
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
@ibrahimkhaled19/backgen
Advanced tools
Generate Express.js backend projects with Prisma, Drizzle, or Mongoose — CLI generator for boilerplate-free APIs with auth, multi-tenant, and Docker
BackGen ships a built-in MCP (Model Context Protocol) server that AI assistants (Claude, Cursor, GitHub Copilot, VS Code) can use to scaffold projects on your behalf.
{
"mcpServers": {
"backgen": {
"command": "npx",
"args": ["-y", "@ibrahimkhaled19/backgen", "backgen-mcp"]
}
}
}
Available MCP tools:
| Tool | Description |
|---|---|
init_project | Scaffold a new production-ready backend project with chosen ORM, preset, and plugins |
add_plugin | Install a plugin (jwt, clerk, stripe, s3, ratelimit, ci-github, dependabot, codeql, docker-registry, release) |
remove_plugin | Remove a previously installed plugin |
generate_resource | Generate a CRUD resource with fields, relations, validation, and Swagger |
generate_seed | Generate a database seed file for a resource |
generate_factory | Generate a test factory for a resource |
doctor | Validate an existing BackGen project for configuration issues |
list_plugins | List all available plugins with descriptions |
list_presets | List all available domain presets |
project_info | Show project metadata from the manifest |
Then just ask: "Scaffold a SaaS backend with Prisma, JWT auth, and Stripe payments"
BackGen is a CLI tool that generates complete Express.js backend projects on Prisma, Drizzle, or Mongoose — with authentication, multi-tenant infrastructure, production hardening, Docker, and testing — all working out of the box.
npx @ibrahimkhaled19/backgen init my-api --orm drizzle
cd my-api
npm run dev
Swagger docs at http://localhost:3000/docs in under 60 seconds. Pick your ORM, keep everything else.
init time, switch later via the manifestsaas-core preset ships Organizations, Memberships, Invitations, RBAC, tenant-scoped queries/health + /ready, error envelopebackgen add.backgenrc.json tracks ORM, plugins, versions, and ownership for upgrade/rollback# Install globally
npm install -g @ibrahimkhaled19/backgen
# Create a project (pick your ORM)
backgen init my-api --orm prisma
backgen init my-api --orm drizzle
backgen init my-api --orm mongoose
# Create a full multi-tenant domain
backgen init my-saas --preset saas-core --defaults
# Add authentication
backgen add jwt
backgen add clerk
# Add production hardening
backgen add ratelimit
# Generate a resource
backgen generate resource Product name:string price:number stock:number
# Start developing
cd my-api
npm run dev
backgen init [name]Generate a new backend project.
backgen init my-api # interactive ORM picker
backgen init my-api --orm prisma # explicit ORM
backgen init my-api --orm drizzle --defaults # Drizzle, non-interactive
backgen init my-api --orm mongoose --skip-install
backgen init my-api --preset saas-core --defaults # full multi-tenant domain
backgen init my-api --preset healthcare # healthcare domain
Output:
.backgenrc.json manifest (records project.orm + plugins)No auth by default — choose your auth provider with backgen add.
backgen add [plugin]Install a plugin. Interactive multi-select if no argument.
backgen add # interactive multi-select
backgen add jwt # JWT authentication
backgen add clerk # Clerk auth-as-a-service
backgen add stripe # Stripe payments
backgen add s3 # AWS S3 storage
backgen add ratelimit # Per-IP / per-user rate limiting
backgen add devops # Install all devops plugins at once
Available Plugins:
| Plugin | Category | Description |
|---|---|---|
jwt | auth | JWT authentication with refresh tokens |
clerk | auth | Clerk auth-as-a-service (conflicts with jwt) |
stripe | payment | Stripe checkout, webhooks, customers |
s3 | storage | AWS S3 upload, download, presigned URLs |
ratelimit | production | Per-IP rate limiting with Redis-ready store |
ci-github | devops | GitHub Actions CI pipeline (lint, typecheck, test, build, optional deploy) |
dependabot | devops | Automated dependency updates via Dependabot |
codeql | devops | CodeQL security analysis on push and schedule |
docker-registry | devops | Docker image build and publish to GHCR |
release | devops | Semantic release with npm publish and GitHub releases |
Conflict detection: jwt and clerk cannot be installed together.
Generate a complete domain in one command. Each preset creates multiple resources with relations, auto-installs JWT auth, and wires everything together.
backgen init my-api --preset healthcare
backgen init my-api --preset saas --defaults
Patient, Doctor, Appointment, Prescription, MedicalRecord — appointments between patients and doctors, prescriptions linked to patients, medical records per patient.
