Full-Stack AI Agent Template
Generate full-stack AI applications with agents, RAG, streaming chat, authentication, and production infrastructure.
- Source repo
- vstorm-co/full-stack-ai-agent-template
- Stars
- ★ 2k
- Last updated
- 12d ago
- License
- MIT
- Primary language
- Python
- FA score
- 74/100 · Some gaps
At a glance
- How it runs
- Works with
- Universal · cross-platformOpenAI API · Claude API
- Cost
- Free software; you pay for model usage
- Setup effort
- Medium · a few setup steps
- You'll need
- Typical use
- A team building an internal knowledge assistant can enable RAG and ingest PDF, DOCX, Google Drive, or S3 content into searchable collections.
- Not a fit if
- Teams wanting a single-process app with no extra infrastructure
- Small teams unwilling to manage Docker, databases, and multiple API keys
- Source review
- 74/100 · Some gaps
What does this agent do, and when should you use it?
This repository is a configurable generator for applications built with a FastAPI backend and a Next.js 15/React 19 frontend. A generated project can use PydanticAI, PydanticDeep, LangChain, LangGraph, or DeepAgents with OpenAI, Anthropic, Gemini, or OpenRouter. It includes WebSocket chat streaming, conversation persistence, tool-result UI, document ingestion, and retrieval through Milvus, Qdrant, ChromaDB, or pgvector. Optional product infrastructure covers JWT and API-key authentication, Google OAuth, background jobs, Stripe billing, administration, observability, and messaging channels. Its output is ordinary self-hosted source code deployable with Docker Compose or Kubernetes, while the frontend can also be deployed separately to Vercel; generated applications do not require the generator at runtime.
Running the fastapi-fullstack wizard or fastapi-fullstack create scaffolds a project according to selected database, authentication, agent framework, model provider, RAG, task queue, and frontend options. FastAPI exposes REST, OpenAPI, and WebSocket interfaces; agents can call web search, URL fetching, knowledge-base search, charts, run_python, skills, and ask_user, while the UI streams text deltas, reasoning, task state, and tool results. The RAG pipeline reads local files, API uploads, Google Drive, or S3/MinIO sources, then parses, chunks, embeds, stores, searches, and optionally reranks their contents; all five agent frameworks receive a search_knowledge_base tool. PostgreSQL stores users, sessions, conversations, and application data, while Redis and Celery, Taskiq, ARQ, or Prefect can provide state and background processing. The generated deliverable includes backend and frontend code, Alembic migrations, tests, Docker Compose definitions, a Makefile, and configuration and coding-assistant files matched to the chosen feature set.
- A team building an internal knowledge assistant can enable RAG and ingest PDF, DOCX, Google Drive, or S3 content into searchable collections.
- A SaaS team launching a customer-facing assistant can combine streaming chat, saved conversations, public sharing, workspaces, response ratings, and administration.
- An engineering group evaluating agent stacks can generate comparable projects with PydanticAI, LangGraph, LangChain, PydanticDeep, or DeepAgents.
- A startup preparing a paid AI product can add Stripe subscriptions, seat billing, credit ledgers, usage reporting, authentication, and a marketing site.
- An organization that requires self-hosting can select Docker, Kubernetes, PostgreSQL, Redis, background queues, and Logfire, LangSmith, Sentry, or Prometheus.
- A developer serving users across web and messaging can pair the WebSocket chat application with optional Telegram or Slack multi-bot channels.
How do you install or deploy this agent?
Python 3.11+ is required, and the Next.js frontend requires Node.js 18+; uv and Bun are recommended. Install the generator with uv tool install fastapi-fullstack, pip install fastapi-fullstack, or pipx install fastapi-fullstack. For the first working application, run fastapi-fullstack and complete the wizard, then run cd my_ai_app followed by make bootstrap; this builds the backend image, starts PostgreSQL, applies Alembic migrations, and seeds the development administrator. In another terminal run cd my_ai_app/frontend && bun install && bun dev. Configure credentials for the selected model provider, such as an OpenAI, Anthropic, Gemini, or OpenRouter API key. For production, copy backend/.env.example to backend/.env and supply real secrets. The standard container workflow requires Docker; Windows users also need GNU Make or an environment such as WSL2 or Git Bash.
How do you use this agent?
