Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Windows Tipps & SecurityNighthawk M7 Pro im Test: Flexibler, aber teurer 5G-Router(21.09.2026 um 10:30 Uhr)
Sichere ProgrammierungNeue Gmail-Funktion: So sparst du jetzt Zeit bei Einmalcodes(21.09.2026 um 10:00 Uhr)
Sichere ProgrammierungYour GIF exporter is fine — the container is the problem(21.09.2026 um 10:01 Uhr)
Sichere ProgrammierungCSS, Motion, or GSAP? I Choose by Who Owns the Animation(21.09.2026 um 10:12 Uhr)
Windows Tipps & SecurityNighthawk M7 Pro im Test: Flexibler, aber teurer 5G-Router(21.09.2026 um 10:30 Uhr)
Sichere ProgrammierungNeue Gmail-Funktion: So sparst du jetzt Zeit bei Einmalcodes(21.09.2026 um 10:00 Uhr)
Sichere ProgrammierungYour GIF exporter is fine — the container is the problem(21.09.2026 um 10:01 Uhr)
Sichere ProgrammierungCSS, Motion, or GSAP? I Choose by Who Owns the Animation(21.09.2026 um 10:12 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

What is the Forge Method? Five rules so your agents stop improvising.

In the first post I told you the story: 20 years as a developer, six months of being scared of AI, $800 in burned tokens, and a stubborn agent named Claudio who taught me — by failing over and over — how to ask for things properly. This po…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!

In the first post I told you the story: 20 years as a developer, six months of being scared of AI, $800 in burned tokens, and a stubborn agent named Claudio who taught me — by failing over and over — how to ask for things properly.



This post is the method that came out of all that pain. Five rules, one per letter of FORGE.



I want to be honest about one thing up front: this is not a framework I invented at a whiteboard. Every rule here is a scar. Each one is the lesson from a specific mistake that cost me money, time, or sleep. I'm going to tell you the mistake first, and then the rule. Because the rule only makes sense once you've felt the pain that created it.

Let's go.





First, the idea behind all of it



Here's the thing nobody told me when I started:



A task is not a post-it. It's a contract.



When you ask an AI agent for something with no structure, you're not giving an order — you're placing a bet. The agent interprets, assumes, improvises, and the result depends on how much context it managed to reconstruct on its own. Sometimes it guesses right. Often it doesn't. And you only find out after the tokens are gone.



The Forge Method is the agreement between you and your agents: you bring the structure, they execute with precision. That's it. Five rules to hold up your end of that contract.







F — Focused



The mistake: My early tasks had titles like "Fix bug" and "Update stuff." I'd come back twenty minutes later to find the agent had fixed a bug — just not the one I meant. It wasn't wrong. It just had no way of knowing which thing I was talking about.



**The rule: **If the title is vague, the task is vague. Vague in, vague out.



A focused title needs a domain, an action, and a scope. Two words minimum, and no generic placeholders.



❌ Rejected:




- "Fix bug"
- "Update auth"
- "Do the thing"






✅ Accepted:




- "Fix authentication timeout on Nginx reverse proxy"
- "Update JWT expiry from 1h to 24h in src/auth/config.ts"






The test: Read the title with no context. Do you know the domain, the action, and the scope? If not, rewrite it before you do anything else.









O — Output defined



The mistake: I'd write "Output: Done" and hit go. Then the agent would finish and I'd have no idea whether it actually finished, because I'd never decided what finished looked like. I was checking the work against a definition I didn't have.



The rule: If you don't know what "done" looks like, neither does the agent.



The deliverable has to be concrete and checkable before you start. Not "make it work" — but "file X, at path Y, with behavior Z."



❌ Rejected:




- "Output: Done"
- "Output: Fixed"
- "Output: Implemented"






✅ Accepted:




- "Output: PostgreSQL migration file adding users table with indexes, at db/migrations/20250531_users.sql"






The test: Can you check the output without running the code? If you have to interpret it to know whether it's right, it's not defined well enough.









R — Requirements first



The mistake: This is the one that hurt the most. I'd ask for something and assume the agent "knew" the context — the files, the constraints, the stuff I'd mentioned three chats ago. It didn't. So it filled the gaps the only way it can: by inventing them. That's not the agent being dumb. That's it doing exactly what you'd do with missing information — guess. And a confident guess that looks like code is the most expensive kind of wrong.



**The rule: **No context, the agent hallucinates.

Every input and dependency gets declared upfront: files, links, APIs, constraints, and — this one matters — what not to touch.



❌ Rejected:




- "Input: None"
- "Input: the usual stuff"
- "Input: you know"






✅ Accepted:




Input:
- Figma file: figma.com/file/abc123
- Auth middleware: src/middleware/auth.ts
- DO NOT touch src/routes/public.ts






**The test: **Can the agent start without asking you a single question? If not, you're missing context.









G — Granular



The mistake: I went through both extremes. Either I'd drop one giant task — "build the auth system" — and the agent would wander off and build a parallel universe (this is literally how I lost $200 in one night). Or I'd over-engineer it into fifteen micro-steps and the agent would lose the thread halfway through. Neither worked.



