⚒️ Grok Forge — the unofficial Grok app for VS Code

Forge whatever you decide you want to make. Images through Imagine. Code through Grok Build. All from friendly chat tabs in VS Code — running on your own Grok subscription, with the terminal kept completely out of sight.

Unofficial. Grok Forge is a community project and is not affiliated with, endorsed by, or supported by xAI. "Grok" is a trademark of xAI. This extension is simply a friendly window onto the official Grok Build CLI that you install and sign into yourself.

🆕 What's new in 1.7 — "Fewer Cards"

Search inside your past chats. Type in History and Forge finds chats by what was said in them, not just their titles, with a short preview of the match. The search runs on your Mac; nothing is sent anywhere.

Saved prompts. Keep the prompts you type often at the top of the / menu. Picking one puts its text in the message box for you to edit and send. It is never sent on its own. Add, edit and remove them from Saved prompts… in the same menu. Every chat sees the same list.

"Don't ask again" is back on MCP tool and website cards. The card says exactly what it covers, for example one tool from one MCP server, or one website and its subdomains, in this folder. A different server using the same name asks again. So does a permission planted by hand, and every one is listed with a Clear button.

Servers Grok left running. When a chat ends (you close its tab, or a parked chat finishes), Forge looks for servers Grok left running in your project and asks before stopping each one. If you quit VS Code, it asks at the next start. It only guesses at listening servers it can tie to one of the chat's turns, and it never stops anything you didn't click. A detached program that isn't a server, one that detaches into its own session, and anything an MCP server starts are not found.

Credential files, one step further. Grok's shell can no longer read .netrc, cloud credentials files and similar names at all. A command that names .env, .envrc, .npmrc or .yarnrc is refused with the reason. A dev server Grok starts still loads your .env as usual. This check works by what a command says, so a program that opens one of those files without naming it can still read it.

Your sign-in can't be swapped mid-chat. If Forge's Grok sign-in changes to a different xAI account while a chat is running, that chat stops at once and shows the sign-in screen with the reason. (1.6.2 caught it only at the next chat or mic use.)

🆕 What's new in 1.6 — "Forge's Own Home"

Grok in Forge has a home of its own. Forge chats run Grok in a private folder with its own sign-in, so Grok in a chat can no longer change your terminal Grok's rules, skills, plugins, login or Grok itself. Your rules, skills and workflows still come along — and you can pick which rules Forge loads.

Talk instead of type. Click the 🎤 in the message box, speak, click again — your words land in the box to edit and send. It runs on your grok sign-in (no API key); your voice goes to xAI to become text.

Images get their own conversation. Imagine beside opens a separate image chat next to yours — its own context and its own budget, so iterating on pictures never fills your code chat. Its pictures still show in your chat's gallery, and Use in chat brings one over.

Calmer approvals, on a dial. The new Ask level lets read-only checks inside your project run without a card (each one labelled), while deleting, the internet, credential files and paid generations always ask. Allow for this chat covers one website for the rest of that chat, and every "don't ask again" is listed with a Clear button.

Small things that add up. Undo just the conversation and keep your files · a token budget for /goal · a context meter that moves during long turns · what each request cost, one click away · plan revision notes · a Workflows catalog · images from an undone turn stay reachable.

🆕 What's new in 1.5 — "Longer Media"

Make longer videos. Extend a clip from its last frame, again and again, up to 30 seconds — joined into one video in the gallery. Big screenshots and photos are shrunk before they're sent, so they arrive instead of failing.

The gallery sits beside the chat. Open it next to the conversation and keep working: everything you do in the gallery continues the same chat. Prefer it full-size? One setting.

See your app while Grok builds it. The new Preview button opens your running app in VS Code's own browser, beside the chat. If you want Grok to look too, turn on "Grok can see the preview" and share the page — through the preview tools, Grok can then read and screenshot only the pages you shared. It's off until you turn it on, and VS Code asks you to confirm.

Know what a chat used. Each chat shows its tokens and how long it's been going. Curious about the money? Click the $ — it shows what xAI's meter recorded for the chat's model calls (image and video generations aren't included, and your plan may count it differently).

Switch Ask first ⇄ Auto-approve without restarting. The switch now takes effect at Grok's very next request, and a workflow that's running keeps running.

