Intutic vs Forge

Last reviewed: 2026-10-10

Intutic and Forge start from different places. Intutic is the enforcement point itself: a gate inside the coding agent that decides each tool call before it runs, in 36 of its 43 supported harnesses, backed by a policy proxy, an MCP governance proxy, a default-deny egress firewall and sandboxed execution. It is open core. Forge (forge.ai, by a37) is a hosted governance platform that works top-down: it discovers AI agents and non-human identities across an organization, brokers their cloud credentials, and enforces policy through its own device agent, MCP gateway and LLM gateway plus the security tools you already run.

Comparison

	Intutic	Forge
Where enforcement happens	At the tool call: native pre-execution hook gates in 18 of the 43 harnesses and in-process SDK gates in 17 agent frameworks; plus a request and response proxy, an MCP governance proxy, a host egress firewall (intutic enforce) and sandboxed execution (intutic exec --sandbox)	Its device agent, MCP gateway and LLM gateway, plus control points in connected tools. Its per-call check before a tool runs covers MCP tool calls; a coding agent's built-in shell and file tools are governed through the agent's own settings, which Forge manages
Coding agents covered	43 supported harnesses, including Claude Code, Codex, Cursor, GitHub Copilot, Windsurf, Cline, Roo Code, OpenCode and Goose, plus agent frameworks such as LangGraph, CrewAI and the OpenAI Agents SDK through an in-process gate	Documented integrations for Claude Code, Claude Cowork, Codex, Cursor, OpenClaw and Rovo Dev, with managed configuration and drift reports for the first four; its site also names GitHub Copilot, Devin and Antigravity
Policy actions	Allow, warn, require approval (the call is refused and held for review; with a control plane, once a reviewer approves it the identical retry passes if the workspace has opted in, and with none it stays refused), block, redact, re-ask, and shadow mode that measures how often a rule would act	Allow, nudge, flag for review, redact, filter, require approval, block
When the policy layer fails	Hook gates fail closed on a crash or a malformed payload, and the proxy blocks by default when its policy service is unreachable. With no configuration, the gates block writes to their own hook files and settings, governance-bypass commands and secrets, and the proxy refuses rm -rf /, mkfs and similar operations in a model's code-execution tool call. The gates' destructive-command tier flags those commands rather than blocking them	Rego policies fail closed; built-in conditions that lack data do not match; the Cloudflare transport fails open unless switched to fail closed
Behaviour across a session	Ordering rules in SOP front matter (requires_before, forbid_after, max_calls), WASM rules over the session's tool history, a loop breaker, and a trajectory monitor that reviews the session beside it and, in its ACTIVE mode, can end it	Conditions over session history (an earlier event, an ordered sequence within a time window, counts, distinct values) and a Watcher agent that reviews the session as it runs and intervenes past a risk threshold
MCP governance	A server registry with approvals, an optional default-deny policy and per-tool switches; approval holds; the API key, OS user and session on every event and hold, with the member resolved from the key and SSO group policy applied; call budgets per server, per member and per tool, counted in Valkey across proxies; pattern DLP, argument-matching policy rules, prompt-injection scanning, seven anomaly detectors, WASM rules, trust-on-first-use pinning that flags or blocks a changed tool set, a rule-based risk score for each tool-set change that can return a server to the approval queue, and tool-description poisoning detection; wired automatically into 12 harnesses; MCP servers that bypass the proxy are listed as ungoverned	MCP Gateway with a default-deny server registry, approvals, per-server, per-user and per-tool budgets, tool-change risk scoring and OAuth 2.1
Source	Open core (MIT): the proxy, hook gates, MCP proxy, CLI and sync daemon	Closed

Where Forge is stronger

• Organization-wide discovery. Forge inventories AI agents and non-human identities across the whole organization, through EDR and identity-provider connectors. Intutic's AI inventory, with a control plane, covers the developer machines connected to it: the harnesses, MCP servers and skill bundles on each, and which run ungoverned.
• Credential brokering. It issues short-lived cloud credentials to agents and right-sizes their permissions. Intutic governs what an agent does with access it already has.
• MCP OAuth brokering. Forge's MCP gateway brokers OAuth 2.1 for remote MCP servers. Intutic's MCP proxy passes a remote server's credentials through rather than obtaining, refreshing or scoping them. Both have server registries, budgets and tool-change risk scores; Intutic's budgets count calls in a Valkey the proxies share, so proxies on separate Valkeys count separately. New Intutic workspaces start with the registry allowing unapproved servers.
• Regulatory framework mapping. Intutic maps its own evidence to SOC 2 and OWASP, and to the EU AI Act, ISO/IEC 42001, the NIST AI RMF and MITRE ATLAS where an enforcement layer can evidence a control, mostly as partial coverage. Forge also maps to HIPAA, PCI DSS, GDPR, CCPA/CPRA, AIUC-1 and other frameworks beyond AI governance and security.
• Rego backtests. Both run Rego policies: Intutic compiles them with OPA and runs them in its proxy and MCP proxy, locally or distributed from the control plane, with holds through its review queue (Rego policies). Forge also backtests a Rego policy against historical evidence and previews its impact; Intutic replays native rules against sampled traffic, and measures a Rego rule on live traffic in shadow mode. Both test a policy against cases you write: intutic rules test in Intutic, test packages of up to 1,000 cases in Forge. Both have a Terraform provider on the Terraform Registry; Intutic's is also open source.
• Coverage without installing anything. Forge can govern agents by routing their traffic through a SASE or firewall product the organization already runs. Every Intutic enforcement point runs on the machine, in the CI job or beside the service.
• Drafting policy in plain language. Forge's console assistant drafts a policy from a description, as a proposal an admin applies. Intutic's Policy Guardrails start from the policy documents you already have and cite the passage behind each rule.
• Protocol policies. Connection and command decisions for HTTP, Postgres, MySQL and Redis. Intutic's sql_guard covers destructive SQL issued through an agent's tools.

When to choose Intutic

• Your agents are coding agents and agent frameworks, such as Windsurf, Cline, Goose or LangGraph alongside Claude Code and Cursor, and you want each tool call decided before it runs.
• You want to read the code that blocks a call.
• You want an approval hold, a sandbox and an egress firewall that work with or without the rest of your security stack.

When to choose Forge

• You need to discover and inventory every AI agent and non-human identity across the organization.
• You want agents to receive short-lived cloud credentials rather than standing keys.
• You want to reach agents through your SASE or firewall without installing anything on developer machines.
• Your compliance program needs mappings beyond the AI frameworks, such as HIPAA.
• You want to backtest Rego policies against historical evidence before enforcing them, and a hosted service suits your data posture.

---

Get Started with Intutic →