The rule: Between 2 and 5 subtasks. In the middle is where the clarity lives.



Fewer than 2 means the task is still too vague to plan. More than 5 means you either didn't think it through or it's actually two different tasks wearing one title.



❌ Rejected:




1. Do the auth
2. Test it






(What auth? What test? The agent will guess.)



✅ Accepted:




1. Create JWT util at src/auth/jwt.ts (sign + verify)
2. Add validation middleware at src/middleware/auth.ts
3. Wire middleware to /api routes
4. Integration tests: valid / expired / invalid






The test: Does each subtask have a clear output and can it run independently? If not, split it or merge it.









E — Errors cataloged



The mistake: This is the one that named itself. I got blocked by the same missing output folder twice in a row. The first time, an accident. The second time, I fixed it again and moved on like an idiot. If it had happened a third time with nothing written down, that's not the agent's fault anymore — that's negligence on my side.



**The rule: **If the same error happens twice, document it. The third time, you're the problem.



When an error repeats, it goes in a NOTES.md: what happened, the root cause, the fix. First time it's an accident, second time it's a signal, third time it's on you.



❌ Rejected:




// task-004: output folder missing → fix
// task-009: same error again → fix again
// task-015: same error... fix again






(Nobody wrote it down. So it repeats forever.)



✅ Accepted:




// NOTES.md
## output-folder-missing
Happened in: task-004, task-009
Cause: relative path in config
Fix: use path.resolve(__dirname)
Status: active runbook since task-010






**The test: **Is it in NOTES.md? If the error has happened twice and it isn't documented, you're failing the E.









Why "Forge"



People assume I reverse-engineered the acronym to be cute. I didn't.



Before any of these rules existed, I'd already spent three months building a personal tool I called Forge — a place to manage my AI assistants and the artifacts they produced. So the name was already in my head. When the five rules settled into place, the letters just lined up. F, O, R, G, E. I couldn't have planned it better if I'd tried, and believe me, I didn't.



And the metaphor lined up too. I do woodworking on weekends — I like shaping things with my hands. The best tasks aren't improvised. They're shaped, hammered, hardened before you put them to work. They're forged. The bad ones shatter the first time you lean on them.









What a forged task actually looks like



Here's the whole thing as a template. Steal it.




title: Fix JWT expiry config in auth service

input:
- src/auth/config.ts (current expiry: 1h)
- src/middleware/auth.ts
- DO NOT touch src/routes/public.ts

output:
- src/auth/config.ts with expiry: 24h
- tests passing in src/auth/config.test.ts

subtasks:
1. Update expiry value in config.ts
2. Update unit tests
3. Verify it doesn't break the middleware






And the 30-second check before you hit play on anything:



F — Title has 2+ words and is specific?

O — Did you define the exact deliverable?

R — Did you declare every input?

G — Between 2 and 5 subtasks?

E — Did you check NOTES.md for known errors?



All five checks pass, go. If any one is a "no," rewrite first. It costs you thirty seconds. Skipping it cost me $800.






This isn't theory I'm selling



The reason I trust these five rules is that everything I build runs on them. MC-MONKEYS and MC-Taski both execute on the Forge Method — it's not an add-on, it's the reason they work.



In the next post I'll show you exactly how: how my agency of 8 agents and Lucy, my Chief of Operations, have the Forge Rules baked into the way they work, so a badly-formed task gets rejected before it burns a single token.



That's Post #3. See you there.



— Billy









About MC-STUDIO



I'm Billy — I build digital tools for people who'd rather prompt than read the docs. Everything I make lives under MC-Studio.

Come hang out: mc-studio.ar



My products so far:

🐵** MC-MONKEYS** — a virtual agency of 8 specialist AI agents that work together on Claude Code, coordinated by Lucy (my Chief of Operations) and ruled by the Forge Method → mc-studio.ar/products/mc-monkeys

⚡** MC-Taski **— automate your fixes with Claude Code. Type, hit play, grab a coffee → mc-studio.ar/products/mc-taski



I share the process in real time — wins, mistakes, and zero hype:

📸** Instagram:** @mc.studio.ai

🐦 X / Twitter: @billymcmonkeys



I write about AI agents, the Forge Method, and building with Claude Code. Follow me on dev.to to catch the next post in this series.

Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten What is the Forge Method? Five rules so your agents stop improvising.

Thematisch verwandte Begriffe: What, Forge, Method, Five · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-94036 | A security flaw has been discovered in D-Link DIR-X1860 and DIR-X1860Z u…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick