Product Forge

A comprehensive Claude Code marketplace plugin for product development, PRD management, task tracking, and secure technical implementation. Features CPO/CTO/Marketing/UX/DPO/DevOps/Data Engineering/RAG-CAG expertise with specialized technical agents (Django, FastAPI, FastMCP, React/TypeScript, Celery, Playwright) that research current documentation before coding. Includes design system management, cloud infrastructure (AWS, GCP, Ansible), data transformation (dbt, SQLMesh), RAG/CAG architecture with multi-tenant security, MCP security with 5-layer defense, OAuth/OIDC, and privacy compliance (GDPR/CCPA).

Forge CLI Utilities

Product Forge includes a unified forge CLI tool for skill-related utilities:

YouTube Transcript Fetcher

Fetch YouTube video transcripts as readable text files:

# Install with YouTube support
uv tool install . --with youtube-transcript-api

# Fetch transcript
forge youtube "https://www.youtube.com/watch?v=dQw4w9WgXcQ"
forge youtube "https://youtu.be/dQw4w9WgXcQ" --output transcripts/
forge youtube dQw4w9WgXcQ

Feedback Management

Manage Product Forge learnings and feedback:

# Initialize learnings directory
forge feedback init

# Show statistics
forge feedback stats

# List feedback items
forge feedback list
forge feedback list --project product-forge
forge feedback list --type improvement

# Save feedback (used by hooks)
cat feedback.json | forge feedback save

See FORGE_CLI_IMPLEMENTATION_SUMMARY.md for complete CLI documentation.

Features

Skills (Automatic Context Activation)

Skills automatically activate when Claude detects relevant context, providing expert guidance without explicit commands.

Skill	Triggers	Description
PRD Management	prd, requirements	Automatic lifecycle management and organization
Task Orchestration	task, implement	Documentation-first execution with quality checks
Product Strategy	strategy, market	Chief Product Officer expertise with proven frameworks
Documentation Research	code, build, develop	Enforces online documentation research before implementation
MCP Security	mcp security, prompt injection, authorization	5-layer defense architecture for multi-agent systems
Design System	design system, components, tokens	Build and reuse UI components, tokens, and patterns
Python Style	python, django, fastapi, celery	PEP standards, type hints, and modern Python patterns
TypeScript Style	typescript, react, node, eslint	Strict typing, ESLint, and modern TS/JS patterns
Privacy Compliance	gdpr, ccpa, privacy, data protection	GDPR, CCPA/CPRA, and regional compliance
AWS Cloud	aws, ec2, s3, lambda, iam	AWS services best practices and IAM security
GCP Cloud	gcp, gce, bigquery, cloud run	Google Cloud best practices and IAM security
Ansible	ansible, playbook, vault	Ansible automation for infrastructure
OAuth	oauth, oidc, jwt, pkce	OAuth 2.0 and OpenID Connect implementation
dbt	dbt, data transformation	dbt modeling, testing, and documentation
SQLMesh	sqlmesh, virtual environments	SQLMesh incremental models and CI/CD
RAG/CAG Architecture	rag, cag, vector database, embeddings	RAG/CAG patterns, chunking, multi-tenant security
Chunking Strategies	chunking, text splitting, semantic chunking	Document-type-specific chunking, RAPTOR, evaluation

Commands (Explicit User Actions)

Commands you invoke when you need specific functionality.

Command	Usage	Description
/create-prd	/create-prd my-product	Interactive PRD creation wizard
/create-prd-feature	/create-prd-feature auth	Create feature-specific PRD
/generate-tasks	/generate-tasks prd.md	Convert PRD to task list
/prd-status	/prd-status prd.md --set ACTIVE	Check/update PRD status
/list-prds	/list-prds --status ACTIVE	List PRDs with metadata
/task-list	/task-list --dir focus	List tasks with progress
/task-focus	/task-focus TASK-001	Focus on specific task
/discovery-session	/discovery-session my-product	Start product discovery
/create-persona	/create-persona developer	Create user persona
/position-product	/position-product my-product	Define positioning
/brainstorm-solution	/brainstorm-solution "problem"	Structured brainstorming
/prd-progress	/prd-progress prd.md	Show implementation progress
/prd-archive	/prd-archive prd.md	Archive completed PRDs
/quick-start	/quick-start	Quick start guide

Agents (Complex Multi-Step Tasks)

Agents handle autonomous, multi-step workflows.

