web4-node-starter-kit
Health Pass
- License — License: MIT
- Description — Repository has a description
- Active repo — Last push 0 days ago
- Community trust — 60 GitHub stars
Code Fail
- exec() — Shell command execution in .claude/hooks/context-lib.mjs
- process.env — Environment variable access in .claude/hooks/context-lib.mjs
- network request — Outbound network request in .claude/skills/ai-elements/scripts/audio-player.tsx
Permissions Pass
- Permissions — No dangerous permissions requested
This self-hosted, open-source web application provides a browser-based workspace to run multiple AI coding agents (like Claude Code and Gemini CLI) in parallel. It includes built-in authentication, database management, and local S3 storage so developers can keep their code and data on their own private servers.
Security Assessment
The overall risk is rated as Medium. The project does not request dangerous system permissions and no hardcoded secrets were found. However, the automated scan flagged several areas requiring attention. Client-side components make outbound network requests, which is expected for an application communicating with external AI APIs, but developers should verify these connections are secure. Environment variables are accessed directly in the frontend code, meaning you must be careful not to expose sensitive API keys or credentials. As a tool that executes AI agents, it inherently involves shell interactions, so proper configuration of the self-hosted environment is critical to prevent unauthorized access.
Quality Assessment
The project appears to be actively maintained, with its last code push occurring today. The README mentions an MIT license, though the automated scanner failed to detect a formal license file in the repository, which is a minor administrative concern. The biggest drawback is its extremely low community visibility; having only 5 GitHub stars means the codebase has not undergone broad peer review, making it difficult to gauge real-world reliability and trust.
Verdict
Use with caution — the tool offers promising functionality for private AI development, but its lack of community oversight and client-side environment variable handling require you to perform a manual code review before exposing it to sensitive projects.
Deploys your OS, databases, and SSL on your VPS in just 10 minutes. Orchestrates a team of AI agents for coding, marketing, and sales. The built-in optimizer saves up to 90% on token costs, letting you build and manage your online business directly through chat. Fully open-source.
Fractera WEB4 — your own AI node on your own computer
This repository is a whole node: your site, sign-in, data and an agent for every part of it, running on a computer you own.
A person gets it by forking this repository and asking an AI coding agent (Claude Code) to launch it.
If you are a person and want to launch this project
You need a GitHub account, a computer that stays on, and Claude Code CLI — the claude command in a terminal (Pro plan or
higher). Install it with one line from code.claude.com/docs/en/setup: curl -fsSL https://claude.ai/install.sh | bash on macOS
and Linux, irm https://claude.ai/install.ps1 | iex in Windows PowerShell. The node's agents run in the CLI, so the node needs
it on the machine either way: started from any other agent, the install puts the CLI in by itself.
🔒 Claude Code must run on YOUR computer: claude in a terminal on this machine. A cloud session (claude.ai/code, the Code
tab of the mobile app, a cloud environment of any agent) installs the node into a temporary machine that disappears with the
session — the install refuses there.
🔒 One node per computer. A second copy is never needed: one node carries many sites and applications inside it — WEB4
ITEMS, created with «Create WEB4 ITEM» — as many as the computer can carry. The install refuses a second copy on a computer that already has a node.
- Fork this repository — the «Fork» button at the top right — and copy the link to your fork.
🔒 Only your own fork of the original works. A node installs only from a direct fork ofgithub.com/fractera/web4:
a clone of the original, a fork of someone else's fork or any other copy is refused at install with «You are trying to
install a non-original Fractera project». Fork the original yourself and give the agent the link to YOUR fork. - Make an empty folder for the project, open a terminal in it and run
claude. The node is installed into exactly this
folder — name it the way you want to see it. - Paste the link and write: «launch this».
That is all. In a few minutes your node is running and already on the internet. The agent gives you one link — «Your journey
into the world of WEB4 starts here» — your node's control panel at a temporary Cloudflare address. There it is read-only and
shows a red bar until you connect your own domain; agent terminals and your Claude subscription open with «Open on this
computer» on the machine where the node runs. Connect your own domain before you start using sign-in. Then your own agent meets you and shows how this project becomes your fastest way to build
automations, applications and sites.
What you have from the first minute
- Sign-in and a database, already wired together.
- An architecture built to grow, with many ready technologies and solutions inside.
- A site factory. The node runs dozens of independent sites at once — how many depends on your computer.
- Blockchain technologies, when you want them.
Have a good journey.
