stk is a strict Python framework for AI coding agents. Every session lands in the same architecture, passes the same gate, and proves the app still works in a real browser, so what agents build stays reliable, secure, and easy to change.
Build me an app on stk. Read stkit.dev/start.md and follow it step by step. The app: [describe your app]
AI made scaffolding, refactoring, and documentation cheap. It did not make security, review, or product judgment cheap. stk is shaped around that shifted center of gravity.
Your app is a thin package that depends on stk, published as stkit. It never edits a framework file: features are extensions, and a template is overridden by putting one at the same path. Upgrading is a version bump plus the release note.
# acme/app.py app = Stk(__name__, config=Config, extensions=[invoice]) # pyproject.toml dependencies = ["stkit>=17.1.0,<18"]
The agent should not infer everything from random files. stk exposes boring, inspectable facts about the app and a verification gate before you trust the result.
$ uv run stk inspect context --json $ uv run stk doctor $ uv run stk verify --watch $ uv run stk smokesee the whole loop, with real output →
The frontend runs on Vue 3, loaded directly in the browser. There's no separate JavaScript build to install or maintain, so the agent edits plain HTML templates instead of wrestling a toolchain.
# no build, no install step templates/index.html → Vue 3 from pinned static files
User accounts, the admin dashboard, the async database layer, realtime, and migrations already exist and are tested, so the agent spends its time on your product instead of rebuilding the basics.
auth · admin · async-db · realtime migrations · sessions · rbac · audit-log
Every new app ships with the rules an agent would otherwise learn by breaking things: a CLAUDE.md (also read as AGENTS.md), five skills for blueprints, APIs, migrations, deploys, and lessons, and a CI workflow that runs the tests, the verify gate, and a real browser on every push.
CLAUDE.md → AGENTS.md .claude/skills/ stk-api stk-blueprint stk-deploy stk-lessons stk-migrate .github/workflows/checks.yml tests · stk verify · stk smoke
Your agent installs stk, writes the app with fresh secrets, creates the admin user, and proves it green with doctor, verify, and a real-browser smoke test before it builds anything. The steps it follows are public, so you can read them first.
Build me an app on stk. Read stkit.dev/start.md and follow it step by step. The app: [describe your app]
A read-only MCP server answers from the same pages as docs.stkit.dev, with three tools: search_docs, get_page, and get_command. No sign-in.
Your app's repo to a fresh VPS in one command: Caddy with automatic TLS, a firewall, fail2ban, and key-only SSH.
sudo DOMAIN=example.com REPO=you/myapp bash deploy.sh
PostgreSQL, Redis, and Nginx with TLS. It refuses to start until real passwords and certificates are set.
docker compose up --build
Plain ASGI: Uvicorn behind Nginx or Caddy, managed by systemd.
uvicorn myapp.app:app
Evidence intelligence for defensible investigations. AI proposes claims pinned to the exact line, frame or region they came from, people decide with a passkey, and findings export as a signed package anyone can verify offline.
Open-source, self-hosted invoicing for freelancers and small businesses. No document limits.
An AI research assistant for human rights investigators. Deterministic collection lanes, content credentials, an archived citation trail and a hashed report. AI finds leads. Humans establish facts.