Forge Anvil AI/6 of 8 live

Your AI assistant, working from real evidence

Ask questions of an engagement and get answers that cite the proof. Draft findings from evidence you picked. Catch gaps while you still have access. Coordinate in Slack or Teams — where nothing, ever, approves testing.

Open Ask Anvil Findings register

Live

Ask Anvil

Cited answers across the engagement — the exact command, response, screenshot and timestamped clip behind every claim.

Ask a question

Live

Evidence-to-finding

Draft findings in the customer's template with traceable claims, flagged assumptions and reviewer approval before export.

Draft from evidence

Live

Evidence-quality checks

Catch missing proof, recording gaps and unsupported claims while the tester still has access.

Run the checks

Live

Slack & Teams coordinator

One Forge Slack app, linked per channel to the engagement or exercise it covers. Requests, reviews, scope proposals, daily summaries and handoffs — a chat reaction never authorizes testing.

Open the coordinator

Live

Remediation & retest concierge

Verification criteria and retest requests tied to the original finding. "Ticket closed" and "fix verified" stay separate.

Prepare a retest

Live

Engagement to Forge exercise

With permission, turn a finding into a sanitized, reviewed training scenario with objectives and a rubric.

Slack & Teams coordinator

Point a Slack slash command at /api/public/anvil-slack-webhook. Every request is signature-checked and time-boxed to five minutes before anything is read.

What it answers

status — Where the engagement stands right now.
summary — The daily digest: findings by severity and the last recorded action.
findings — The current findings list, worst first.
quality — Evidence gaps that would fail review.
scope <target> — Logs a scope request. It does not add the target.
assign <person> — Notes who is picking the work up.
handoff — Open work and evidence gaps for the next shift.
escalate <why> — Raises it and repeats the emergency stop word.

What it always refuses

"approve", "approved", "authorize", "sign off"
"go ahead", "green light", "you may test"
"LGTM", "ship it"
Any emoji reaction on any message

Authorization comes only from a signed rules-of-engagement record with a named approver and a scope entry. A reaction is not approval, and neither is a message.

What leaves the engagement

Short extracts and metadata only: a command line, a finding title, a file name and hash.
Never a recording or a packet capture, and no file bodies other than screenshots you ask Anvil to read (held only temporarily, never used for training). The rest stays in the evidence store under its own access rules.
Anvil reads the engagement as you, so it can never show you an engagement you cannot open.

Coming next

Later

Did the defenders see it?

Correlate recorded actions with SIEM/EDR telemetry: blocked, logged-no-alert, alerted, investigated or inconclusive.

Later

AI agent evaluation

Grade agents on known Forge scenarios for scope, approvals, evidence, injection resistance and cost before real engagements.