create-fullstack-app

A CLI tool for scaffolding a full-stack web application with your choice of frontend and backend technologies. The generated projects use npm ci and pinned Python dependencies to ensure fully deterministic and reproducible installations.

Prerequisites

Before running the CLI or the scaffolded applications, ensure you have the following installed on your system:

• Node.js: v20 or newer
• npm: v10 or newer
• Python: The newest stable release (only required for FastAPI / Flask backends. We frequently update frameworks to their latest versions, so using older Pythons may cause pip install errors)
• .NET 9 SDK (only required for the .NET backend — the CLI will offer to install it automatically on macOS/Linux if not found)

Quickstart

To generate a new full-stack application, simply run:

npx @adriankulik/create-fullstack-app@latest

(If you are developing locally, run npm install in the root directory and execute node cli/index.js).

You will be prompted to choose a project name, your preferred frontend, and backend framework.

Features

• Frontend Options:
  • Next.js (v16.4.3)
  • Angular (v22.2.3) - Configured with Zone.js
  • Vue (v3.5.44)
  • Svelte (v5.57.2)
• Backend Options:
  • FastAPI (v0.141.1)
  • Flask (v3.1.3)
  • .NET (v10.0.13)
  • Node.js Express (v5.3.0)
• Database: PostgreSQL (v15) configured via docker-compose. Tooling includes:
  • Migrations: Alembic (v1.20.1), SQLAlchemy (v2.1.6), and Psycopg2 (v2.9.13) are used universally for database migrations across all frameworks.
  • Drivers: FastAPI/Flask use SQLAlchemy/Psycopg2, Node.js Express uses pg (v8.23.0), and .NET uses Npgsql (v10.0.3).
• Opinionated Defaults: We bake in sensible, predefined choices (e.g., Angular uses zone.js, testing is unified under Playwright and framework-native test runners).
• Fullstack Containerization: Every frontend and backend framework includes an optimized, production-ready Dockerfile. Orchestrate the entire three-tier architecture (frontend, backend, database + migrations) via Docker Compose (./start.sh or docker compose up --build).
• Self-Contained AI Sandbox: Run autonomous coding agents (Antigravity, Claude Code, OpenCode) in a strictly isolated container (./sandbox.sh or .devcontainer/). Host filesystem outside /workspace is completely inaccessible.
• Secret Leak Prevention: Developer secrets in .env.local or .env.secrets are masked with empty mounts inside the container, preventing the AI from reading them.
• Pipelock AI Firewall & MCP Sentinel: Integrated Pipelock proxy scans outbound AI traffic with 65+ DLP patterns, prevents secret exfiltration, blocks SSRF against cloud metadata, validates MCP tool calls, and generates verifiable signed audit receipts.
• Unified Scripts: start.sh, sandbox.sh, test.sh, and lint.sh available out of the box to manage both frontend and backend seamlessly.
• CI/CD Ready: Includes a pre-configured .github/workflows/cli-e2e.yml that tests both ends. Tip: To enforce this, enable branch protection in your GitHub repository settings and require the "test" status check to pass.
• Developer Experience: Includes .vscode/extensions.json recommending the necessary linters and formatters, and an AGENTS.md file providing behavioral guidelines for AI agents. It is AI development friendly, including an extensive set of agent skills in .agents/skills.

Generated Project

The generated application will look like this:

my-app/
├── .github/
├── .vscode/
├── backend/
│   ├── main.py
│   ├── test_main.py
│   └── requirements.txt
├── frontend/
│   ├── app/ (or src/)
│   └── package.json
├── start.sh
├── test.sh
└── lint.sh

_Note: Depending on your environment, you may need to ensure the generated shell scripts are executable by running chmod +x *.sh inside your new project directory.\

Local E2E Testing

You can automatically test all frontend and backend permutations locally via Playwright integration tests using the provided script in the root directory.

Ensure you make the script executable first:

chmod +x run_e2e.sh

Then run it:

./run_e2e.sh

Note for Windows Users: The run_e2e.sh script utilizes Unix commands (like lsof and kill -9) for process teardown. You must run this script inside a WSL (Windows Subsystem for Linux) or Git Bash terminal.

Roadmap

Future plans for this CLI include:

• Adding frontend framework-specific component libraries during the scaffold step.
• Spring Boot backend support (Java, enterprise-ready framework).
• Rust (Rocket) backend support (web framework for Rust with focus on ease of use).

Acknowledgements

This project redistributes boilerplate code and configuration files generated by the official CLIs and templates of the integrated frameworks. I'm grateful to the maintainers of these projects:

• Next.js (MIT License)
• Angular (MIT License)
• Vue.js (MIT License)
• Svelte (MIT License)
• FastAPI (MIT License)
• Flask (BSD 3-Clause License)
• .NET (MIT License)
• Express (MIT License)
• PostgreSQL (PostgreSQL License)
• Alembic (MIT License)
• SQLAlchemy (MIT License)
• Psycopg2 (LGPL with exceptions)
• node-postgres (pg) (MIT License)
• Npgsql (PostgreSQL License)
• Docker (Apache License 2.0)
• Pipelock (Apache License Version 2.0, January 2004)

References

• Shields.io
• andrej-karpathy-skills
• claude-skills