python-fullstack — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited python-fullstack (Plugin) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<p align="center"> <a href="https://frootai.dev"><img src=".github/frootai-mark.png" width="112" alt="FrootAI"></a> </p>
<h1 align="center">FrootAI</h1> <p align="center"><strong>The open protocol and community catalog for composable AI systems.</strong></p> <p align="center">Connect agents, instructions, skills, hooks, workflows, plugins, tools, prompts, and guardrails into governed Solution Plays.</p>
<p align="center"> <a href="https://frootai.dev"><img src="https://img.shields.io/badge/frootai.dev-10b981?style=flat-square&logo=cloudflare&logoColor=white" alt="Website"></a> <a href="https://github.com/frootai/frootai/actions/workflows/validate-plays.yml"><img src="https://img.shields.io/github/actions/workflow/status/frootai/frootai/validate-plays.yml?branch=main&style=flat-square&label=plays" alt="Solution Play validation"></a> <a href="https://github.com/frootai/frootai/actions/workflows/validate-primitives.yml"><img src="https://img.shields.io/github/actions/workflow/status/frootai/frootai/validate-primitives.yml?branch=main&style=flat-square&label=primitives" alt="Primitive validation"></a> <a href="https://www.npmjs.com/package/frootai-mcp"><img src="https://img.shields.io/npm/v/frootai-mcp?style=flat-square&logo=npm&label=MCP" alt="frootai-mcp version"></a> <a href="https://www.npmjs.com/package/frootai"><img src="https://img.shields.io/npm/v/frootai?style=flat-square&logo=npm&label=CLI" alt="frootai CLI version"></a> <a href="https://marketplace.visualstudio.com/items?itemName=frootai.frootai-vscode"><img src="https://img.shields.io/visual-studio-marketplace/v/frootai.frootai-vscode?style=flat-square&logo=visualstudiocode&label=VS%20Code" alt="VS Code extension version"></a> <a href="./LICENSE"><img src="https://img.shields.io/badge/public%20catalog-MIT-f5c542?style=flat-square" alt="MIT License"></a> </p>
<p align="center"> <a href="https://frootai.dev/getting-started"><strong>Get started</strong></a> · <a href="https://frootai.dev/solution-plays">Solution Plays</a> · <a href="https://frootai.dev/docs">Documentation</a> · <a href="https://frootai.dev/mcp-tooling">MCP</a> · <a href="https://frootai.dev/chatbot">Ask Agent FAI</a> </p>
FrootAI is a vendor-neutral context-wiring system for AI delivery. The FAI Protocol defines how reusable primitives are assembled into complete, evaluated Solution Plays without coupling the architecture to one model, cloud, or agent framework.
| Public building block | Current catalog | Purpose |
|---|---|---|
| Solution Plays | 101 | Complete architecture, DevKit, TuneKit, SpecKit, infrastructure, and evaluation contracts |
| Agents | 238 | Specialized roles with explicit responsibilities and constraints |
| Instructions | 176 | Scoped coding, architecture, governance, and operational policies |
| Skills | 333 | Reusable procedures, domain knowledge, and delivery playbooks |
| Hooks | 11 | Lifecycle guardrails and deterministic checks |
| Plugins | 77 | Installable bundles of compatible primitives |
| Knowledge modules | 25 | FROOT learning path from foundations through production |
Catalog counts come from the committed Factory catalog and are validated in CI.
The fastest path is to choose a Solution Play, install its Agentic OS assets, and adapt the included architecture and evaluation gates.
flowchart LR
D["Discover"] --> F["Define"] --> B["Develop"] --> G["Govern"] --> V["Verify and improve"]Published artifacts are the supported installation boundary for distribution products.
| Surface | Install | Current release |
|---|---|---|
| FrootAI MCP | npx -y frootai-mcp | 6.1.1 |
| FrootAI CLI | npx -y [email protected] | 6.2.0 |
| VS Code | code --install-extension frootai.frootai-vscode | 6.7.3 |
| Python SDK | pip install frootai==5.1.0 | 5.1.0 |
| Python MCP | pip install frootai-mcp==6.1.0 | 6.1.0 |
{
"servers": {
"frootai": {
"command": "npx",
"args": ["-y", "frootai-mcp"]
}
}
}Use the MCP setup guide for VS Code, Claude, Cursor, Docker, Python, and hosted read-only access.
Container availability and immutable image tags are published on the FrootAI packages page. Pin an explicit version or digest before production use.
Existing deployments that reference ghcr.io/frootai/frootai-mcp should verify package visibility and migrate to a published immutable tag or digest before changing production configuration.
A Solution Play is wired by fai-manifest.json. The manifest resolves compatible primitives, shared knowledge, guardrails, configuration, infrastructure, and evaluation requirements.
{
"schemaVersion": "1.0.0",
"play": "01-enterprise-rag",
"primitives": {
"agents": ["./.github/agents/builder.agent.md"],
"instructions": ["./.github/instructions/security.instructions.md"],
"skills": ["./.github/skills/evaluate-rag/SKILL.md"]
},
"evaluation": {
"required": true
}
}This repository is the public home for the FAI Protocol, schemas, conformance assets, community primitives, Solution Plays, learning content, examples, governance, and public integration contracts.
Distribution products and hosted services are released through controlled delivery pipelines. Historical or transitional implementation directories that remain in this repository are not the release authority and will be addressed only through compatibility-gated migrations. No consumer-facing path should be removed without replacement contracts and release-continuity validation.
See Repository Scope for the durable public/private boundary.
agents/ Public agent primitives
instructions/ Scoped instruction primitives
skills/ Reusable skills and bundled references
hooks/ Lifecycle and policy hooks
plugins/ Community-distributed primitive bundles
workflows/ Agentic workflow definitions
solution-plays/ Complete public architecture contracts
fai-protocol/ FAI Protocol specification
schemas/ Machine-readable contracts
conformance/ Protocol compatibility fixtures and results
docs/ FROOT knowledge modules
cookbook/ Composition recipes
workshops/ Hands-on learning material
orchard/ Public registry, schemas, and community submissionsReport vulnerabilities privately through SECURITY.md. Do not open a public security issue.
Contributions are welcome for public protocol work, schemas, documentation, primitives, Solution Plays, recipes, workshops, and community registry content.
Before opening a pull request:
For help, see SUPPORT.md. For planned public work, see ROADMAP.md.
The public protocol, catalog, and community material in this repository are available under the MIT License, unless a contained file or third-party component states otherwise. Hosted services and separately distributed products may have additional terms documented with those services or artifacts.
<p align="center"><strong>From the Roots to the Fruits.</strong><br>Connected, governed, and ready to grow.</p>
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.