Skillget

basilic

agent
Security Audit
Warn
Health Pass
  • License — License: MIT
  • Description — Repository has a description
  • Active repo — Last push 0 days ago
  • Community trust — 89 GitHub stars
Code Warn
  • process.env — Environment variable access in .agents/skills/drizzle-orm-v0/templates/db.ts
Permissions Pass
  • Permissions — No dangerous permissions requested

No AI report is available for this listing yet.

SUMMARY

Full-Stack API-First Agentic TypeScript Starter

README.md

Basilic: API-First AI TypeScript FullStack Starter

Typed SDKs, self-hosted auth, a portable architecture, a shared AGENTS.md agent contract, and a thin web demo. Fastify • OpenAPI • Next.js • Expo scaffold — one stack, multiple clients.

MIT licensed. Start a product with npx create-basilic@latest my-app (independent history; no docu app; no generator). Fork this repo to contribute. First successful use is Product Ready (pnpm setup, db:start, pnpm reset, pnpm dev, [email protected]). After you own the copy: After fork.

Features

  • 🤖 AI-first skills — AGENTS.md, mattpocock/skills (/grill-me /implement /tdd), Basilic /w-* as a lightweight alternative, and CodeRabbit. Any coding agent or IDE that can read those files.
  • 🔌 REST API & JWT — OpenAPI spec, Swagger UI, JWT and API key auth for all clients
  • 📦 SDK generation — Type-safe clients from OpenAPI via HeyAPI
  • 🧩 Web + API starters — Next.js demo, React hooks, Expo UI scaffold, Fastify API (not a wallet or OpenAI template)
  • 🔓 Zero vendor lock-in — Shipped path is Vercel + Supabase; ordinary Node/HTTP/Postgres elsewhere
  • 🎨 Turbo monorepo + design system — ShadcnUI components with shared utilities
  • ⚙️ Preconfigured dev tools — Biome, Git workflows, hooks, and security checks
  • 🛡️ Security & quality — Automated checks in CI (Gitleaks, OSV, DeepSec)
  • ⛓️ Multichain (API) — EVM and Solana SIWE/SIWS on Fastify; shared @repo/utils/web3 helpers — not a web wallet demo
  • 📐 Conventions — AGENTS.md, glob Cursor rules as adapters, @repo/error, Pino logging, shared TS and style
  • 🧑‍💻 TypeScript-first — End-to-end types from database to frontend

Technology stack

  • AI (in-app): AI SDK — Anthropic, OpenRouter, Ollama (no first-class OpenAI SDK)
  • Frontend: Next.js 16, React 19, Tailwind, ShadcnUI
  • Backend: Fastify, PostgreSQL, Supabase
  • Web3: Fastify SIWE/SIWS + @repo/utils/web3 helpers. No Wagmi and no wallet UI in apps/web
  • DevOps: Node.js 24.x (LTS Krypton), pnpm, TurboRepo, TypeScript, Biome, ESLint

Apps

  • API — Type-safe REST API built with Fastify & OpenAPI
  • Web App — Next.js app with monorepo integration
  • Mobile App — Expo UI scaffold (shared @repo/ui; not an API client yet)
  • Documentation — Fumadocs site (architecture, ADRs, development)

Packages

  • @repo/core — Runtime-agnostic API client and types generated from OpenAPI specs
  • @repo/cli — TypeScript CLI for API (API key auth; ideal for agentic integrations)
  • @repo/react — React Query hooks for @repo/core API functions
  • @repo/ui — Shared UI component library (Shadcn/ui, Tailwind)
  • @repo/utils — Shared utilities (async, data, debug, error, logger, web3)
  • @repo/error — Error reporting and utilities (captureError, getErrorMessage)
  • @repo/email — Email template library built with React Email

Scripts

Run with pnpm <script>.

Setup

  • setup — Full setup (install, hooks, agent skills from mattpocock/skills plus basilic-skills /w-*, gitleaks, osv, env templates, database, deepsec, Playwright Chromium)
  • setup:skills — Install Matt pack + /w-* playbooks into .agents/skills/ (restores skills-lock.json)
  • setup:gitleaks, setup:osv — Install Gitleaks, OSV scanner
  • setup:playwright — Install Playwright Chromium for API and web E2E
  • setup:env — Copy .env.<qualifier>.example templates to dest files when missing
  • setup:database — Database tools (Docker, Supabase CLI)
  • setup:deepsec — Install DeepSec workspace (.deepsec/)
  • reset — Local API database: Supabase reset + Drizzle migrations + seed (pnpm --filter @repo/api reset). See apps/api/README.md

Primary

  • build — Build packages and apps
  • dev — Start dev (core, react, error, utils, api, web)
  • qa — Full check: install (if needed) → checktypes → lint → OpenAPI drift → build → test:scripts → test (unit) → test:e2e (Fastify + Next, SKIP_BUILD=1)
    Format / Lint
  • checktypes — Type-check all packages
  • format — Format code (Biome)
  • lint — Lint with Biome + ESLint
  • lint:biome, lint:biome:fix — Biome check, fix
  • lint:eslint, lint:eslint:fix — ESLint check, fix
  • lint:fix — Fix both linters
    Test
  • test — Run unit tests (packages + apps)
  • test:e2e — E2E (Fastify + Next)
    CI
  • Lint and security.yml run on every PR. DeepSec reviews the PR diff on same-repo PRs from OWNER, MEMBER, or COLLABORATOR (deepsec.yml). App E2E (web-e2e, api-e2e) and package tests (packages-test) run only when relevant code changes. Mobile: EAS build, preview on main, PR OTA—see GitHub Actions and Mobile CI/CD.
    Security
  • security:block-files — Block sensitive file patterns
  • security:secrets — Scan staged files for secrets
  • security:secrets:full — Full Gitleaks scan
  • security:osv — OSV vulnerability scan
  • security:audit — pnpm audit (high+; registry errors ignored)
  • security:check — Run security check script
  • security:deepsec:scan — DeepSec regex scan (no AI)
  • security:deepsec:process:diff — DeepSec AI review vs origin/main (GPT-5.6 Sol)
  • security:deepsec:process:diff:grok — Same review with Cursor Grok 4.6
  • security:deepsec:process — DeepSec full-repo AI review (GPT-5.6 Sol)
  • security:deepsec:report — DeepSec findings summary
    Hooks
  • hooks:pre-commit — Pre-commit: security + Biome staged
  • hooks:security — Block files, scan secrets, OSV
    Misc
  • update-deps — Update pnpm via Corepack and all dependencies

Documentation

Full docs: basilic-docs.vercel.app

Reviews (0)

No results found