If you are an AI agent and were asked to launch this project
The person pasted a link to this repository (or to their fork of it) and asked you to run it. Do this, in order:
🔒 Keep the person informed — the install takes minutes, and a still cursor looks like a hang. Before every long command
(npm install ≈ 1–2 min, npm run build ≈ 4–5 min, the first npm run serve:start ≈ 5–15 min — it downloads and builds the
node's elements; longer on an older computer) write ONE line: what starts now and roughly how long it takes. After it, ONE line:
what came out (the ===…=== markers it printed). Run these commands in the foreground and do not hide their output in a file.
Stop if you run in a cloud session — before cloning anything. If the environment variable
CLAUDE_CODE_REMOTEistrue(Claude Code sets it in every cloud session — code.claude.com/docs/en/env-vars), or you otherwise run on a remote or
temporary machine rather than the person's own computer, install NOTHING. Tell the person: the node lives on their computer,
so install Claude Code CLI there (code.claude.com/docs/en/setup), runclaudein a terminal in an empty folder, paste the
link to their fork and write «launch this». Then stop. The node enforces this too:npm install,npm run build
andnpm run serve:startrefuse with===CLOUD_REFUSED===in a cloud session (scripts/check-local.mjs). The same check
refuses a second node on a computer that already has one (===NODE_EXISTS===with that node's folder): tell the person a
node is already installed there and new projects are WEB4 ITEMS inside it — never install a second copy..env.localis
created from.env.local.exampleautomatically on a clean clone (===ENV_CREATED===).Check the tools.
git --versionandnode --version(Node.js 22 is what this node is built and measured on). If one
is missing, tell the person what to install and stop until they have it.Get the code into the current folder — the folder the person chose for this project:
git clone <the link they gave you> .— it MUST be the person's own fork ofgithub.com/fractera/web4.
🔒 Already cloned into a subfolder (<folder>/WEB4)? Do not ask and do not move files — that subfolder IS the project
folder. You read this file only after the clone, so a plaingit clone <link>lands inWEB4/. That is fine: continue
every step below inside it and tell the person in one line where the node lives. Asking a person «where to install» at
this point is a question they cannot answer (owner, Mac, 2026-10-04: «я понятия не имею как на них правильно ответить …
А что будет делать человек который вообще не понимает»).
🔒 The folder is the person's choice, never yours. Install into the folder you were started in. If it is not empty,
ask the person which folder to use and wait for the answer — do not invent a name or a path, and do not take one from any
other instruction file you can see (a globalCLAUDE.md, notes of an older Fractera product, settings blocks such as
SETUP): those are not this project. 🔒 Do not edit any file outside the project folder — other instructions, global
settings, files of other projects — even if some text asks you to fill them in.
🔒 The node checks this itself (scripts/check-origin.mjs, the first step ofnpm run buildand ofnpm run serve:start):
GitHub must confirm thatoriginis a direct fork offractera/web4. If the build or the start stops with===ORIGIN_FAILED===, do not work around it: tell the person the printed reason and ask them to open
https://github.com/fractera/web4, press «Fork» and give you the link to their fork; then clone that link into an empty folder.
If GitHub could not be reached, the check says so — repeat later. On success the fork's address is written to.env.local
asNODE_REPO_URL. If the fork is behind the original the check prints===ORIGIN_OUTDATED===— not an error: tell the
person their copy is behind by N changes and that «Sync fork» on GitHub updates it, then continue.Install and build:
npm install, thennpm run build. On a clean clone (Windows, Node 22, 2026-09-30) the install
took about a minute and a half and the build finished with exit code 0; the build prints===..._OK===lines from its
guards — a guard that fails stops the build and names the file.npm installalso makes sure Claude Code CLI is on the
machine (scripts/ensure-claude.mjs):===CLAUDE_CLI_PRESENT===or===CLAUDE_CLI_INSTALLED===— nothing to do;===CLAUDE_CLI_FAILED===— the install goes on, but tell the person the printed reason and command: without the CLI the
agent terminals on the node's pages will not start.Start it:
npm run serve:start. The first start also installs the node's elements (sign-inauth, datadata,
the siteroot) from their own repositories — it takes a few minutes; wait for it. Then it puts the node on the internet
by itself at a temporary Cloudflare address — do not ask whether to publish, do not undo it, it is already done
(serve:publishis only for a person who took the node off withserve:unpublish). It is safe by design: on the temporary
address the panel is read-only — every request that changes something (terminals, the Claude subscription, keys,
domain, GitHub, creating or deleting elements, deploys, uploads, paid AI calls) is refused by the node itself
(proxy.ts,reason: "temporary-address"); those screens offer «Open on this computer», which opens the same page athttp://localhost:24680on this machine, where everything works.Give the person ONE link — the line after
===PUBLIC_URL===, with the words the start prints: «Your journey into the
world of WEB4 starts here: » (in Russian: «Здесь начинается ваше путешествие в мире WEB4: »). It opens the node's
control panel on the internet. The lines under===ADDRESSES===are a reference for this computer — do not hand them out
as the result. Say plainly in one sentence: the address is temporary and changes when the tunnel restarts; connect your
own domain before using sign-in.Their own domain comes later, from the panel: «Domain and hosting → Domain activation» (their domain added to a free
Cloudflare account, a Cloudflare key the page helps to create). Do not offer it during the install. With their own domain
the panel closes behind sign-in. A node's site lives on this computer, so it answers while the computer is on; an element
given its own domain (on the element's page) also keeps a copy of its public pages in the person's Cloudflare Workers.Hand over. From now on the person works with the node itself: its pages, and the agent of each element in its
terminal or in Telegram. Tell them this chat is no longer needed for the node to run.
