Forge Space: Open-Source IDP for Governing AI-Generated Code

We built an open-source IDP that stops AI-generated code from becoming tech debt

Lucas Santana has launched Forge Space, an open-source Internal Developer Platform designed specifically for the AI generate-to-ship pipeline. The system provides an automated A-F scorecard for every AI generation, tracking security, quality, accessibility, and compliance.

Why This Matters

The technical reality is that teams are adopting AI code generation faster than they are building guardrails, leading to ‘AI limbo engineering’ where code is shipped without audits or tests. Forge Space addresses this by providing a lightweight governance layer for teams of 5-50 developers who need service catalogs and quality controls without the massive infrastructure overhead of tools like Backstage.

Key Insights

• The Forge Space scorecard calculates an overall grade (A-F) based on weighted metrics including Security (30%), Quality (30%), and Compliance (20%).
• Security policy checks automatically block merges if they detect hardcoded credentials or critical CVEs in the dependency tree (Source: Forge Space, 2026).
• Compliance policies enforce an audit trail by preserving generation logs and ensuring new features are deployed behind feature flags.
• The platform includes an MCP gateway that routes AI tool calls through a central hub with JWT authentication, RBAC, and audit logging.
• The Siza web app supports ‘Bring Your Own Key’ (BYOK) for Anthropic, OpenAI, and Google APIs to maintain data sovereignty.

Working Examples

Scaffolds governance policies and GitHub Workflows in a project

npx forge-init

Runs a CLI-based scorecard check to evaluate the PR against defined thresholds

npx forge-scorecard --threshold 70

A custom policy definition to block builds exceeding a 3KB bundle size

{
"name": "custom",
"rules": [{
"id": "max-bundle-size",
"severity": "block",
"check": "bundle-size",
"threshold": 3072
}]
}

Practical Applications

• Use case: Engineering teams of 5-50 developers can use Forge Space to implement ‘Golden Path’ templates for scaffolding new services with built-in governance. Pitfall: Using heavy platforms like Backstage without a dedicated platform team often leads to high maintenance costs and failed adoption.
• Use case: Automated PR reviews using the ‘no-secrets’ and ‘dep-vulnerabilities’ policies to stop AI-generated security flaws before they reach production. Pitfall: Manual security reviews cannot keep pace with high-volume AI code generation, leading to unvetted code entering the codebase.

References:

• https://dev.to/luksantana/we-built-an-open-source-idp-that-stops-ai-generated-code-from-becoming-tech-debt-2kbj
• https://siza.forgespace.co
• https://github.com/Forge-Space