{
  "markdown": "# create-starter\n\n> Scaffold and audit Starter Series projects — MCP server, Claude Code skill, and CLI in one package.\n\nPart of: **Human-Controlled AI Systems** — scaffolding is the easy half. What keeps a shipped repo trustworthy is the audit primitives (`audit`, `audit-cd`, `audit-security`) verifying release, CD, and CI security hygiene against a known bar — gating each merge instead of asking a human to re-check by hand.\n\nKorean documentation is maintained under [`docs/ko/README.md`](docs/ko/README.md); the root README stays English-only.\n\n## Currently implemented\n\n- **CLI** — package and binary identity are `starter-series`; after the unscoped npm package is published, `npx starter-series my-bot --template discord-bot` scaffolds one of 11 templates with Zod-validated input, atomic rename on success, retry + timeout + 50 MB download cap.\n- **MCP server** — nine stdio tools: `list_templates`, `create_project`, `audit_release`, `audit_cd`, `audit_security`, `audit_instructions`, `generate_launch_proof_report`, `seed_security_guidance`, `add_component`. One binary chooses the mode by argv (positional -> CLI, none -> MCP stdio).\n- **Claude Desktop extension** — `.mcpb` bundle on every release; drag onto the Claude Desktop settings window.\n- **Claude Code plugin + skill** — `/plugin install create-starter@starter-series` ships the MCP server and the conversational `create` skill together.\n- **MCP Registry metadata** — `io.github.starter-series/create-starter`; registry submission is gated on the unscoped npm package being live and tarball-verified.\n- **`audit_release`** — detects matched starter, version vs last-tag drift, CHANGELOG drift vs merged PRs (`git log <tag>..HEAD`), publish-workflow kind (release-please / publish-on-tag / auto-release).\n- **`audit_cd`** — probes npm, PyPI, Open VSX, VS Marketplace, AMO, GitHub Releases for per-destination publish drift (in-sync / needs-publish / local-stale / not-found / unsupported).\n- **`audit_security`** — checks 9 items: 8 core CI primitives (gitleaks with pin check, CodeQL, dependency audit, license check, `--ignore-scripts`, Dependabot grouped, secret-scanning hint, claude-code-security-review Action) plus the optional repo-author `claude-security-guidance.md`. The 8 core checks gate the HARDENED verdict; this repo passes 8/8 core.\n- **`audit_instructions` / `audit-instructions`** — reviews agent instruction files (`AGENTS.md`, `CLAUDE.md`, `GEMINI.md`, Copilot instructions) for exact same-file duplicates, cross-file surface overlap, and keyword-based risk reminders. Duplicate/overlap findings need review; keyword risk summaries are advisory only and not exhaustive safety or semantic drift detection.\n- **`proof-report` / `generate_launch_proof_report`** — runs release, CD, security, and instruction-review audits together and writes a client-ready [`Launch Proof Report`](docs/launch-proof-report.md). This is the monetizable handoff surface: evidence first, no \"certified\" claim, exit code 1 unless the repo is actually launch-ready.\n- **`add_component`** — the remediation half of the audit loop: lifts a starter's CI/CD layer (ci / security / dependabot / maintenance / all) into an *existing* repo without re-scaffolding. Dry-run by default with a per-file plan (create / identical / skip-exists / overwrite); refuses a dirty git tree unless forced; never touches app code or secrets-bearing CD workflows. The dry-run plan doubles as a drift report against the starter.\n- **Graduation guide** — `docs/graduation-from-vibe-coding.md` (+ Korean): five-step path from Lovable/Bolt/v0 exports to GitHub Actions + a real deploy target, using the release/CD/security audit primitives.\n\n## Planned\n\n- `audit_cd` support for Chrome Web Store, EAS, Railway, Fly, and GHCR. Currently reported as `unsupported` because those destinations require auth or have no public read API.\n\n## Design intent\n\n- **One binary, two surfaces.