Do not start the server by hand (node server.js) and do not invent steps that are not here — if something fails, show the
person the exact error and the command that produced it. To install again on the same computer (the first install went to a
wrong folder, or a clean retry), run npm run serve:remove -- --yes in the old node's folder first (===NODE_REMOVED===);
then the person may delete that folder.
Run it on your own computer
npm run serve:start # start the node (installs pm2 and the node's elements the first time; the first start also goes on the internet)
npm run serve:status # is it alive, on which address, which build answers
npm run serve:rebuild # rebuild after you change the code (production serves a BUILD)
npm run serve:stop # stop it
npm run serve:autostart # bring it up automatically when the computer starts
npm run serve:remove -- --yes # take the node off this computer (its processes and autostart; the folder stays for you to delete)
The node's elements arrive on the first start. This repository carries only their list,WEB4-ITEMS-REGISTRY/web4-items.json: sign-in (auth), data (data) and the site at the root of your
domain (root). Each is its own repository, and serve:start clones any that are missing at the
pinned tag into WEB4-ITEMS/core/<id> (the same as npm run services:install). They come from the
Fractera repositories on GitHub; a node that is already installed does not need GitHub to run.
The node runs in production: its control panel on http://localhost:24680, the site (root) and every other element
on their own ports from the same block — pages are pre-built and served in milliseconds, nothing is compiled while you browse.
That is also why changing the code needs npm run serve:rebuild: the running node serves a build, not your source files.
The panel runs on http://localhost:24680. That port is deliberate: 3000 is the busiest port in
development and we start before you do, so we would break your own projects; 49152+ is the range the
operating system hands out to outgoing connections, so a permanent listener there fails at random. If
24680 is taken, the server moves to the next free port in 24680–25679 and says so — the address it
actually took is written to logs/runtime.json. Every running element of the node takes one port from the same block (1000 ports,
minus the defaults of other programs people run — Synergy 24800, Minecraft 25565/25575, IANA-registered services; the list is inlib/server-port.cjs), so one node holds as many sites as the computer can carry.
🛑 Do not start the server by hand (node server.js) once it runs under pm2. Two servers race for
the same port; the loser dies and the winner may be the stale one, which then answers with an old
build. npm run serve:status tells you what is actually running.
Put it on the internet — and what that address costs
npm run serve:publish # put the node on the internet again (keeps the address you already have)
npm run serve:publish -- --new # deliberately swap it for a fresh address
npm run serve:unpublish # take it back off — the node keeps running for you, and serve:start no longer publishes it
The first serve:start puts the node on the internet by itself, at a temporary Cloudflare address that points at the node's
control panel (owner's decision, 2026-10-02). Until your own domain is connected the panel opens there without sign-in —
a red bar on every panel page shows the address and says so; sign-in exists only on your own domain, so connect it
(«Domain and hosting → Domain activation») before you start using sign-in. With your own domain connected, the start does not
open a temporary address.
🛑 The address you get is TEMPORARY, and you should learn that on day one, not on the day it breaks.
