AI Fullstack SaaS Boilerplate
Fullstack SaaS boilerplate with Fastify, tRPC, and React including AI chat, authentication, and type-safe APIs.
- Source repo
- alan345/AI-Fullstack-SaaS-Boilerplate
- Stars
- ★ 1.4k
- Last updated
- 10d ago
- License
- MIT
- Primary language
- TypeScript
- FA score
- 20/100 · Major gaps
At a glance
- How it runs
- Works with
- Platform-specific
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- Developers who want to bootstrap a SaaS product with authentication and AI features quickly.
- Not a fit if
- Teams that need SEO-friendly marketing or content sites
- Teams wanting to avoid Fastify/tRPC stack lock-in
- Source review
- 20/100 · Major gaps 8 safety controls not found
What does this agent do, and when should you use it?
This is an open-source SaaS boilerplate built with Fastify, tRPC, and React, offering end-to-end type safety. It uses Drizzle ORM for PostgreSQL, Better Auth for authentication, and supports AI chat via Server-Sent Events (SSE). The project is designed for developers who want a modern fullstack foundation without the overhead of Next.js, allowing the frontend to be deployed as static files. It includes features like health checks, debounced search, and a chat interface with OpenAI integration. The repository is MIT-licensed and actively maintained.
The project uses pnpm workspaces to manage a client and server. The server (Fastify) exposes tRPC endpoints, including a health check at http://localhost:2022/health.trpc, and uses Drizzle ORM to interact with PostgreSQL. It implements a chat API that streams responses from OpenAI using Server-Sent Events. The client (React 19 with Tailwind v4) includes pages for login/signup, a dashboard, and a chat interface, all authenticated via Better Auth. The codebase includes E2E tests using Playwright and uses Zod for schema validation.
- Developers who want to bootstrap a SaaS product with authentication and AI features quickly.
- Teams needing type-safe APIs between React and Node.js without a monolithic framework.
- Hobbyists building a chat application with streaming responses using SSE.
- Engineers who prefer a non-Next.js stack to keep frontend deployment simple and static.
- Learners wanting to see how tRPC, Fastify, and Drizzle ORM integrate in a real project.
How do you install or deploy this agent?
Install pnpm globally (npm install -g pnpm) and PostgreSQL. Rename example.env files (root and client) to .env and fill in your credentials. Create a database named fsb with psql -U user and running CREATE DATABASE fsb;. From the root, run pnpm install, then pnpm run push to set up the schema, and pnpm run seed to populate seed data.
How do you use this agent?
After installation, run pnpm run dev to start both client and server. The server health check is at http://localhost:2022/health.trpc. For production, run pnpm run build followed by pnpm run start. To run E2E tests while the app is running, use pnpm run test.
What are this agent's strengths and limitations?
- End-to-end type safety with tRPC eliminates many API contract errors.
- Frontend is static-friendly, making deployment to CDNs or S3 trivial.
- SSE-based chat simplifies streaming AI responses compared to WebSocket.
- Pre-integrated stack (Drizzle, Better Auth, Tailwind v4) saves setup time.
- Not SEO-friendly, so unsuitable for content-heavy or marketing sites.
- Tied to specific frameworks (Fastify, tRPC) — migrating to other stacks is costly.
- Free-tier demo can be slow due to spin-down, affecting user experience.
- AI integration is OpenAI-specific; switching providers requires custom work.
How does this agent compare with similar options?
Compared to T3 App (create.t3.gg), this boilerplate deliberately avoids Next.js to keep the frontend as static files, prioritizing web app development over SEO-optimized websites.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| AI Fullstack SaaS Boilerplate This agent | 20 · Major gaps | CLIFree + model costs | ★ 1.4k | 10d ago | TypeScript | — |
| Sandbox Agent | 67 · Some gaps | Self-hosted serviceFree + model costs | ★ 1.6k | 5d ago | TypeScript | Codex · Claude Code |
| SGR Agent Core | 56 · Major gaps | Self-hosted serviceFree + model costs | ★ 1.1k | 1mo ago | Python | OpenAI API |
| Atmosphere Real-Time JVM Agent Engine | 46 · Major gaps | CLIFree + model costs | ★ 3.8k | 1d ago | Java | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
Evidence shows a full-stack SaaS boilerplate with authentication, database, and external API calls, but no evidence of least privilege, user confirmation, data flow transparency, sensitive data handling, dependency security, external effects, rollback, or source attribution. Therefore all trust criteria score 0.
Self-consistency: Script names in README and package.json are consistent, but test file has commented-out code indicating incomplete tests. Dependency availability: Dependencies listed but no lockfile or version ranges, potentially unstable. Failure messages: No evidence of error handling or user-friendly error messages.
Audience and scenarios: README describes target audience and use cases. Capability boundaries: States not SEO-friendly but no explicit boundaries. Trigger precision: No defined triggers. Environment fit: Installation instructions provided but no details on environment variable configuration.
Information architecture: Clear directory structure. Install notes: Detailed installation steps. Naming stability: Project name and package name consistent. Examples and FAQ: Examples and demo provided, but no FAQ. Known limitations: Mentions not SEO-friendly. License: MIT license. Versioning changelog: No CHANGELOG. Maintenance responsibility: Contribution guide and sponsor link.
Output usability: Demo and screenshots provided. Marginal value: Unique features like SSE chat. Cost benefit: Free and open source, but no performance or cost analysis.
Claim traceability: README claims correspond to code. Cross-source corroboration: No external verification. Fact-inference separation: README distinguishes facts and inferences.
- Not found in source: least-privilege scopingGrant only what the task needs: a dedicated account or read-only token, scoped to specific directories and repos.
- Not found in source: confirmation before actingTurn on (or add) a confirmation step before it acts, and try it in a sandbox or test environment before real data.
- Not found in source: data-flow disclosureWatch which external services it contacts (proxy or firewall logs) and keep sensitive data out until you know where it goes.
- Not found in source: sensitive-data handlingUse dedicated, low-privilege, revocable API keys — never production credentials — and keep secrets out of logs.
- Not found in source: dependency securityPin versions and run a dependency audit (npm audit, pip-audit) before installing; prefer running it in a container.
- Not found in source: disclosed external effectsEstablish which external systems it writes to, sends to or changes, and verify with test accounts or repos before production.
- Not found in source: rollback or recovery pathBack up first, or work on a git branch or snapshot, so its changes can be undone.
- Not found in source: verifiable attributionInstall from the official repo or registry and check the publisher and URL to avoid look-alike packages.
- Commented-out code in test file suggests incomplete tests.
- No lockfile provided, leading to potential dependency inconsistency.
- No evidence of security audit or dependency vulnerability scanning.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.