stk is a strict Python framework for AI coding agents. Every session lands in the same architecture, passes the same gate, and proves the app still works in a real browser, so what agents build stays reliable, secure, and easy to change.
uvx --from stkit stk init myapp
AI made scaffolding, refactoring, and documentation cheap. It did not make security, review, or product judgment cheap. stk is shaped around that shifted center of gravity.
Your app is a thin package that depends on stk, published as stkit. It never edits a framework file: features are extensions, and a template is overridden by putting one at the same path. Upgrading is a version bump plus the release note.
# acme/app.py app = Stk(__name__, config=Config, extensions=[invoice]) # pyproject.toml dependencies = ["stkit>=17.1.0,<18"]
The agent should not infer everything from random files. stk exposes boring, inspectable facts about the app and a verification gate before you trust the result.
$ uv run stk inspect context --json $ uv run stk doctor $ uv run stk verify --watch $ uv run stk smokesee the whole loop, with real output →
The frontend runs on Vue 3, loaded directly in the browser. There's no separate JavaScript build to install or maintain, so the agent edits plain HTML templates instead of wrestling a toolchain.
# no build, no install step templates/index.html → Vue 3 from pinned static files
User accounts, the admin dashboard, the async database layer, realtime, and migrations already exist and are tested, so the agent spends its time on your product instead of rebuilding the basics.
auth · admin · async-db · realtime migrations · sessions · rbac · audit-log
Every new app ships with the rules an agent would otherwise learn by breaking things: a CLAUDE.md (also read as AGENTS.md), five skills for blueprints, APIs, migrations, deploys, and lessons, and a CI workflow that runs the tests, the verify gate, and a real browser on every push.
CLAUDE.md → AGENTS.md .claude/skills/ stk-api stk-blueprint stk-deploy stk-lessons stk-migrate .github/workflows/checks.yml tests · stk verify · stk smoke
Three commands, no configuration: stk init writes the app with fresh secrets. It writes the production stack too, so docker compose up --build brings PostgreSQL, Redis, and Nginx with it.
Your app's repo to a fresh VPS in one command: Caddy with automatic TLS, a firewall, fail2ban, and key-only SSH.
sudo DOMAIN=example.com REPO=you/myapp bash deploy.sh
PostgreSQL, Redis, and Nginx with TLS. It refuses to start until real passwords and certificates are set.
docker compose up --build
Plain ASGI: Uvicorn behind Nginx or Caddy, managed by systemd.
uvicorn myapp.app:app
Evidence intelligence for defensible investigations. AI proposes claims pinned to the exact line, frame or region they came from, people decide with a passkey, and findings export as a signed package anyone can verify offline.
Open-source, self-hosted invoicing for freelancers and small businesses. No document limits.
Stripe, multi-tenancy, and teams on top of stk.