Grok's background commands are on screen. A dev server or watcher Grok started shows in its own strip with a Stop — and closing the chat stops them too.

Safer by default.

• Paid image and video generations are counted per chat; past your budget (50 by default) Forge asks before each one, even in Auto-approve.
• Terminal-only commands like /usage are answered by Forge instead of being sent to the model.
• A closed chat that's still working can't get anything approved until you reopen it.

🆕 What's new in 1.4 — "Steer the Agents"

Steer Grok's helpers while they work. When Grok splits a job across helper agents, each one now has its own line with what it is doing right now, a Stop that stops that one alone, and a Message that sends it a new instruction, or wakes it again after it finished. Reopen the chat and each helper's history and ending are still there. Watched against real Grok: the stopped one stayed stopped, its sibling finished, and the messaged one acted on the message.

Workflows and goals run in the chat. /workflow <name> launches one, with Pause, Resume and Stop on a run strip that shows Grok's own status, and the result arrives as a labelled turn instead of vanishing. A goal Grok is working toward shows on the same strip. ↩ Undo on any of your messages puts both your files and the conversation back, after showing you what will change. /compact works from the chat. And writing a message is easier than ever: clearing it, getting it back, and opening the / menu without losing your draft.

What you pick is what runs. On grok 1.0.41 the model and effort pickers were being overridden at startup, so every chat ran on the same model whatever the chip said. Fixed, and if Grok refuses a choice, Forge says so. The context meter now shows how full the chat is, not what a turn spent.

Security, tightened and stated. Your home folder's credential stores are now actually denied (they were only denied inside the project). Grok's file tools can no longer save notes outside your project without a card, and a shell command that names Grok's own folder (its memory, rules, skills, plugins, the program itself) asks first even in Auto-approve. Typing /always-approve no longer switches approvals off behind a selector that says "Ask first". A plugin's MCP servers can be switched off one at a time. What is still open, including what those cards cannot see, is listed in the changelog and SECURITY.md rather than left for you to find.

🆕 What's new in 1.3 — "Say It Once"

Plan mode plans, and Accept means accept. Picking Plan on a chat that was already running could leave Grok in its normal mode — Forge blocked the edit, but no plan ever arrived. And when a plan did arrive, Forge had already answered it with "the user wants to revise", so Grok asked what to change right above the Approve button. Both are fixed: your click is now Grok's answer, and Accept starts the build in the same turn — watched working in a real editor.

Forge says each thing once. The transcript stops filling with connection notices and cleanup receipts. The Ask-first and Plan disclosures come from one source and sit in one banner for the mode you are actually in, instead of a stack of amber boxes that included one for a mode you had already left. The part of each disclosure that admits what Forge cannot see is no longer the part that gets cut off.

A new MCP server can be approved. Vet & approve on a never-approved server did nothing at all; it now vets and approves. The Plugins & MCP panel no longer shows disabled plugins as live, and a plugin's server row says exactly what Forge can do about it: disable the whole plugin, not that one server.

Your X-High effort setting is kept when Forge can't identify the model, instead of being dropped with an explanation that wasn't true. Agent lanes keep their real names when Grok runs a helper in the foreground — those used to stay labelled "Subagent 1". And a plan left waiting 30 minutes says it expired instead of leaving an Accept button that looked live.

Still true, still stated: Grok's own shell can read files Forge refuses, Ask first does not mean every command asks, and MCP servers are refused only your credential stores. The changelog lists these rather than leaving them for you to find.

🆕 What's new in 1.2 — "Nothing Disappears"

Deleting a chat asks first, and can be undone. Every row in Recent used to carry a delete button that was invisible until you hovered, sat inside the row you click to open the chat, and destroyed it on a single click — no confirmation, no undo, no trash. It ate a real transcript mid-session, which is how it was found. The button is now visible at rest, the first click asks and names the chat it will destroy, and deleted chats stay recoverable for 30 days with an Undo offered the moment one goes.

A step you refused stops looking like a crash. Expanding a turn marked blocked showed a red ✗ beside the step you had just declined — reporting your own decision back to you as a failure. It now shows a muted ⊘ that matches the badge above it. A genuine failure keeps its red ✗.

