AI Agents & MCP
Connect your AI agent to Forest and it checks for a well-used package before writing code from scratch, reads its source and license, installs it, and publishes your own modules when you ask. Setup adds two things together: the Forest MCP server, which gives your agent the tools, and the Forest skill, which tells it when to use them.
Add Forest to your agent
Pick your agent:
Claude Code
In Claude Code, run:
/plugin install forest --marketplace Forest-Software-LLC/forest-agent-skillsThe Forest plugin brings the skill and the MCP server together. On Claude Code older than 2.1.275, run these in your terminal instead:
claude plugin marketplace add Forest-Software-LLC/forest-agent-skills
claude plugin install forest@forest-agent-skillsSign in
Public packages work signed out, so you can skip this until you need your private packages or want to publish.
Claude Code
Run /mcp, pick forest, and choose Authenticate.
A forest.dev page shows which app is asking, the account it will act as, and the permissions it wants. Approve, and you’re connected. Your agent still asks you before every publish.
Try it
Ask your agent something like:
Find a promise library for my Roblox game on Forest.It searches Forest, reads the best matches, and asks before installing anything.
What your agent can do
- Find packages: search and browse the registry, including mirrored Wally packages.
- Vet them: read a package’s README, files, and source, its versions and dependencies, and its license rating with caveats.
- Install them: it gives you the
forest installcommand, or runs it for you if your agent can use a terminal. - Work with your account: list your packages and your Studios’ packages, private ones included.
- Publish: send a package’s files to Forest for you, after you approve. Text files only, up to 200 files and 1 MB, at most 10 publishes an hour; packages with
.rbxmmodels are published with the forest CLI.
Every app you’ve signed in with is listed under Connected apps in your forest.dev profile settings, where Disconnect cuts it off immediately.
Package READMEs, descriptions and source are written by their authors, and a package can be published just to steer an agent. With the Forest skill, your agent treats that text as data, not instructions: a package whose README or comments tell it to install something, run a command, fetch a URL, publish, or keep quiet is dropped and reported to you. It judges packages by what Forest measured (downloads, likes, versions, license rating) and by the code it reads, installs only when you say so, and takes the install command from Forest, never from package text. Text hidden from human readers, such as HTML comments, never reaches the agent at all.
In CI and scripts
Agents that run without a person present can skip sign-in and send a Forest API token instead. API tokens are read only: they reach private packages but can’t publish. In Claude Code:
claude mcp add --transport http forest https://api.forest.dev/mcp --header "Authorization: Bearer $FOREST_TOKEN"Your shell fills in $FOREST_TOKEN, and Claude Code stores the token outside your repository. For a project .mcp.json you commit, reference the variable instead so the token never lands in the file:
{
"mcpServers": {
"forest": {
"type": "http",
"url": "https://api.forest.dev/mcp",
"headers": { "Authorization": "Bearer ${FOREST_TOKEN}" }
}
}
}Agents without MCP
An assistant that can only fetch URLs can use Forest’s public HTTP API instead. Paste https://forest.dev/llms.txt into the chat and ask it to read it: that file documents every endpoint.