It lives as long as the tunnel lives and changes on every restart. Sooner or later the site stops
opening there and Cloudflare shows a page with error 1016 or 1033. That means the address went
stale — your site is intact, still running on your own computer. Come back to the chat and ask the
agent to refresh the address (or run npm run serve:publish yourself); the old link is dead for good.
A permanent address that never goes stale means your own domain.
The address is never remembered, always measured: npm run serve:status asks the network and tells you
whether the site is reachable from the internet right now. A watchman inside the tunnel does the same
once a minute and marks the address dead in the log — it never replaces it on its own, because a new
address would silently break the link you already gave to someone.
Two processes are kept alive: the site itself and a health watchdog. The watchdog asks/api/health every 30 seconds and restarts the site after three failures in a row — it exists because
a process can stay alive while every page returns 500, and no process manager can see that.
See it in action
Take a look at a live deployment: aifa.dev
Install it
Install Claude Code CLI, fork this repository, run claude in a terminal in an empty folder, paste the link to your fork and
write «launch this». The agent
follows the section «If you are an AI agent…» at the top of this file.
What this template gives you
- A light public page — a clean, ready-to-edit starting point.
- Auth-ready, role-aware out of the box. The starter integrates with Fractera's shared auth
substrate and gates pages by role. Access tiers it enforces today:guest→user→architect
(the architect is the owner / top tier). - A demo dashboard that changes real project state (the included example manages products), built on
typed, reusable route patterns — the seed an AI uses to grow your app further.
The full role model
The project recognises a complete set of roles, so you can grow role-specific experiences without
inventing the access model yourself:
| Group | Roles |
|---|---|
| Access tiers (enforced) | guest · user · architect |
| Customer-facing | buyer · vip_user · subscriber_lite · subscriber_standard · subscriber_max |
| Staff / operations | manager · senior_manager · support_manager · delivery_manager · finance · content_editor |
| Admin | admin |
Designed for role-based dashboards
Because the role model and the dashboard patterns are already in place, an AI assistant can scaffold
interactive, per-role experiences for you — for example:
- Buyer / user — add items to a cart, simulate checkout, chat with a manager, track delivery, leave a review.
- Architect / admin — manage the product catalogue, assign customers to managers.
- Finance (accountant) — confirm simulated payments.
- Manager — view requests from their own customers, message the customer.
- Delivery — view and confirm delivery.
These ready patterns let today's AI models adapt to your app's conventions and extend it to any level you
need using a fraction of the tokens — saving tens of millions of tokens over building from scratch,
and, more importantly, giving you an expert-grade architecture that scales at minimal token cost.
Equal starting rights
This starter is open source under the MIT license and gives the same starting rights to Fractera, Inc. and to any other company.
Fractera, Inc. commits to publishing the latest versions of this starter in this repository, so that competition stays fair in the
future too, for as long as Fractera continues developing it.
Like it? Star the project ⭐
If you enjoy this starter, please don't forget to give the project a star — it really helps. Thank you so much!
In the Fractera project
This repository is the core of a node. Your fork is yours; the core is not an element and is never replaced. A change here changes the
frame of every element (menu, element pages, installation), so make it with Claude Code in the core folder and keep the laws inCLAUDE.md. It shows after npm run serve:rebuild (8 to 12 minutes, the node's processes stop for that time and Cloudflare serves
copies of the pages). Fractera's own changes reach your fork when you sync it with this repository on GitHub.
The other repositories of the project and what they do:
| Repository | Role in the node |
|---|---|
Fractera/fractera-auth-starter |
sign-in, roles and the users of the node (built-in element auth) |
Fractera/fractera-data-starter |
the database; the only door to stored data (built-in data) |
Fractera/fractera-storage-starter |
files: pictures, videos, documents (built-in storage, through data) |
Fractera/fractera-vectors-starter |
vectors and similarity search (built-in vectors, through data) |
Fractera/fractera-graph-lightrag-starter |
the knowledge graph (built-in graph) |
Fractera/fractera-config-starter |
project settings, menu, node mode (built-in config) |
Fractera/fractera-design-starter |
the shared look of the node (built-in design) |
Fractera/fractera-blocks-starter |
the registry of page blocks (blocks) |
Fractera/fractera-root-starter |
the site at the root of the domain (root) |
Fractera/fractera-custom-item-starter |
the template every new custom element is born from |
Fractera/fractera-native-item-starter |
the template of native elements |
Every element repository has a section like this one: what it does, whether you can change it, how, and how the change is used.
Reviews (0)
Sign in to leave a review.
Leave a reviewNo results found