Plan mode's disclosure fits on the screen, and is accurate. The part that admits Grok auto-runs some commands Forge never sees was being clipped mid-sentence, so you read the promise and none of the exception. It now sits in a banner that wraps and cannot be missed — and it no longer says "directory-level", because a bare touch creates a file and never reaches Forge either.

A missing file is reported as a missing file. A failed read used to say "that folder wasn't found" and blame a tool that never ran.

Eight defects, six of them found by a person using the product rather than by the 2,007 unit and 614 browser tests — including two inside the fix for the first one. The changelog says which, and why the tests missed them.

🆕 What's new in 1.1 — "See It Work"

Turn a generated sprite into a transparent PNG. Ask for game art in one of the 2D modes and the lightbox offers Remove background — it previews the result on a checkerboard so you can actually judge it, then Rename / Add to assets/ writes it into your project with a row in ASSETS.md. Nothing reaches disk until you have seen it and named it, and a name that is already taken gains -2 rather than overwriting what was there.

The keyer cuts a matte, not a hole. Anti-aliased and JPEG-compressed edges used to survive as a bright ring of key colour around the sprite — measured at 14.7% of the visible subject on a real generated sprite. Forge now recovers how much of each edge pixel is background and unmixes the key back out, taking that to 1.94% with ~30,000 genuinely soft edge pixels where there were none.

See what each subagent actually said. Run two agents in parallel and every lane gets a toggle that opens onto its own words — its reasoning, its tool calls and what it wrote — instead of a step count.

Plan mode says what it actually does. It now names exactly what it blocks (file edits and content-writing shell commands), names the exception it cannot see (simple shell commands that create files and folders — touch, mkdir — run without asking Forge), and tells you "Grok hasn't proposed a plan yet" when that is the actual reason, instead of pointing you at a plan that does not exist.

Limits worth knowing before you install. An MCP server's question now renders and answers, and agent lane transcripts now survive reopening a chat — both were limits here in 1.1 and both were fixed and verified in a real editor. What remains: a required field on an MCP question will still accept an empty answer, and Plan mode has a second gate inside Grok that refuses edits without explaining itself. Both are written up in the changelog rather than left for you to discover — as is the larger one, that Grok auto-runs some simple commands Forge never sees at all.

🆕 What's new in 0.9 — "Parity II"

Plan mode — read the plan before Grok edits your files. A Plan pill in the chat title bar flips Grok into planning: it investigates your code and writes up what it intends to do instead of doing it. The plan arrives as a card you can actually read, and Forge blocks file edits and content-writing shell commands until you approve it — then Grok switches back and carries it out. Reading and searching still work, so Grok can research first. Toggle it mid-conversation for the one risky change and come straight back out. Connect your own tools (MCP) with the new Manage MCP Servers command — Forge connects to each server itself first, reads back every tool it offers, and shows you the list to approve; a server you add reaches Grok only once you approve it, and if it later changes its tools the approval is void. (A Grok plugin can also bring its own MCP server, which bypasses that flow entirely — the Plugins & MCP panel shows you those and says so.) Grok reads your AGENTS.md project rules, and a live activity panel shows the tools it's running as it runs them, so a long turn is no longer a blank wait. Plus a security pass: hidden characters are stripped from what Grok reads, permission cards show the verbatim command, destructive commands stay carded even on auto-approve, and a per-turn tool-call brake stops runaway loops. Full details on the Changelog tab.

🆕 What's new in 0.8 — "Checkpoints & Speed"

Checkpoints — a safety net for letting Grok edit. Every message you send now snapshots your project first. A clock button in the chat title bar lists every turn; click one and your files roll back to exactly how they were before it — an edit undone, a deleted file restored, a file Grok created removed. It reverts files only (your conversation with Grok stays exactly as it is) and never touches your own Git history or your .gitignored secrets. @-mention files too: type @ in the message box to filter your project's files and attach one as context, so "explain @thing.ts" just works — with secrets never shown or attachable. Plus a faster first message (Grok warms up in the background while you read and type) and a smaller install. Full details on the Changelog tab.

