Product Forge

A comprehensive Claude Code marketplace plugin for product development, PRD management, task tracking, and secure technical implementation. Features CPO/CTO/Marketing/UX/DPO/DevOps/Data Engineering/RAG-CAG expertise with specialized technical agents (Django, FastAPI, FastMCP, React/TypeScript, Celery, Playwright) that research current documentation before coding. Includes design system management, cloud infrastructure (AWS, GCP, Ansible), data transformation (dbt, SQLMesh), RAG/CAG architecture with multi-tenant security, MCP security with 5-layer defense, OAuth/OIDC, and privacy compliance (GDPR/CCPA).

Forge CLI Utilities

Product Forge includes a unified forge CLI tool for skill-related utilities:

YouTube Transcript Fetcher

Fetch YouTube video transcripts as readable text files:

# Install with YouTube support
uv tool install . --with youtube-transcript-api

# Fetch transcript
forge youtube "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
forge youtube "https://youtu.be/dQw4w9WgXcQ" --output transcripts/
forge youtube dQw4w9WgXcQ

Feedback Management

Manage Product Forge learnings and feedback:

# Initialize learnings directory
forge feedback init

# Show statistics
forge feedback stats

# List feedback items
forge feedback list
forge feedback list --project product-forge
forge feedback list --type improvement

# Save feedback (used by hooks)
cat feedback.json | forge feedback save

See FORGE_CLI_IMPLEMENTATION_SUMMARY.md for complete CLI documentation.

Features

Skills (Automatic Context Activation)

Skills automatically activate when Claude detects relevant context, providing expert guidance without explicit commands.

Commands (Explicit User Actions)

Commands you invoke when you need specific functionality.

Agents (Complex Multi-Step Tasks)

Agents handle autonomous, multi-step workflows.

Leadership Agents

Design & Experience Agents

Product Management Agents

Infrastructure & DevOps Agents

AI/ML Agents

Technical Specialist Agents

All technical specialists research online documentation before implementation to ensure current best practices.

Agent Hierarchy

┌─────────────────────────────────────────────────────────────────────────────┐
│                           LEADERSHIP LAYER                                   │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  product-architect   cto-architect    marketing-expert    dpo-expert        │
│  (CPO)               (CTO)            (Brand)             (Privacy)         │
│  ├─ Strategy         ├─ Architecture  ├─ Brand Guidelines ├─ GDPR/CCPA     │
│  ├─ Market Analysis  ├─ Tech Select   ├─ Messaging        ├─ Privacy Audits│
│  └─ Roadmap          └─ Coordinates → └─ Go-to-Market     └─ DPIA          │
│                              │                                               │
└──────────────────────────────┼───────────────────────────────────────────────┘
                               │
     ┌─────────────────────────┼─────────────────────────┐
     │                         │                         │
     ▼                         ▼                         ▼
┌─────────────────┐ ┌───────────────────┐ ┌─────────────────────┐
│   DESIGN/UX     │ │  BACKEND          │ │  FRONTEND/QA        │
├─────────────────┤ ├───────────────────┤ ├─────────────────────┤
│                 │ │                   │ │                     │
│ ui-product-     │ │ django-expert     │ │ react-typescript-   │
│ expert          │ │ fastapi-expert    │ │ expert              │
│ ux-expert       │ │ fastmcp-expert    │ │ playwright-testing  │
│                 │ │ celery-expert     │ │ expert              │
│ Uses Playwright │ │                   │ │                     │
│ MCP for QA      │ │                   │ │                     │
└─────────────────┘ └───────────────────┘ └─────────────────────┘
                               │
       ┌───────────────────────┼───────────────────────┐
       │                       │                       │
       ▼                       ▼                       ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────────┐
│ INFRASTRUCTURE   │ │  DATA            │ │  AI/ML               │
├──────────────────┤ ├──────────────────┤ ├──────────────────────┤
│                  │ │                  │ │                      │
│ devops-expert    │ │ data-engineering │ │ rag-cag-expert       │
│ ├─ CI/CD         │ │ expert           │ │ ├─ RAG Architecture  │
│ ├─ Terraform     │ │ ├─ dbt           │ │ ├─ Chunking          │
│ ├─ Kubernetes    │ │ ├─ SQLMesh       │ │ ├─ Vector DBs        │
│ └─ AWS/GCP       │ │ └─ Data Quality  │ │ └─ GraphRAG          │
└──────────────────┘ └──────────────────┘ └──────────────────────┘
                              │
              ┌───────────────┴───────────────┐
              │                               │
              ▼                               ▼
    ┌──────────────────────┐    ┌──────────────────────┐
    │  SECURITY            │    │  TESTING             │
    ├──────────────────────┤    ├──────────────────────┤
    │                      │    │                      │
    │ mcp-security-expert  │    │ python-testing-expert│
    │ ├─ 5-layer defense   │    │ ├─ pytest            │
    │ ├─ Prompt injection  │    │ ├─ Mocking           │
    │ └─ Authorization     │    │ └─ Coverage          │
    └──────────────────────┘    └──────────────────────┘