Organization, Team, Membership, Subscription, Invoice — organizations with teams and memberships, subscriptions with invoices.
Category, Product, Cart, Order, OrderItem, Payment — products in categories, carts with items, orders with line items and payments.
Contact, Company, Deal, Activity — companies with contacts, deals tracked through pipeline, activity logging.
Course, Lesson, Enrollment, Progress, Certificate — courses with lessons, student enrollments, progress tracking, certificates.
backgen remove [plugin]Remove a plugin. Interactive multi-select if no argument. Supports devops shorthand to remove all devops plugins.
backgen remove # interactive multi-select
backgen remove stripe # remove specific plugin
backgen remove devops # remove all devops plugins
backgen generate resource <name> [fields...]Generate a CRUD resource module.
# Interactive
backgen generate resource Product
# Non-interactive
backgen generate resource Product name:string price:number stock:number
# With relations
backgen generate resource Appointment date:datetime status:string \
--relations "doctor:Doctor,patient:Patient"
# With --fields flag
backgen generate resource Product --fields "name:string,price:number"
Generated files:
src/modules/product/
product.controller.ts # CRUD endpoints
product.service.ts # business logic
product.repository.ts # database operations
product.validation.ts # Zod schemas
product.types.ts # TypeScript interfaces
product.routes.ts # route definitions + Swagger
product.test.ts # test placeholder
Field types: string, number, boolean, date, datetime
Relations: doctor:Doctor (belongsTo), patients:Patient (hasMany)
backgen generate seed <resource>Generate seed data for development.
backgen generate seed Product --count 10
Output: prisma/seeds/product.ts (Prisma), db/seeds/product.ts (Drizzle), or seeds/product.ts (Mongoose)
backgen generate factory <resource>Generate a test factory.
backgen generate factory Product
Output: src/factories/product.factory.ts
Usage:
import { createProduct } from "./factories/product.factory.js";
const product = await createProduct({ name: "Widget" });
backgen generate migration [name]Generate a database migration (ORM-aware).
backgen generate migration add-product-table # runs prisma migrate dev / drizzle-kit generate / no-op for Mongoose
backgen syncReconcile .backgenrc.json with the project. Regenerates missing plugin files.
backgen sync
backgen healthShow system health information.
backgen health
Displays:
backgen doctorCheck project health with ownership integrity diagnostics.
backgen doctor # health check + ownership audit
backgen doctor --fix # auto-fix missing manifest entries
Checks:
backgen upgradeUpgrade a generated project to the latest template version. Creates a backup, then applies pending migrations sequentially.
backgen upgrade # show pending migrations, prompt before applying
backgen upgrade --yes # skip confirmation, apply all pending
What happens:
generatedVersion from .backgenrc.json.backgen/backups/pre-<version>/generatedVersion in manifestbackgen rollbackRestore a project to its pre-upgrade state from the most recent backup.
backgen rollback # show latest backup, prompt before restoring
backgen rollback --yes # skip confirmation
What happens:
.backgen/backups/Every plugin implements the BackGenPlugin interface:
interface BackGenPlugin {
name: string;
category: string;
description: string;
version: string;
dependencies?: string[];
devDependencies?: string[];
requires?: string[];
conflicts?: string[];
env?: Record<string, string>;
templates: string[];
migrations?: PluginMigration[]; // versioned plugin migration scripts
install(ctx: InstallContext): Promise<void>;
uninstall?(ctx: InstallContext): Promise<void>;
}
Plugins can:
.backgenrc.json tracks plugins, versions, generated version, and file ownership:
{
"version": "1.0.0",
"generatedVersion": "1.9.0",
"project": {
"name": "my-api",
"framework": "express",
"database": "postgresql",
"orm": "prisma",
"preset": "saas-core"
},
"plugins": {
"jwt": {
"version": "1.0.0",
"installedAt": "2026-06-01",
"source": "core"
}
},
"files": {
"src/app.ts": { "owner": "shared", "version": "1.9.0" },
"src/server.ts": { "owner": "framework", "version": "1.9.0" },