Run fastapi-fullstack for interactive generation. A copyable non-interactive example is fastapi-fullstack create my_ai_app --database postgresql --frontend nextjs; use fastapi-fullstack create my_ai_app --preset ai-agent for the streaming-agent preset, or fastapi-fullstack create my_app --rag --database postgresql --task-queue celery for RAG with Celery. Once running, open http://localhost:8000, http://localhost:8000/docs, http://localhost:8000/admin, and http://localhost:3000. make bootstrap seeds [email protected] with password admin123 for development; those credentials must not be retained for production. Routine commands include make dev, make dev-down, make dev-logs, and make dev-frontend. For a project named my_ai_app, backend operations include uv run my_ai_app server run --reload, uv run my_ai_app db migrate -m "message", uv run my_ai_app db upgrade, and uv run my_ai_app user create-admin. Existing generated projects can preview template updates with make upgrade-dry-run and apply a three-way merge on a dedicated branch with make upgrade.
What are this agent's strengths and limitations?
- One generator explicitly supports five agent frameworks, four model providers, and four vector-store choices, giving adopters meaningful stack and hosting flexibility.
- It covers the product path from ingestion, retrieval, and agent tools through streaming UI, authentication, administration, billing, and observability.
- The result is editable source code without a generator runtime dependency, and the documented upgrade flow uses a three-way merge intended to preserve local customizations.
- Docker Compose, Kubernetes, a separately deployable Vercel frontend, multiple job systems, and several observability options provide broad deployment coverage.
- A feature-rich deployment can combine PostgreSQL, Redis, a vector database, a task queue, two application runtimes, and several external APIs, creating substantial operational overhead.
- Provider support is not uniform: OpenRouter is documented only for PydanticAI, so switching framework may reduce the available provider choices.
- RAG options carry different infrastructure costs: Milvus uses three Docker services, Qdrant uses one, and embeddings, reranking, Google Drive, or S3 may require additional services and credentials.
- The extensive option surface still requires adopters to review authentication, seeded administrator credentials, rate limits, secrets, billing, and deployment settings before production use.
How does this agent compare with similar options?
Compared with full-stack-fastapi-template, this project is specifically aimed at AI/LLM products and adds five agent frameworks, RAG, WebSocket streaming, conversation persistence, LLM observability, and a Next.js chat interface. Compared with create-t3-app, it supplies a FastAPI backend plus RAG, job processing, administration, and Docker/Kubernetes paths; the source comparison lists NextAuth and Prisma for create-t3-app but no agent or RAG features.
Key facts side by side with the most closely related agents.
| Agent | Source review | Form / cost | Stars | Updated | Language | Full support on |
|---|---|---|---|---|---|---|
| Full-Stack AI Agent Template This agent | 74 · Some gaps | CLIFree + model costs | ★ 2k | 12d ago | Python | OpenAI API · Claude API |
| Agents Towards Production | 0 · Major gaps | Library / SDKFree + model costs | ★ 22k | 1d ago | Jupyter Notebook | — |
| AI Agent Service Toolkit | 69 · Some gaps | FrameworkFree + model costs | ★ 4.5k | today | Python | OpenAI API |
| llm.rb | 59 · Major gaps | Library / SDKFree + model costs | ★ 144 | today | Ruby | OpenAI API · Claude API |
How does FollowAgents rate this agent?
Why each dimension lost points
The evidence shows JWT, RBAC, HTTP-only cookies, SSRF and path validation, webhook signatures, secret-exclusion guidance, and encrypted token storage in generated projects. The project-board workflow declares empty default GITHUB_TOKEN permissions and avoids checking out untrusted pull-request code. Upgrades offer a dry run and dedicated branch, while the agent UI supports ask-user pauses. Deductions apply because the supplied files do not enumerate permissions, destinations, or confirmation policy for every integration and agent tool; the seeded public admin credentials are development-only; and database encryption, rotation, LLM-output safety, and compliance auditing remain user responsibilities. Dependency auditing exists, but CI silently ignores five CVEs without documented assessment or mitigation, so dependency security is only thin. Vstorm, author email, and a security contact are attributed, but publisher identity is not independently verified and is treated only as unknown.
The README, package metadata, CI configuration, and authentication tests are broadly coherent. CI describes several generated configurations and Python versions, while tests cover authentication failures, rate limiting, and delegated-auth boundaries. Dependencies and environment procedures are reasonably clear, and HTTP statuses, workflow notices, and log commands provide useful failure signals. Deductions apply because no execution results are supplied, some tooling and Actions use latest or moving major tags rather than immutable versions, and the matrix cannot establish availability of every claimed integration. Failure-message evidence is concentrated in authentication and one workflow rather than generation, upgrades, RAG, and external-service failures.
The material explicitly targets developers building chatbots, ML applications, enterprise SaaS, and startup products. It provides a wizard, explicit flags, presets, a minimal mode, five agent frameworks, and many optional integrations. The security policy clearly separates included controls from user responsibilities, while environment instructions cover development, staging, production, local backend work, and Windows through WSL or Git Bash. Audience coverage, boundaries, and environment fit therefore earn full marks. Trigger precision is deducted because CLI examples are clear but the supplied evidence does not show the complete constraint and conflict model or the conditions under which agent tools are invoked.