              🔬 ALL SPECIALISTS RESEARCH DOCS FIRST 🔬

Documentation-First Approach

All technical specialists follow a strict documentation-first approach:

Before ANY implementation:

1. SEARCH official documentation online
2. READ current best practices
3. IDENTIFY deprecated patterns
4. REPORT findings to user
5. PROCEED with implementation

Example output:
┌────────────────────────────────────────────┐
│ Documentation Research Summary              │
├────────────────────────────────────────────┤
│ Technology: Django 5.0                      │
│                                            │
│ CURRENT BEST PRACTICES                     │
│ * Use AbstractUser for custom users        │
│ * Define AUTH_USER_MODEL early             │
│                                            │
│ DEPRECATED PATTERNS                        │
│ * Profile model extension (legacy)         │
│                                            │
│ SOURCE: docs.djangoproject.com             │
└────────────────────────────────────────────┘

MCP Security: 5-Layer Defense Architecture

For MCP servers, multi-agent systems, and text-to-SQL pipelines, the plugin enforces a 5-layer defense architecture:

┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 1: INPUT GUARDRAILS          ┃
┃ * Rate limiting  * Length limits   ┃
┃ * Injection detection (ML+regex)   ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 2: AUTHORIZATION GATE        ┃
┃ * User→Role mapping  * RBAC/ABAC  ┃
┃ * Schema filtering before agent    ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 3: SQL VALIDATION            ┃
┃ * AST parsing  * DDL/DML blocklist ┃
┃ * Table allowlist  * RLS injection ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 4: EXECUTION SANDBOX         ┃
┃ * Read-only conn  * Timeout        ┃
┃ * Cost limits  * Row limits        ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 5: OUTPUT GUARDRAILS         ┃
┃ * PII masking  * Audit logging     ┃
┃ * Result limits  * SIEM export     ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

Core Principle: Security is NOT a peer agent. Security is INFRASTRUCTURE.

BAD: Security Agent (can be prompt-injected)
GOOD: Security Guardrails (deterministic, cannot be "convinced")

The mcp-security skill automatically activates and warns when detecting:

• User input going directly to LLM without validation
• Generated SQL without proper validation
• Agents trusting previous agent's authorization checks
• Mutable or unsigned user context
• Missing audit logging

Installation

From Claude Code Marketplace

/plugin marketplace add jpoutrin/product-forge

Manual Installation from GitHub

Step 1: Clone the repository

# Clone to your preferred location
git clone https://github.com/jpoutrin/product-forge.git ~/projects/product-forge
cd ~/projects/product-forge

Step 2: Install the Forge CLI

The Forge CLI provides command-line utilities for browser capture, feedback management, and webhook notifications.

# Install using uv (recommended)
uv tool install -e .

# Verify installation
forge --version  # Should show: forge, version 0.2.0
forge --help     # Show available commands

Step 3: Initialize all subsystems

# Initialize everything (prompts for webhook confirmation)
forge init

# Or skip webhook system
forge init --skip-webhook

# Or initialize only specific subsystems
forge init --skip-feedback --skip-webhook  # Browser capture only

This will set up:

• ✅ Feedback/learnings directory (~/.claude/forge/learnings/)
• ✅ Browser capture system (~/browser-logs/ with config)
• ✅ Webhook notifications (optional - LaunchAgent + shell config)

Step 4: Install the Claude Code plugin

# Install plugin from local directory
claude plugin install ~/projects/product-forge

# Or install to standard location
git clone https://github.com/jpoutrin/product-forge.git ~/.claude/plugins/product-forge

Prerequisites

• Python 3.9+ - Required for Forge CLI
• uv - Python package manager (install guide)
• Claude Code - Latest version recommended

Forge CLI Commands

After installation, the forge command provides:

# Browser log capture (Chromium browsers: Dia, Chrome, Edge)
forge browser-capture --page "Dashboard" --all

# View forge logs
forge logs -f

# Feedback management
forge feedback list
forge feedback stats

# Webhook notifications (macOS only)
forge webhook status

# Session management
forge session list

Updating

cd ~/projects/product-forge
git pull
uv tool install -e . --force  # Reinstall CLI