** CLI and MCP stdio share one scaffolding engine. Argv decides which surface answers. No duplicated logic for \"the same thing called from a human vs an agent\".\n- **Atomic on failure.** Extraction happens in a sibling `.<name>-incomplete-<rand>` directory and only renames into the final path on success. Network failure, corrupt archive, partial write — none of them leaves a half-scaffolded directory behind.\n- **Audit is first-class.** Templates ship a security baseline (gitleaks pinned to SHA, CodeQL, Dependabot grouped, `--ignore-scripts`, claude-code-security-review). The audit commands check whether a downstream repo still matches that bar — turning the baseline from a one-time scaffold into an ongoing gate.\n- **Eat your own dogfood.** This repo passes `audit_security` 8/8 core checks (HARDENED); the 9th is the optional `claude-security-guidance.md`. If the tool that audits other repos can't pass its own bar, the bar isn't real.\n- **Read-only outside its sandbox.** Downloads are capped (50 MB, 30 s timeout, 3 retries). Relative output paths cannot escape cwd; absolute paths are accepted only as explicit user intent. `git init` failure is logged but non-fatal.\n\n## Non-goals\n\n- **Full vendor parity in `audit_cd`.** Destinations without a public read API stay `unsupported` rather than reporting confidently-wrong state.\n- **Rewriting app code.** The graduation flow lifts CI/CD from the matching starter; it never touches application code.\n- **A general-purpose project generator.** Templates are the Starter Series 11. New stacks land as new starters, not as flags on `create_project`.\n- **Semantic instruction drift or AI safety enforcement.** `audit_instructions` is a review aid for exact duplicate/surface overlap and keyword reminders. It is not a semantic similarity engine, runtime guardrail, red-team harness, or exhaustive safety/security linter.\n\n## Quick start — CLI\n\n```bash\n# After the unscoped npm package is published:\nnpx starter-series my-bot --template discord-bot\n\n# Before npm publication, run from source:\nnpm ci\nnpm run build\nnode dist/index.js my-bot --template discord-bot\n```\n\n```\nstarter-series — scaffold a project from the Starter Series.\n\nUsage\n  starter-series <name> --template <id> [options]\n  starter-series audit [path]\n  starter-series audit-cd [path]\n  starter-series audit-security [path]\n  starter-series audit-instructions [path]\n  starter-series proof-report [path] [--output <file>] [--stdout]\n  starter-series seed-security-guidance [path] [--force]\n  starter-series add-component [path] [--component <g>] [--starter <id>] [--apply] [--force]\n  starter-series --list\n  starter-series --help\n\nOptions\n  -t, --template <id>      Template ID (see --list)\n  -d, --description <text> One-line project description\n  -o, --output-dir <path>  Output directory (default: ./<name>)\n      --no-git             Skip \"git init\" after scaffold\n      --output <file>       proof-report output (default: <path>/launch-proof-report.md)\n      --stdout              print proof-report Markdown; with --output, also writes the file\n      --component <group>   add-component group: ci, security, dependabot, maintenance, all\n      --starter <id>        add-component source starter override\n      --apply               Write the add-component plan (default is dry-run)\n      --force               Overwrite differing component files or guidance\n      --list               List templates and exit\n  -h, --help               Show help and exit\n  -v, --version            Print version and exit\n\nEnvironment\n  CREATE_STARTER_DEBUG=1   Emit verbose stderr logs\n```\n\n## Available templates\n\n| ID | Stack |\n|----|-------|\n| `mcp-server` | TypeScript + `@modelcontextprotocol/sdk` + Zod |\n| `mcp-server-python` | Python + FastMCP |\n| `npm-package` | Jest + ESLint + OIDC publish |\n| `discord-bot` | discord.js v14 + Docker |\n| `telegram-bot` | grammY + Docker |\n| `browser-extension` | Chrome/Firefox MV3 |\n| `vscode-extension` | VS Marketplace + Open VSX |\n| `electron-app` | cross-platform + code signing |\n| `react-native` | Expo + EAS |\n| `cloudflare-pages` | Wrangler + Pages |\n| `docker-deploy` | any language + GHCR + SSH |\n\nRun `starter-series --list` (CLI) or call `list_templates` (MCP) for the authoritative, up-to-date list.