained by the Spec Kit community. Plan Forge's catalog format is compatible — install via specify extension add (Spec Kit) or pforge ext add (Plan Forge).

See the full Spec Kit + Plan Forge integration guide →

Build Your Own Extension

Package your organization's standards into a versioned, distributable extension. One extension.json manifest, any combination of instruction files, agents, and prompts.

Extension Structure

my-extension/
├── extension.json          # manifest
├── README.md               # docs
├── instructions/
│   └── hipaa.instructions.md
├── agents/
│   └── hipaa-reviewer.agent.md
└── prompts/
    └── hipaa-checklist.prompt.md

extension.json

{
  "name": "healthcare-compliance",
  "version": "1.0.0",
  "description": "HIPAA compliance guardrails",
  "author": "your-org",
  "minTemplateVersion": "1.0.0",
  "files": {
    "instructions": ["hipaa.instructions.md"],
    "agents": ["hipaa-reviewer.agent.md"],
    "prompts": ["hipaa-checklist.prompt.md"]
  }
}

Distribution Methods

GitHub Repo

Clone or ZIP download. Version with tags. Team members install with path to the repo.

Git Submodule

git submodule add for tight version coupling. Auto-updates with git pull.

Manual Copy

Download and paste to .forge/extensions/. Simplest for air-gapped environments.

Extension Ideas for Your Organization

HIPAA Compliance PCI-DSS React Design System Microservices Patterns Data Pipeline Guardrails Mobile App Standards GraphQL Conventions Org Naming Rules