Quick Start

1. Product Planning (CPO Path)

# Full discovery session with CPO guidance
/discovery-session my-awesome-product

# Or quick PRD creation
/create-prd my-awesome-product

2. Technical Architecture (CTO Path)

The CTO agent will:

• Design system architecture
• Select appropriate technologies
• Delegate to specialist agents
• Coordinate implementation

3. Implementation

Technical specialists work with documentation research:

# Django web application
→ django-expert researches docs.djangoproject.com
→ Implements with current best practices

# FastAPI microservice
→ fastapi-expert researches fastapi.tiangolo.com
→ Implements with Pydantic V2 patterns

# React frontend
→ react-typescript-expert researches react.dev
→ Implements with React 18 patterns

# Testing
→ python-testing-expert ensures 80%+ coverage

4. Infrastructure & DevOps

# DevOps expert handles CI/CD and infrastructure
→ devops-expert configures GitHub Actions
→ Sets up Terraform for AWS/GCP
→ Deploys to Kubernetes

# Data pipelines with dbt/SQLMesh
→ data-engineering-expert designs data models
→ Implements incremental transformations
→ Sets up data quality tests

5. Task Tracking

# Generate tasks from PRD
/generate-tasks my-awesome-product-prd.md

# List and track progress
/task-list

# Focus on specific task
/task-focus TASK-001

Plugin Structure

product-forge/
├── .claude-plugin/
│   └── plugin.json              # Plugin metadata (v1.0.0)
├── commands/ (14 commands)      # Slash commands
│   ├── create-prd.md
│   ├── discovery-session.md
│   └── ...
├── skills/ (17 skills)          # Auto-activating context
│   ├── prd-management/
│   ├── task-orchestration/
│   ├── product-strategy/
│   ├── documentation-research/
│   ├── mcp-security/            # 5-layer defense
│   ├── design-system/           # Component library
│   ├── python-style/            # Python code style
│   ├── typescript-style/        # TypeScript code style
│   ├── privacy-compliance/      # GDPR/CCPA
│   ├── aws-cloud/               # AWS best practices
│   ├── gcp-cloud/               # GCP best practices
│   ├── ansible/                 # Ansible automation
│   ├── oauth/                   # OAuth 2.0/OIDC
│   ├── dbt/                     # dbt transformation
│   ├── sqlmesh/                 # SQLMesh patterns
│   ├── rag-cag-security/        # RAG/CAG architecture
│   └── chunking-strategies/     # Document chunking deep-dive
├── agents/ (19 agents)          # Multi-step workflows
│   ├── product-architect.md     # CPO
│   ├── cto-architect.md         # CTO
│   ├── marketing-expert.md      # Brand strategy
│   ├── dpo-expert.md            # Privacy/GDPR
│   ├── ui-product-expert.md     # UI guidelines
│   ├── ux-expert.md             # User experience
│   ├── devops-expert.md         # CI/CD, Infrastructure
│   ├── data-engineering-expert.md # dbt, SQLMesh, pipelines
│   ├── rag-cag-expert.md        # RAG/CAG architecture
│   ├── prd-orchestrator.md
│   ├── task-executor.md
│   ├── django-expert.md
│   ├── fastapi-expert.md
│   ├── fastmcp-expert.md
│   ├── celery-expert.md         # Task queues
│   ├── react-typescript-expert.md
│   ├── playwright-testing-expert.md # E2E testing
│   ├── python-testing-expert.md
│   └── mcp-security-expert.md
├── templates/                   # Document templates
├── processes/                   # Process documentation
└── README.md

When to Use What

Key Concepts

CTO Orchestration

The CTO agent coordinates technical specialists:

User: "Build a task management API"

cto-architect:
1. Designs architecture (FastAPI + PostgreSQL)
2. Delegates API implementation → fastapi-expert
3. Delegates testing → python-testing-expert
4. Delegates CI/CD → devops-expert
5. Reviews integration
6. Ensures quality standards

Documentation Research Enforcement

Technical specialists MUST research before coding:

django-expert receives task

STEP 1: Research
→ WebSearch("Django 5.0 [topic] best practices")
→ WebFetch("https://docs.djangoproject.com/...")
→ Report findings

STEP 2: Implement
→ Follow documented patterns
→ Avoid deprecated APIs
→ Reference docs in comments

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Submit a pull request

License

MIT License - see LICENSE file for details.

Credits

Based on claude-blueprint CLI tool.

Inspired by:

• claude-code-templates
• claude-code-plugins-plus