\n\n## Graduating from Lovable / Bolt / v0\n\nAlready have a working app on a vibe-coding platform and want to graduate to GitHub Actions + your own deploy target? Read [`docs/graduation-from-vibe-coding.md`](docs/graduation-from-vibe-coding.md) ([한국어](docs/graduation-from-vibe-coding.ko.md)) — a 5-step path that uses `audit`, `audit-cd`, and `audit-security` to diagnose your repo, then lifts CI/CD from the matching starter without rewriting your app code.\n\n## Install from source\n\n```bash\ngit clone https://github.com/starter-series/create-starter\ncd create-starter\nnpm install\nnpm run build\n```\n\nRequires Node.js ≥22.\n\n## One-click install in Claude Desktop\n\nGrab the latest `.mcpb` bundle from the [Releases page](https://github.com/starter-series/create-starter/releases/latest) and drag it onto the Claude Desktop settings window. Claude Desktop unpacks the bundled `dist/` and `node_modules/` and registers `create-starter` as an MCP server — no `npm`, no config file, no absolute path.\n\n> `.mcpb` (MCP Bundle, formerly `.dxt`) is Anthropic's packaged extension format for MCP servers. See [Desktop Extensions](https://www.anthropic.com/engineering/desktop-extensions).\n\nTo rebuild the bundle locally:\n\n```bash\nnpm ci\nnpm run bundle:mcpb   # produces create-starter-<version>.mcpb\n```\n\n## Use as MCP server\n\nRegister the built binary in your MCP client (Claude Desktop, Cursor, etc.):\n\n```json\n{\n  \"mcpServers\": {\n    \"create-starter\": {\n      \"command\": \"node\",\n      \"args\": [\"/absolute/path/to/create-starter/dist/index.js\"]\n    }\n  }\n}\n```\n\nThen ask your agent: *\"Use create-starter to scaffold a new discord bot named `my-bot`.\"* The agent will call `list_templates` if needed and then `create_project`.\n\n> The binary speaks **MCP stdio** when called with no extra arguments, and switches to **CLI mode** when given any positional argument or flag. Both modes share the same scaffolding engine.\n\n## Use as Claude Code plugin\n\nThe plugin bundles both the MCP server and the `create` skill — one install wires them up together.\n\nFrom the Claude Code REPL:\n\n```\n/plugin marketplace add starter-series/create-starter\n/plugin install create-starter@starter-series\n```\n\nThen ask Claude: *\"scaffold a new discord bot named `my-bot`\"* and the `create-starter:create` skill guides the conversation into the MCP tools.\n\nFor local development (no marketplace round-trip):\n\n```bash\nclaude --plugin-dir /path/to/create-starter\n```\n\nPoint at a git clone so edits in `skills/create/SKILL.md` or `dist/index.js` take effect the moment the session starts.\n\n## Use via MCP Registry\n\nAfter registry publication, this server uses the [Official MCP Registry](https://registry.modelcontextprotocol.io/) namespace:\n\n```\nio.github.starter-series/create-starter\n```\n\nMCP-compatible clients that integrate registry discovery can install it by name without manual path wiring. The registry entry points at the npm package `starter-series`, so the registry step must run only after the npm package is published and verified.\n\nOwnership is verified through GitHub OIDC (namespace `io.github.starter-series/*`) and npm tarball inspection (`package.json#mcpName`). See [`.github/workflows/publish-mcp-registry.yml`](https://github.com/starter-series/create-starter/blob/main/.github/workflows/publish-mcp-registry.yml) for the publish flow.\n\nFor npm release setup (trusted-publisher registration, including the post-2026-05-20 allowed-action step), see [`docs/RELEASING.md`](docs/RELEASING.md).