Leadership Agents

Agent	Role	Capabilities
product-architect	Chief Product Officer	Discovery, strategy, roadmap, launch planning
cto-architect	Chief Technology Officer	System design, tech selection, team coordination
marketing-expert	Brand Strategist	Brand guidelines, messaging, go-to-market
dpo-expert	Data Protection Officer	GDPR/CCPA compliance, privacy audits, DPIA

Design & Experience Agents

Agent	Role	Capabilities
ui-product-expert	UI Specialist	UI guidelines, design tokens, visual QA (Playwright MCP)
ux-expert	UX Specialist	User research, usability testing, accessibility

Product Management Agents

Agent	Role	Capabilities
prd-orchestrator	PRD Lifecycle Manager	Create, validate, track, archive PRDs
task-executor	Task Implementation	Documentation-first execution, quality checks

Infrastructure & DevOps Agents

Agent	Role	Capabilities
devops-expert	DevOps Engineer	CI/CD, Terraform, Kubernetes, Docker, GitOps
data-engineering-expert	Data Engineer	dbt, SQLMesh, ELT pipelines, data quality

AI/ML Agents

Agent	Role	Capabilities
rag-cag-expert	RAG/CAG Architect	RAG architecture, chunking, vector DBs, GraphRAG, semantic caching

Technical Specialist Agents

All technical specialists research online documentation before implementation to ensure current best practices.

Agent	Expertise	Key Capabilities
django-expert	Python Django	Models, views, DRF, admin, authentication
fastapi-expert	Python FastAPI	Async APIs, Pydantic, OpenAPI, JWT
fastmcp-expert	Python FastMCP	MCP tools, resources, Claude integration
react-typescript-expert	React + TypeScript	Components, hooks, state, testing
python-testing-expert	pytest	Unit tests, integration, mocking, CI/CD
celery-expert	Python Celery	Task queues, async processing, scheduling
playwright-testing-expert	Playwright	E2E testing, visual regression, accessibility
mcp-security-expert	Multi-Agent Security	5-layer defense, prompt injection, authorization

Agent Hierarchy

┌─────────────────────────────────────────────────────────────────────────────┐
│                           LEADERSHIP LAYER                                   │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  product-architect   cto-architect    marketing-expert    dpo-expert        │
│  (CPO)               (CTO)            (Brand)             (Privacy)         │
│  ├─ Strategy         ├─ Architecture  ├─ Brand Guidelines ├─ GDPR/CCPA     │
│  ├─ Market Analysis  ├─ Tech Select   ├─ Messaging        ├─ Privacy Audits│
│  └─ Roadmap          └─ Coordinates → └─ Go-to-Market     └─ DPIA          │
│                              │                                               │
└──────────────────────────────┼───────────────────────────────────────────────┘
                               │
     ┌─────────────────────────┼─────────────────────────┐
     │                         │                         │
     ▼                         ▼                         ▼
┌─────────────────┐ ┌───────────────────┐ ┌─────────────────────┐
│   DESIGN/UX     │ │  BACKEND          │ │  FRONTEND/QA        │
├─────────────────┤ ├───────────────────┤ ├─────────────────────┤
│                 │ │                   │ │                     │
│ ui-product-     │ │ django-expert     │ │ react-typescript-   │
│ expert          │ │ fastapi-expert    │ │ expert              │
│ ux-expert       │ │ fastmcp-expert    │ │ playwright-testing  │
│                 │ │ celery-expert     │ │ expert              │
│ Uses Playwright │ │                   │ │                     │
│ MCP for QA      │ │                   │ │                     │
└─────────────────┘ └───────────────────┘ └─────────────────────┘
                               │
       ┌───────────────────────┼───────────────────────┐
       │                       │                       │
       ▼                       ▼                       ▼
┌──────────────────┐ ┌──────────────────┐ ┌──────────────────────┐
│ INFRASTRUCTURE   │ │  DATA            │ │  AI/ML               │
├──────────────────┤ ├──────────────────┤ ├──────────────────────┤
│                  │ │                  │ │                      │
│ devops-expert    │ │ data-engineering │ │ rag-cag-expert       │
│ ├─ CI/CD         │ │ expert           │ │ ├─ RAG Architecture  │
│ ├─ Terraform     │ │ ├─ dbt           │ │ ├─ Chunking          │
│ ├─ Kubernetes    │ │ ├─ SQLMesh       │ │ ├─ Vector DBs        │
│ └─ AWS/GCP       │ │ └─ Data Quality  │ │ └─ GraphRAG          │
└──────────────────┘ └──────────────────┘ └──────────────────────┘
                              │
              ┌───────────────┴───────────────┐
              │                               │
              ▼                               ▼
    ┌──────────────────────┐    ┌──────────────────────┐
    │  SECURITY            │    │  TESTING             │
    ├──────────────────────┤    ├──────────────────────┤
    │                      │    │                      │
    │ mcp-security-expert  │    │ python-testing-expert│
    │ ├─ 5-layer defense   │    │ ├─ pytest            │
    │ ├─ Prompt injection  │    │ ├─ Mocking           │
    │ └─ Authorization     │    │ └─ Coverage          │
    └──────────────────────┘    └──────────────────────┘