🆕 What's new in 0.7.5 — "Polish"

A bigger, cleaner media viewer. Open a tall image or clip in a wide window and the viewer now splits into three columns — actions on the left, the media centred and filling the full height, caption and Refine on the right — instead of a narrow strip with wide black margins. The clip gets about two-thirds more area, the description shows in full, and it flips back to the familiar stacked layout on narrow panels automatically as you resize. Plus a history button in the chat title bar to jump straight to any past conversation, a Stop button that stays reachable from inside the viewer, and a round of security hardening — Grok no longer inherits your whole environment (including your SSH agent). Full details on the Changelog tab.

🆕 What's new in 0.7

Video. Every generated image now carries a ▶ badge — click it, pick 6 or 10 seconds, and watch the video appear right where you're looking: a spinner with a live second-count runs on the image itself, then the finished clip replaces it in place. Nothing closes, nothing kicks you back to the chat, and the conversation stays clean — no repeated photos, no restated requests. Open a clip and describe the motion in plain English ("camera cranes up", "360° orbit") to re-animate it, or use the ✨ Suggestions picker (Camera · Lighting · Mood · Style) in either composer. A photo and everything made from it now share one gallery tile: the grid shows the newest version, ‹ › flips across tiles and ↑ ↓ walks a tile's history back to the original.

0.7 also ships a security hardening pass: credential files (~/.ssh/id_rsa, .aws/credentials, .netrc, .npmrc, .env*) are refused for reads and writes, and Grok's file tools write only inside your project folder — with no folder open it works in a private contained folder instead of your entire home directory. Every file action is re-checked before it runs.

Security, stated plainly. Grok Forge runs a real coding agent on your machine — that is the point of it — and it is the only way to run Grok Build with an OS-level sandbox in front of it. Forge launches Grok under a kernel profile that denies ~/.ssh, ~/.aws, ~/.azure, ~/.gnupg, gcloud and kube outright. Run grok yourself in a terminal and nothing does that.

Correction (1.4). Until 1.4, that rule held only inside your project folder. On grok 1.0.41 we measured Grok's shell and an MCP server both reading a decoy in your real ~/.azure, and our own check had been passing because its decoy sat inside the project. 1.4 names your home folder's credential stores directly, and we watched the kernel refuse both of them. One consequence to know about: Grok's shell inside Forge cannot use your SSH keys or cloud CLI credentials (git push over SSH, aws, gcloud, az, kubectl). Your own terminal is unaffected.

Correction (1.4) — Grok's memory. The 0.7 line above says Grok's file tools write only inside your project folder. On grok 1.0.41 that stopped being true: with xAI's Memory v2 switched on (by xAI's remote setting, not by you), Grok saves notes about your project with its own file tools into ~/.grok/memory-v2/, outside your project, and later chats are told to read them first. Grok writes those files itself, so Forge's re-check never saw them. We measured a note landing even with every card denied. From 1.4, every write by Grok's file tools outside your project raises a card, in Ask and in Auto-approve, naming the place ("grok's memory, outside your project"), the file, and what would be written. That card offers Yes once or No, never "allow all edits during this session". Say yes and "remember this" still works. Writes inside your project, and Grok's own plan file, are unchanged.

Correction (1.4) — Grok's own folder. Grok's shell can write almost all of ~/.grok: its memory, its rules (loaded into every chat), skills, plugins, workflows, even the Grok program. Only its hooks, config.toml and sandbox.toml are protected, and Forge cannot add more at the OS level: Grok's sandbox binds Grok's own process, so a rule that stops the shell stops Grok too (measured on grok 1.0.41). What 1.4 adds is a card, in every mode, for a shell command that names one of those places, saying which one, with no "don't ask again" option. It reads the words of the command, so it is a warning, not a wall: a program Grok runs can still write there without naming it. Grok's shell can also read its own login token, and Grok runs that read without asking, so no card can appear for it. A fix for both is planned with 1.5.