\n\n## Tools\n\nScaffolding:\n\n- **`list_templates`** — returns the full template table as JSON.\n- **`create_project`** — args:\n  - `template` *(required)* — template ID from the table above.\n  - `name` *(required)* — project name matching `^[A-Za-z0-9][A-Za-z0-9_-]*$`.\n  - `description` *(optional)* — one-line description.\n  - `output_dir` *(optional)* — defaults to `./<name>` relative to the MCP server's cwd. Relative paths must stay inside cwd; absolute paths are accepted as explicit user intent.\n  - `init_git` *(optional, default `true`)* — run `git init` after scaffold.\n\nAudit (each takes an optional `path` arg, default = MCP server cwd; all read-only):\n\n- **`audit_release`** — release-readiness diagnosis. CLI mirror: `starter-series audit [path]`.\n- **`audit_cd`** — per-destination publish-drift probe. CLI mirror: `starter-series audit-cd [path]`.\n- **`audit_security`** — baseline CI security hygiene check. CLI mirror: `starter-series audit-security [path]`.\n- **`audit_instructions`** — agent-instruction duplicate and surface-overlap review, with advisory keyword risk summaries. CLI mirror: `starter-series audit-instructions [path]`.\n- **`generate_launch_proof_report`** — combined Markdown launch handoff from release, CD, security, and instruction-review audits. CLI mirror: `starter-series proof-report [path] [--output <file>] [--stdout]`.\n- **`seed_security_guidance`** — generate a starter-aware `claude-security-guidance.md` draft. CLI mirror: `starter-series seed-security-guidance [path] [--force]`.\n- **`add_component`** — propose or apply starter CI/CD components to an existing repo as a dry-run plan. CLI mirror: `starter-series add-component [path] [--component <g>] [--starter <id>] [--apply] [--force]`.\n\n## Safety & reliability\n\n- Project names are regex-validated before any filesystem touch; relative output paths are rejected if they escape the working directory.\n- Downloads enforce a 30 s timeout, 3-attempt exponential backoff, and a 50 MB size cap.\n- Extraction happens in a sibling `.<name>-incomplete-<rand>` dir; on any failure (network, corrupt archive, extraction error) the tmp dir is removed. The final path only appears via an atomic `rename` once everything succeeded.\n- `git init` failures are logged to stderr but do not fail the scaffold; the project is usable without a `.git` directory.\n\n## Supply-chain security pre-wired\n\nEvery Starter Series template ships with the 9 checks `audit_security` looks for — no opt-in required:\n\n| Check | What it catches |\n|---|---|\n| **gitleaks** (SHA256-pinned manual install) | Committed secrets in code or history |\n| **CodeQL** (weekly + PR) | Static analysis for JS/TS/Python |\n| **Dependency audit** (`npm audit --audit-level=moderate` / `pip-audit`) | Known CVEs in transitive deps |\n| **License check** | GPL/AGPL contamination |\n| **`--ignore-scripts`** on every `npm/pnpm/yarn install` | Malicious postinstall scripts |\n| **Dependabot grouped updates** | Lockfile-conflict storms from one-by-one bumps |\n| **GitHub secret scanning + push protection** | Tokens leaked at push time |\n| **`anthropics/claude-code-security-review`** Action on PR | AI-based diff review |\n| **`claude-security-guidance.md`** *(this is the only one you write)* | Org-specific rules consumed by Anthropic's in-session [Claude Code Security Guidance Plugin](https://www.anthropic.com/news/claude-code-plugins) (released 2026-05-26) |\n\nThis was Vercel's stack during their 2026-04-21 npm supply-chain incident — they pre-empted compromise via the same pre-wired checks plus Socket/npm/GitHub coordination. The Starter Series ships those checks pre-wired in every starter.\n\n## License\n\nMIT © heznpc\n",
  "bytes": 15339,
  "sha": "01cd268600e6fd76c1606497bbe84658a5b4a5c9e6ca15570955a2e7e9cdd9ce",
  "repo_slug": "starter-series/create-starter",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_starter_series_create_starter_edd62a08/readme"
}