The README has strong navigation, quick-start instructions, environment tables, command examples, FAQ and documentation entry points, and an upgrade guide. Installation and deployment notes are concrete. The complete MIT text matches package metadata, justifying full license marks. SECURITY.md identifies supported versions, a disclosure channel, response targets, and maintenance scope; the organization workflow also documents issue-routing responsibility. Deductions apply because the repository, distribution, CLI, and generated-project command use several related names that users must map, and although version 0.2.19 and an upgrade mechanism are documented, no changelog or release-history file is supplied.
The proposed output is a directly extendable FastAPI, Next.js, database, authentication, agent, RAG, and deployment scaffold with startup commands, UI examples, administration features, and an upgrade path, supporting strong static output usability. It plausibly saves substantial setup effort, but claims such as production-ready, generation in under 60 seconds, and 20-plus integrations are primarily first-party assertions without independent quantitative comparison. The many optional services, containers, frontend and backend toolchains, and retained production-security duties introduce configuration and operational cost, so marginal value and cost-benefit are not awarded full marks.
Many claims map across the README, pyproject, SECURITY policy, CI, and authentication tests, including version, license, Python support, auditing, authentication, rate limiting, and generated configurations. This provides useful internal corroboration. Deductions apply because the source excerpt is truncated and includes only a small portion of implementation tests, preventing criterion-by-criterion tracing of all security controls, integrations, and UI claims. The 100% coverage, production-readiness, idempotent-upgrade, and performance-like claims lack an included static report or complete implementation evidence. Limitations are separated from feature marketing in places, but several promotional assertions are not explicitly labeled as unverified.
- The pip-audit job explicitly ignores five CVEs, but the supplied material gives no severity analysis, affected-path assessment, patch plan, or compensating controls; review each exception before adoption.
- make bootstrap creates [email protected] / admin123. Those credentials must never remain in an environment reachable by others and must be disabled, removed, or changed before production use.
- The template explicitly omits default database-at-rest encryption, secret rotation, LLM-output filtering, compliance audit trails, and formal penetration testing; production adopters must implement and verify them.
- Code execution, web search, RAG, cloud-drive, S3, Stripe, Slack, and Telegram features may process or transmit sensitive data. The supplied files are insufficient to verify least privilege, consent, and retention behavior for each integration.
- This assessment is based only on the supplied static files; the generator, tests, dependency audit, deployment, and upgrade paths were not executed.
Recent releases
Latest entries from the project's GitHub Releases. Notes are quoted from upstream as written, not rewritten or tested by FollowAgents.
-
Release notes excerpt
Fixed - **alembic upgrade head failed in every PostgreSQL project without --mcp-client** — since 0.2.19, migration 0027 named 0026_create_mcp_connections as its parent, and that migration is generated only with the MCP client, so Alembic stopped with KeyError: '0026_create_mcp_connections'. 0027 now follows 0025 when 0026 is absent. Nobody noticed because tests/test_migrations.py took any `alembic current` failure for "no database" and skipped itself; it now checks the connection directly, so a broken chain fails it. A new matrix check, …View on GitHub ↗ -
Release notes excerpt
Added - **--llm-provider openai_compatible: any OpenAI-compatible gateway or server** — model routers and LLM gateways (LiteLLM, Requesty, OrcaRouter, Portkey) and self-hosted servers (vLLM, llama.cpp, LM Studio, Ollama), reached by OPENAI_COMPATIBLE_BASE_URL, with AI_MODEL named as the endpoint names it and an optional OPENAI_COMPATIBLE_API_KEY (OPENAI_API_KEY is never sent there). Pydantic AI and Pydantic Deep Agents projects; OpenAI embeddings for RAG go to the same endpoint; Pydantic Deep Agents projects need …View on GitHub ↗ -
Release notes excerpt
A security release, from a full audit of the template's product code. Upgrade if you generated with --auth-mode delegated, --rate-limiting, or email sign-in links. There are breaking changes and one migration — see Upgrading. One pattern runs through most of this: the mechanism was built and correct, and nothing attached it. Rate limiting shipped twice and guarded no route. The reranker was warmed at startup and thrown away on every request. Delegated auth was half-wired. All of it lived in configurations no CI job rendered — 53 of the 88 CLI flags were never generated — so nothing wa …View on GitHub ↗
FAQ
Is OpenAI mandatory?
Can this be used as a conventional full-stack template without AI features?
Does RAG always require a separate vector-database service?
Can a generated project receive later template updates?
make upgrade-dry-run previews changes, make upgrade performs a three-way merge on a dedicated branch, and make upgrade-finalize updates the manifest. Merge conflicts still require manual resolution.