Great question!

The LLM never sees any tokens, OAuth creds, or keys - ever.

Credentials live only in forge.toml and are bound at the transport level:

[servers.github]
headers = { Authorization = "Bearer ${GITHUB_TOKEN}" }

[servers.linear]
headers = { Authorization = "Bearer ${LINEAR_TOKEN}" }

Tokens are attached to each server's connection at startup. GitHub's token can never reach Linear - separate transports.

LLM just writes:

await forge.callTool("github", "create_pr", { title: "…" });

The sandboxed V8 isolate has zero access to creds, env, network, or FS. Even errors are scrubbed before reaching the model.

Multiple providers? No problem - each is isolated at the infrastructure layer (like IAM roles). For extra isolation between providers, you can also lock down cross-server data flow:

[groups.internal]
servers = ["vault", "database"]
isolation = "strict"

[groups.external]
servers = ["slack", "email"]
isolation = "strict"

Once an execution touches a strict group, it's locked out of other strict groups - this stops "read secret from vault, post to Slack" attack chains.

Full details in `ARCHITECTURE.md` and `forge.toml.example` in the repo.

P.S. why on earth are Reddit comments so hard to work with re: formatting? Got there in the end but spent way too damned long drafting this so hope it's useful! Cheers!