We would rather tell you where it stops. All three are open, all three are upstream, and all three were re-verified against grok 1.0.13 on 2026-08-29 rather than assumed:

• The approval card gates a path, not an intention. Deny a write and Grok may reach the same goal through its shell a second later. We have watched exactly that, in ordinary use, land in /tmp — outside your project. The sandbox holds the line at your home directory and your credentials. It does not hold it at your project folder, and we will not pretend otherwise.
• "Ask first" does not mean everything asks. Grok keeps its own list of commands it runs without showing a card, and Forge does not control that list. On grok 1.0.13 we watched it create a directory and a file unasked — one of them in /tmp, outside the project folder. The sandbox permits temp by design; what is missing is the question. Every command is still written to Forge's Grok Forge — Security output channel — a record after the fact, not a gate. It is the only handle we have here. The list is upstream and moves between releases, so we describe its shape rather than publish a roster that will go stale.
• An MCP server is contained by almost nothing. Approving one in Forge means a person read its tool descriptions — that is all it has ever meant. Since 1.4 the kernel refuses a server the same credential stores it refuses the shell (watched on grok 1.0.41). That is the whole of it: anything else you can read, a server can read. Servers that arrive inside a plugin never reach our approval flow at all, and the Plugins & MCP panel exists to show you those by name.

We publish what we have measured, including the parts that make us look worse. A tool that hides its own holes is a tool you cannot calibrate against.

Full detail, measured against this build rather than assumed: docs/SECURITY.md.

What you get

• 💬 Multi-chat in real editor tabs — the anvil icon opens a sidebar hub; start a new chat or reopen a past one and it opens as its own editor tab. Live streaming responses, a model picker, and a chat · plan · build · imagine cue so you always know what Grok is set up to do.
• 🗂️ Local chat history — conversations are saved on your machine; reopen or delete them from the sidebar hub. Nothing leaves your device.
• 🎨 A real image workflow — ask Grok to imagine something and results arrive as compact cards. Click an image to expand it with its exact generation prompt beneath it and ‹ › arrows to flip through the batch; refine the one you're viewing from right there. Each card opens its own per-batch gallery. Right-click any image for Copy / Save As… / Open / Show in Finder / Save to assets/ (with optional ASSETS.md logging for license tracking). Images are detected from disk, so it works no matter how Grok phrases its output.
• 📎 Attach & paste — attach files to a message, @-mention a workspace file to filter and attach it inline, paste a screenshot straight from the clipboard, and click any image to expand it in a lightbox.
• ↩️ Checkpoints — every turn snapshots your project, so you can rewind your files to before any message with one click. Files only — your conversation stays put, and your own Git history and .gitignored secrets are never touched.
• 📋 Plan mode — flip the Plan pill and Grok proposes an approvable plan first. Forge blocks file edits and content-writing shell commands until you approve the plan. Reading and searching still work. Approve and it executes; toggle back out whenever you like. One limit, stated plainly: Grok auto-runs some simple shell commands without asking Forge — including ones that create files and folders, like touch and mkdir — so those are not covered.
• 🔌 Your own tools via MCP — add MCP servers from Manage MCP Servers. Forge vets each one itself and shows you every tool before it approves, and a server that changes its tools has to ask again.
• 📐 Project rules — Grok picks up your AGENTS.md house rules automatically; the Project Rules (AGENTS.md) command will scaffold one if you don't have it.
• ⏱️ Never looks frozen — a live "Grok is working… Ns" timer that settles into "took Ns" when the turn finishes.
• 🔐 Your subscription, your machine — everything runs through the official Grok Build CLI locally. No keys to paste, no third-party servers in between.
• 🛡️ Real permission prompts — when Grok wants to act, you get big Allow/Deny buttons (or flip on auto-approve in settings if you like to live fast).
• ♿ Accessibility-first — large click targets, high contrast, a one-click mic button, zero drag-and-drop, zero required keyboard shortcuts. Designed from day one for single-click (including BCI) use.

Getting started

1. Install this extension.
2. Click the ⚒️ anvil icon in the activity bar.
3. No Grok Build CLI yet? The welcome screen installs it for you — one button runs the official installer (curl -fsSL https://x.ai/cli/install.sh | bash), another runs grok login so you can sign in with your subscription.
4. Click New chat in the hub — it opens as an editor tab. Chat, imagine, forge.

Settings

How it works

Grok Forge speaks the Agent Client Protocol (ACP) to a persistent grok agent stdio session — the same architecture the official Claude Code and Zed integrations use to talk to their CLIs. The extension is a thin, friendly cockpit; the CLI does the flying.

License

MIT. Not affiliated with xAI — see the disclaimer above.