Anyone can register an app with Forge, and an app can give itself any name, even Forge's own name or the name of a tool you use. So Forge's sign-in page never trusts a name alone, and neither should you.
The one habit that protects you
Start every connection from inside your own AI tool or app. Never start one from a link somebody sent you, by email, text or chat, however official it looks.
Then, before you choose Allow read access, check two things on Forge's page:
- The address bar shows
app.forge.equipment. A page anywhere else is not Forge. - The line "After you choose, you'll go back to" names where you expect to return: the tool you started from, or "an app on this computer" for an app installed on your computer.
If anything looks wrong, choose Cancel. Nothing is shared.
Where the connection returns to
The page always shows where a connection returns to, as the main part of that web address, or "an app on this computer". That is what gives a fake away, because an app can call itself anything but cannot return you somewhere it does not control.
Verified and unverified apps
Forge keeps a list of apps it has checked. Each entry is an app's name and the exact addresses it returns to. When every address an app returns to matches an entry, the page shows the checked name with no warning, whatever name the app registered with.
Every other app shows "Unverified app. Forge has not checked this app. Only continue if you started this connection yourself." Unverified does not mean harmful. It means Forge has not checked it, so the habit above is what protects you.
Look-alike names are refused
An app Forge has not verified cannot register a name that is, or contains, the name of a verified app, or the word Forge. Capital letters and look-alike characters do not get around it. So an app on Forge's page that calls itself Forge, or a close copy of a tool you know, has been refused at registration, and the page you see is not what it claims.