              🔬 ALL SPECIALISTS RESEARCH DOCS FIRST 🔬

Documentation-First Approach

All technical specialists follow a strict documentation-first approach:

Before ANY implementation:

1. SEARCH official documentation online
2. READ current best practices
3. IDENTIFY deprecated patterns
4. REPORT findings to user
5. PROCEED with implementation

Example output:
┌────────────────────────────────────────────┐
│ Documentation Research Summary              │
├────────────────────────────────────────────┤
│ Technology: Django 5.0                      │
│                                            │
│ CURRENT BEST PRACTICES                     │
│ * Use AbstractUser for custom users        │
│ * Define AUTH_USER_MODEL early             │
│                                            │
│ DEPRECATED PATTERNS                        │
│ * Profile model extension (legacy)         │
│                                            │
│ SOURCE: docs.djangoproject.com             │
└────────────────────────────────────────────┘

MCP Security: 5-Layer Defense Architecture

For MCP servers, multi-agent systems, and text-to-SQL pipelines, the plugin enforces a 5-layer defense architecture:

┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 1: INPUT GUARDRAILS          ┃
┃ * Rate limiting  * Length limits   ┃
┃ * Injection detection (ML+regex)   ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 2: AUTHORIZATION GATE        ┃
┃ * User→Role mapping  * RBAC/ABAC  ┃
┃ * Schema filtering before agent    ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 3: SQL VALIDATION            ┃
┃ * AST parsing  * DDL/DML blocklist ┃
┃ * Table allowlist  * RLS injection ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 4: EXECUTION SANDBOX         ┃
┃ * Read-only conn  * Timeout        ┃
┃ * Cost limits  * Row limits        ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
           │
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ Layer 5: OUTPUT GUARDRAILS         ┃
┃ * PII masking  * Audit logging     ┃
┃ * Result limits  * SIEM export     ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛

Core Principle: Security is NOT a peer agent. Security is INFRASTRUCTURE.

BAD: Security Agent (can be prompt-injected)
GOOD: Security Guardrails (deterministic, cannot be "convinced")

The mcp-security skill automatically activates and warns when detecting:

• User input going directly to LLM without validation
• Generated SQL without proper validation
• Agents trusting previous agent's authorization checks
• Mutable or unsigned user context
• Missing audit logging

Installation

From Claude Code Marketplace

/plugin marketplace add jpoutrin/product-forge

Manual Installation from GitHub

Step 1: Clone the repository

# Clone to your preferred location
git clone https://github.com/jpoutrin/product-forge.git ~/projects/product-forge
cd ~/projects/product-forge

Step 2: Install the Forge CLI

The Forge CLI provides command-line utilities for browser capture, feedback management, and webhook notifications.

