developing-genkit-go — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited developing-genkit-go (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Genkit Go is an AI SDK for Go that provides generation, structured output, streaming, tool calling, prompts, and flows with a unified interface across model providers.
package main
import (
"context"
"fmt"
"log"
"net/http"
"github.com/firebase/genkit/go/ai"
"github.com/firebase/genkit/go/genkit"
"github.com/firebase/genkit/go/plugins/googlegenai"
"github.com/firebase/genkit/go/plugins/server"
)
func main() {
ctx := context.Background()
g := genkit.Init(ctx, genkit.WithPlugins(&googlegenai.GoogleAI{}))
genkit.DefineFlow(g, "jokeFlow", func(ctx context.Context, topic string) (string, error) {
return genkit.GenerateText(ctx, g,
ai.WithModelName("googleai/gemini-flash-latest"),
ai.WithPrompt("Tell me a joke about %s", topic),
)
})
mux := http.NewServeMux()
for _, f := range genkit.ListFlows(g) {
mux.HandleFunc("POST /"+f.Name(), genkit.Handler(f))
}
log.Fatal(server.Start(ctx, "127.0.0.1:8080", mux))
}Load the appropriate reference based on what you need:
| Feature | Reference | When to load |
|---|---|---|
| Initialization | references/getting-started.md | Setting up genkit.Init, plugins, the *Genkit instance pattern |
| Generation | references/generation.md | Generate, GenerateText, GenerateData, streaming, output formats |
| Prompts | references/prompts.md | DefinePrompt, DefineDataPrompt, .prompt files, schemas |
| Tools | references/tools.md | DefineTool, DefineResumableTool interrupts (Interrupted claim, Restart/Respond, WithResume), ai/tool helpers (tool.Interrupt, tool.Fail, tool.AttachParts) |
| Middleware | references/middleware.md | ai.Middleware, ai.WithUse, Hooks (Generate/Model/Tool), built-ins (Retry, Fallback, ToolApproval, Filesystem, Skills, SoftToolErrors, ContextCompression, Budget) |
| Observability | references/observability.md | OpenTelemetry export (otelgenai), tracing.SetInstrumentation, aix.Observer, reflection API outside dev |
| Flows & HTTP | references/flows-and-http.md | DefineFlow, DefineStreamingFlow, genkit.Handler, HTTP serving |
| Model Providers | references/providers.md | Google AI, Vertex AI, Anthropic, OpenAI-compatible, Ollama setup |
Genkit Go has an experimental agent API for persistent, multi-turn conversations (sessions, snapshots, interrupts, branching, background execution). It is gated: initialize with genkit.Init(ctx, genkit.WithExperimental()) or the constructors panic. Server constructors come from genkit/exp (aliased genkitx); types and options from ai/exp (aliased aix); session stores from ai/exp/localstore.
genkitx.DefineAgent rather than hand-rolling a Generate + tools loop in a flow. Reach for a plain flow only for single-shot, stateless generation.For details see:
localstore.NewInMemorySessionStore/NewFileSessionStore, PostgreSQL), snapshots, and the sessionstoretest conformance suite.continue_task, and remote agents (DefineRemoteAgent).DefineCustomAgent for full turn control.genkit.Handler.Genkit Go has an A2UI (Agent-to-UI) plugin (github.com/firebase/genkit/go/plugins/a2ui/exp, imported as a2uix) that lets an agent stream interactive UI surfaces (cards, lists, forms, buttons), not just prose. The whole integration is the &a2uix.Surfaces{} model middleware added via ai.WithUse on a generate call or agent inline prompt. Go is server-only: it has no A2UI client/renderer. Render surfaces with a JS or Dart/Flutter client that talks to your Go agent over HTTP (the server and clients are wire-compatible).
genkit start unintrusively wraps any Go program that uses the Genkit library, running it unchanged while capturing traces from every Genkit action so you can prove tools were actually called and inspect model I/O from the terminal, even for headless checks. It forwards stdio, so interactive CLI tools that rely on stdin/stdout work without issues. Running the app directly (go run .) skips trace capture, so you're debugging blind. Check install with genkit --version.
Installation:
curl -sL cli.genkit.dev | bashPrimary pattern (default): prefix genkit start -- to your normal run command. This collects telemetry from any Genkit code your program runs, whether triggered from the dev UI, your own web server/web UI, or a plain script. Starts the Developer UI (usually http://localhost:4000) for running flows, model and agent playground, and browsing traces:
genkit start -- go run .
genkit start --noui -- go run . # same, without the Dev UI (still a persistent server)
genkit start -o -- go run . # also opens the browsergenkit start runs until you stop it with Ctrl+C. That is expected and correct for the common cases: a server your web/mobile app calls, or an interactive CLI you exit yourself. --noui only drops the Dev UI; it is not a one-shot command and will not exit on its own. Do not use genkit start as a blocking step in automated/non-interactive contexts; use flow:run (below) for that.
Non-interactive use (agents/CI): add the global --non-interactive flag before -- so the CLI uses defaults and never blocks on a prompt (e.g. the first-run analytics notice): genkit start --non-interactive -- go run . (works with flow:run too).
Run a flow (`flow:run`): invoke a specific flow by name from the CLI. Append your run command after -- to spin up the runtime just for this run (the command runs as-is to register your flows):
genkit flow:run myFlow '{"data": "input"}' -- go run .
genkit flow:run myFlow '{"data": "input"}' --stream -- go run . # with streaming
genkit flow:run myFlow '{"data": "input"}' --wait -- go run . # wait for completionThis is self-terminating: it runs the flow once, prints a Trace ID, then exits, so it's the right choice for a quick, non-interactive check (unlike genkit start). Traces for this run can be inspected using the trace commands below.
Debugging with traces: the fastest way to see prompts, model inputs/outputs, tool calls, latencies, and errors. Inspect from the terminal after any run under genkit start:
genkit trace:list # find recent trace IDs
genkit trace:get <traceId> # full trace details (inputs, outputs, tool calls, errors)
genkit trace:get <traceId> --format json # machine-readable JSON, safe to pipe into jq or other parsersFor machine-readable output, pass --format json to get clean JSON you can pipe into jq or other parsers. The default output is human-oriented (banner/log lines, possible truncation on large traces), so don't pipe that form directly; use --format json, grep, or the Dev UI trace viewer.
Documentation:
genkit docs:search "streaming" go
genkit docs:list go
genkit docs:read go/flows.mdSee references/getting-started.md for full CLI and Developer UI details.
*Genkit instance returned by genkit.Init is the central registry. Pass it to all Genkit functions rather than storing it as a global. This is a core pattern throughout the SDK.genkit.Handler, and the ability to test from the Developer UI and CLI. Any generation call worth keeping should live in a flow.go run .) does not capture dev traces. See the Genkit CLI section for how to run your app and capture traces.Interrupted method and resume with ai.WithResume. ai.InterruptWith, RestartWith/RespondWith, and WithToolRestarts are deprecated; genkitx.DefineInterruptibleTool and ai/exp/tool were removed in v1.14.0. See references/tools.md.Retry, Fallback, ToolApproval, Filesystem, Skills, and SoftToolErrors cover the common cross-cutting needs and compose with each other via ai.WithUse. See references/middleware.md. When you do write custom middleware, allocate per-call state in closures captured by New, and guard anything that WrapTool mutates because tools may run concurrently.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.