LiveGuard Tools Reference

14 post-coding intelligence tools. Each guards a different gate.

Tool Index

All 14 LiveGuard tools are available as MCP tools and via REST API. Full reference per tool below.

All 14 LiveGuard tools shipped as of v2.30.0.

forge_drift_report

Scores codebase against architecture guardrail rules from instruction files. Tracks drift over time in .forge/drift-history.json. Fires a bridge notification when the score drops below the configured threshold.

pforge drift [--since <ref>]

Output: { score, delta, violations[], timestamp }. Score is 0–100; higher is better. delta is the change since the previous run.

forge_incident_capture

Records incidents with severity, affected files, and MTTR tracking. Dispatches on-call notification via the .forge.json onCall config if present.

pforge incident capture
pforge incident list

Output: { incidentId, severity, mttr, onCallNotified, storedAt }. Incidents are stored in .forge/incidents/ as individual JSON files.

forge_dep_watch

Scans dependencies for CVEs using npm audit. Compares against a previous snapshot in .forge/deps-snapshot.json. Alerts on new vulnerabilities only — unchanged findings are suppressed.

pforge dep-watch

Output: { newVulnerabilities[], resolvedVulnerabilities[], unchanged, snapshot }. Fires a dep-vulnerability hub event when new CVEs appear.

forge_regression_guard

Extracts validation gate commands from plan files, executes them against the codebase, and reports pass/fail/blocked results. Used by the PostSlice hook and manually after refactors.

pforge regression-guard [--plan <plan-file>]

Output: { gates[], passed, failed, blocked, summary }. Commands are allow-listed via GATE_ALLOWED_PREFIXES — dangerous patterns like rm -rf / are blocked.

forge_runbook

Generates a human-readable operational runbook from a hardened plan file. Optionally appends recent incidents for context. Saves to .forge/runbooks/.

pforge runbook list
pforge runbook get <name>
pforge runbook add <plan-file>

Naming: Plan filename → lowercase → non-[a-z0-9-] replaced with hyphens → collapse → append -runbook.md.

forge_hotspot

Identifies git churn hotspots — files that change most frequently. Uses a 24-hour cache to avoid repeated git log queries.

pforge hotspot [--top 10] [--since 30d]

Output: { hotspots[{ file, changeCount, lastChanged }], since, cachedUntil }.

forge_health_trend + Health DNA v2.32

Aggregates drift scores, cost history, incident frequency, model performance, and test pass rates over a configurable time window. Returns an overall health score 0–100 plus a Health DNA fingerprint for decay detection.

pforge health-trend [--window 30d]

Output: { healthScore, drift, cost, incidents, models, tests, healthDNA }.

Health DNA (.forge/health-dna.json): Composite fingerprint — driftAvg, incidentRate, testPassRate, modelSuccessRate, costPerSlice. Compare across time to detect project decay before it manifests as bugs.

forge_alert_triage

Reads incidents and drift violations, ranks by priority (severity × recency), and returns a prioritized list. Read-only — never modifies data.

pforge alert-triage

Output: { alerts[{ source, severity, priority, description, timestamp }], totalAlerts }. Priority is a computed score — higher means "address first".

forge_deploy_journal

Records deployments with version, deployer, notes, and an optional slice reference. Correlates with forge_incident_capture so incidents can be linked to the deploy that introduced them.

pforge deploy-log [--tag <tag>] [--notes "..."]

Output: { deployId, version, deployer, timestamp, notes }. Stored in .forge/deploy-journal.jsonl.

forge_secret_scan v2.28

Scans git diff output for high-entropy strings using Shannon entropy analysis. Never logs actual secret values — all findings are masked to <REDACTED> in output, cache, and telemetry.

pforge secret-scan [--since HEAD~1] [--threshold 4.0]

Output:

{
  "scannedAt": "2026-04-13T...",
  "since": "HEAD~1",
  "threshold": 4.0,
  "scannedFiles": 5,
  "clean": false,
  "findings": [{
    "file": "src/config.js",
    "line": 5,
    "type": "api_key",
    "entropyScore": 4.8,
    "masked": "<REDACTED>",
    "confidence": "high"
  }]
}

forge_env_diff v2.28

Compares environment variable key names across .env files. Identifies keys present in the baseline but missing in targets (and vice versa). Never reads, logs, or caches environment variable values.

pforge env-diff [--baseline .env] [--files .env.staging,.env.production]

Output:

{
  "scannedAt": "2026-04-13T...",
  "baseline": ".env",
  "filesCompared": 2,
  "pairs": [{
    "file": ".env.staging",
    "missingInTarget": ["STRIPE_KEY"],
    "missingInBaseline": []
  }],
  "summary": { "clean": false, "totalGaps": 1, "baselineKeyCount": 12 }
}

.forge.json Schema

LiveGuard tools read configuration from .forge.json at project root. Below are the root-level fields relevant to LiveGuard.

Example .forge.json with LiveGuard fields:

{
  "bridge": { "url": "https://hooks.slack.com/...", "approvalSecret": "..." },
  "model": "claude-sonnet-4.6",
  "onCall": { "name": "Platform Team", "channel": "#incidents", "escalation": "eng-lead" },
  "hooks": {
    "preDeploy": { "enabled": true },
    "postSlice": { "enabled": true },
    "preAgentHandoff": { "enabled": true }
  },
  "openclaw": { "endpoint": "https://your-openclaw-instance" }
}