# Install using uv (recommended)
uv tool install -e .

# Verify installation
forge --version  # Should show: forge, version 0.2.0
forge --help     # Show available commands

Step 3: Initialize all subsystems

# Initialize everything (prompts for webhook confirmation)
forge init

# Or skip webhook system
forge init --skip-webhook

# Or initialize only specific subsystems
forge init --skip-feedback --skip-webhook  # Browser capture only

This will set up:

• ✅ Feedback/learnings directory (~/.claude/forge/learnings/)
• ✅ Browser capture system (~/browser-logs/ with config)
• ✅ Webhook notifications (optional - LaunchAgent + shell config)

Step 4: Install the Claude Code plugin

# Install plugin from local directory
claude plugin install ~/projects/product-forge

# Or install to standard location
git clone https://github.com/jpoutrin/product-forge.git ~/.claude/plugins/product-forge

Prerequisites

• Python 3.9+ - Required for Forge CLI
• uv - Python package manager (install guide)
• Claude Code - Latest version recommended

Forge CLI Commands

After installation, the forge command provides:

# Browser log capture (Chromium browsers: Dia, Chrome, Edge)
forge browser-capture --page "Dashboard" --all

# View forge logs
forge logs -f

# Feedback management
forge feedback list
forge feedback stats

# Webhook notifications (macOS only)
forge webhook status

# Session management
forge session list

Updating

cd ~/projects/product-forge
git pull
uv tool install -e . --force  # Reinstall CLI

Quick Start

1. Product Planning (CPO Path)

# Full discovery session with CPO guidance
/discovery-session my-awesome-product

# Or quick PRD creation
/create-prd my-awesome-product

2. Technical Architecture (CTO Path)

The CTO agent will:

• Design system architecture
• Select appropriate technologies
• Delegate to specialist agents
• Coordinate implementation

3. Implementation

Technical specialists work with documentation research:

# Django web application
→ django-expert researches docs.djangoproject.com
→ Implements with current best practices

# FastAPI microservice
→ fastapi-expert researches fastapi.tiangolo.com
→ Implements with Pydantic V2 patterns

# React frontend
→ react-typescript-expert researches react.dev
→ Implements with React 18 patterns

# Testing
→ python-testing-expert ensures 80%+ coverage

4. Infrastructure & DevOps

# DevOps expert handles CI/CD and infrastructure
→ devops-expert configures GitHub Actions
→ Sets up Terraform for AWS/GCP
→ Deploys to Kubernetes

# Data pipelines with dbt/SQLMesh
→ data-engineering-expert designs data models
→ Implements incremental transformations
→ Sets up data quality tests