"src/config/env.ts": { "owner": "framework-editable", "version": "1.9.0" },
"prisma/schema.prisma": { "owner": "user" },
"src/modules/user/user.service.ts": { "owner": "user" },
"docker-compose.yml": { "owner": "shared", "version": "1.9.0" }
}
}
Ownership levels:
| Level | Description | Upgrade behavior |
|---|---|---|
framework | BackGen owns fully | Safe to overwrite |
framework-editable | Generated but user may customize | Smart merge via migration |
shared | Generated skeleton, user extends (e.g. docker-compose) | Migration-aware update |
user | User owns entirely | Never touched |
my-api/
├── prisma/ # Prisma ORM only
│ ├── schema.prisma
│ └── seeds/
├── src/db/ # Drizzle ORM only
│ ├── schema/
│ │ └── index.ts
│ └── seeds/
├── src/models/ # Mongoose ORM only
│ └── seeds/
├── src/
│ ├── app.ts # Express app setup
│ ├── server.ts # Server entry point
│ ├── config/
│ │ ├── env.ts # Zod env validation
│ │ ├── database.ts # Prisma client / Drizzle db / Mongoose connection
│ │ └── swagger.ts # Swagger config
│ ├── middleware/
│ │ ├── auth.ts # JWT/Clerk auth
│ │ ├── validate.ts # Zod validation
│ │ ├── error.ts # Global error handler
│ │ └── logger.ts # Request logging
│ ├── modules/
│ │ ├── auth/ # Auth module (if jwt installed)
│ │ ├── stripe/ # Stripe module (if installed)
│ │ └── <resource>/ # Generated resources
│ ├── services/
│ │ └── logger.service.ts # Winston logger
│ ├── utils/
│ │ ├── api-error.ts # Error class
│ │ ├── async-handler.ts # Async wrapper
│ │ └── response.ts # Response formatters
│ └── factories/ # Test factories
├── .env.example
├── .backgenrc.json # Manifest
├── Dockerfile
├── docker-compose.yml
├── package.json
└── tsconfig.json
# Clone
git clone https://github.com/your-username/backgen.git
cd backgen
# Install
npm install
# Build
npm run build
# Test
npm run test
# Lint
npm run lint
277+ tests covering:
| Layer | Technology |
|---|---|
| CLI | Commander.js |
| Prompts | Inquirer.js |
| Templates | Handlebars |
| Spinner | Ora |
| Colors | Chalk |
| Testing | Vitest |
| Linting | ESLint 9 (flat config) |
| Language | TypeScript (strict) |
| Layer | Technology |
|---|---|
| Framework | Express.js |
| Language | TypeScript (strict) |
| Database | PostgreSQL |
| ORM | Prisma / Drizzle / Mongoose |
| Validation | Zod |
| Auth | JWT or Clerk |
| Payments | Stripe |
| Storage | AWS S3 |
| Docs | Swagger/OpenAPI |
| Logging | Winston + Morgan |
| Testing | Vitest |
| Deployment | Docker |
| Tool | ORM Choice | Auth | Plugin System | Presets | Upgrade Engine | Docs Site |
|---|---|---|---|---|---|---|
| BackGen | Prisma, Drizzle, Mongoose | JWT, Clerk | ◈ 7+ plugins | 5 domains | ◈ Backup + rollback | — |
| NestJS CLI | No (fixed NestJS) | Built-in | ◈ Modules | — | — | ◈ |
| Express Generator | No (fixed plain JS) | — | — | — | — | — |
| T3 Stack | Prisma | NextAuth | — | — | — | ◈ |
| AdonisJS | Lucid ORM | Built-in | ◈ Ace | — | — | ◈ |
| LoopBack | Built-in | Built-in | ◈ | — | — | ◈ |
Key differentiators:
| Version | Focus | Status |
|---|---|---|
| V1 | Foundation | Done |
| V2 | Plugin System | Done |
| V3 | Resource Generator | Done |
| V4 | Domain Presets | Done |
| V4.5 | SaaS Essentials | Done |
| V4.6 | Production Hardening | Done |
| V4.6.1 | Base Hardening Default-On | Done |
| V5 | Multi-ORM (Prisma, Drizzle, Mongoose) | Done |
| V6 | DevOps & Infrastructure | Done |
| V6.1 | Ownership Tracking & Doctor --fix | Done |
| V6.2 | Upgrade Engine & Migration Runner | Done |
| V6.3 | Backups & Rollback | Done |
| V6.4 | Plugin Migrations | Done |
| V7 | Upgrade Polish & Diffing | In Progress |
| V8 | Schema-First Development | Planned |
| V9 | Enterprise Features | Planned |
| V10 | Plugin Authoring SDK | Planned |
| V11 | Marketplace | Planned |
| V12 | AI Context Layer | Planned |
See docs/ROADMAP.md for details.
MIT
FAQs
Generate Express.js backend projects with Prisma, Drizzle, or Mongoose — CLI generator for boilerplate-free APIs with auth, multi-tenant, and Docker
The npm package @ibrahimkhaled19/backgen receives a total of 99 weekly downloads. As such, @ibrahimkhaled19/backgen popularity was classified as not popular.
We found that @ibrahimkhaled19/backgen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.