5. Task Tracking

# Generate tasks from PRD
/generate-tasks my-awesome-product-prd.md

# List and track progress
/task-list

# Focus on specific task
/task-focus TASK-001

Plugin Structure

product-forge/
├── .claude-plugin/
│   └── plugin.json              # Plugin metadata (v1.0.0)
├── commands/ (14 commands)      # Slash commands
│   ├── create-prd.md
│   ├── discovery-session.md
│   └── ...
├── skills/ (17 skills)          # Auto-activating context
│   ├── prd-management/
│   ├── task-orchestration/
│   ├── product-strategy/
│   ├── documentation-research/
│   ├── mcp-security/            # 5-layer defense
│   ├── design-system/           # Component library
│   ├── python-style/            # Python code style
│   ├── typescript-style/        # TypeScript code style
│   ├── privacy-compliance/      # GDPR/CCPA
│   ├── aws-cloud/               # AWS best practices
│   ├── gcp-cloud/               # GCP best practices
│   ├── ansible/                 # Ansible automation
│   ├── oauth/                   # OAuth 2.0/OIDC
│   ├── dbt/                     # dbt transformation
│   ├── sqlmesh/                 # SQLMesh patterns
│   ├── rag-cag-security/        # RAG/CAG architecture
│   └── chunking-strategies/     # Document chunking deep-dive
├── agents/ (19 agents)          # Multi-step workflows
│   ├── product-architect.md     # CPO
│   ├── cto-architect.md         # CTO
│   ├── marketing-expert.md      # Brand strategy
│   ├── dpo-expert.md            # Privacy/GDPR
│   ├── ui-product-expert.md     # UI guidelines
│   ├── ux-expert.md             # User experience
│   ├── devops-expert.md         # CI/CD, Infrastructure
│   ├── data-engineering-expert.md # dbt, SQLMesh, pipelines
│   ├── rag-cag-expert.md        # RAG/CAG architecture
│   ├── prd-orchestrator.md
│   ├── task-executor.md
│   ├── django-expert.md
│   ├── fastapi-expert.md
│   ├── fastmcp-expert.md
│   ├── celery-expert.md         # Task queues
│   ├── react-typescript-expert.md
│   ├── playwright-testing-expert.md # E2E testing
│   ├── python-testing-expert.md
│   └── mcp-security-expert.md
├── templates/                   # Document templates
├── processes/                   # Process documentation
└── README.md

When to Use What

Need	Use	Why
Plan a new product	product-architect agent	CPO expertise for strategy
Design system architecture	cto-architect agent	CTO expertise + delegates to specialists
Create brand guidelines	marketing-expert agent	Brand strategy and messaging
Ensure privacy compliance	dpo-expert agent	GDPR/CCPA expertise
Design UI guidelines	ui-product-expert agent	Design tokens, component specs
Plan user experience	ux-expert agent	Research, journey mapping, usability
Build Django web app	django-expert agent	Researches Django docs first
Build FastAPI service	fastapi-expert agent	Researches FastAPI docs first
Build React frontend	react-typescript-expert agent	Researches React docs first
Create MCP server	fastmcp-expert agent	Researches MCP protocol first
Add background tasks	celery-expert agent	Task queues and scheduling
Set up CI/CD pipelines	devops-expert agent	GitHub Actions, Terraform, K8s
Build data pipelines	data-engineering-expert agent	dbt, SQLMesh, data quality
Design RAG/CAG systems	rag-cag-expert agent	Chunking, vector DBs, multi-tenant
Write E2E tests	playwright-testing-expert agent	Visual regression, accessibility
Write unit tests	python-testing-expert agent	pytest expertise
Secure multi-agent system	mcp-security-expert agent	5-layer defense architecture
Implement OAuth/OIDC	Use oauth skill	Authorization Code + PKCE
Deploy to AWS	Use aws-cloud skill	IAM, EC2, S3, Lambda patterns
Deploy to GCP	Use gcp-cloud skill	IAM, Cloud Run, BigQuery patterns
Automate infrastructure	Use ansible skill	Playbooks, roles, vault
Build RAG pipelines	Use rag-cag-security skill	Architecture, chunking, security
Create a PRD	/create-prd command	Interactive wizard
Track tasks	/task-list command	Visual progress

Key Concepts

CTO Orchestration

The CTO agent coordinates technical specialists:

User: "Build a task management API"

cto-architect:
1. Designs architecture (FastAPI + PostgreSQL)
2. Delegates API implementation → fastapi-expert
3. Delegates testing → python-testing-expert
4. Delegates CI/CD → devops-expert
5. Reviews integration
6. Ensures quality standards

Documentation Research Enforcement

Technical specialists MUST research before coding:

django-expert receives task

STEP 1: Research
→ WebSearch("Django 5.0 [topic] best practices")
→ WebFetch("https://docs.djangoproject.com/...")
→ Report findings

STEP 2: Implement
→ Follow documented patterns
→ Avoid deprecated APIs
→ Reference docs in comments

Contributing

1. Fork the repository
2. Create a feature branch
3. Make your changes
4. Submit a pull request

License

MIT License - see LICENSE file for details.

Credits

Based on claude-blueprint CLI tool.

Inspired by:

• claude-code-templates
• claude-code-plugins-plus