
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
create-cmp-cli
Advanced tools
Scaffold a production-ready Kotlin/Compose Multiplatform app (Android + iOS) that builds green in minutes — toolchain auto-bootstrapped, navigation/insets pre-solved, Clean Architecture wired, Appium harness ready. Installs the `create-cmp` command.
Scaffold a green-building Kotlin/Compose Multiplatform app (Android + iOS) in minutes — not hours.
Toolchain auto-bootstrapped · Navigation & insets pre-solved · Clean Architecture wired · Appium harness ready.
Starting a Compose Multiplatform project is slow and flaky — not because the knowledge is hard, but because it isn't reproducible. Kotlin ↔ KSP ↔ CMP ↔ Room ↔ AGP must all agree or the build dies; the iOS shell (XcodeGen + CocoaPods + Firebase pods + AppDelegate + framework embedding) is a multi-step minefield; edge-to-edge insets get re-debugged on every project; and the toolchain itself is a cliff most scaffolders leave to you. That friction is why greenfield mobile apps quietly default to React Native.
create-cmp removes the friction. It stamps a frozen, CI-verified golden template (it does not
freehand-generate your project), bootstraps the toolchain, and proves a green build before it
reports success.
Full usage in one place:
docs/USAGE.mdis the single entry point — setup, every CLI command, all 8 skills, the 14-toolcmp-inspectorMCP, and the workflows that tie them together. Read it and you can drive create-cmp end to end (agents included).
npx create-cmp-cli@latest
…or non-interactively:
npx create-cmp-cli@latest --name Acme --package com.acme.app --yes --verify
The scaffolder interviews you (or takes flags), runs the toolchain doctor, stamps the template, and builds the app to prove it's green.
On the package name: it publishes as
create-cmp-cli— the bare namecreate-cmpis held by an unrelated placeholder, andcreate-cmp-appis a real, unrelated CMP generator, so we didn't reuse either. The installed command is stillcreate-cmp. You can also run straight from GitHub with no install:npx github:kvdm-co-pilot/create-cmp, or use the Claude Code plugin.
create-cmp is useful across the whole life of a project, not just day one — and every command
except create works on any KMP project, not only ones it scaffolded:
| Command | What it does |
|---|---|
create-cmp [dir] / create-cmp create | Scaffold a new app from the frozen golden template (the default command). |
create-cmp doctor [--fix] | Toolchain preflight (JDK/SDK/Xcode/Appium, consent-gated installs) plus project diagnosis when run inside a Gradle project: kotlin↔ksp lockstep, drift vs proven-green sets, the KSP2/iOS catch-22, sdk.dir, ~/.konan bloat, disk space. --fix applies the safe heals. |
create-cmp upgrade [--dry-run] | Migrate gradle/libs.versions.toml to the next proven-green version set — diff table first, surgical in-place edits with .bak-upgrade backups, kotlin↔ksp lockstep guardrail, --verify to prove the result. |
create-cmp clean | Cache & build-output hygiene: stale ~/.konan toolchains + project build//.gradle/ dirs (sizes shown, consent-gated); ~/.gradle/caches is size-reported only. |
create-cmp verify [--target-dir .] | Run the green-build gate (Android, and iOS on macOS) against an existing project. |
North-star (a goal, measured honestly — not a benchmark): time-to-green — a running app on the Android emulator and the iOS simulator, smoke-passing, with zero manual steps modulo the one Xcode App Store install. Target: under 5 minutes on a clean machine. Every scaffold ends with a
--verifybuild gate, so success is proven, not assumed.
Everything below is stamped from a template that builds green on Android + iOS — not regenerated per run, so it can't silently drift:
ksp.useKSP2=true). Frozen and CI-gated.project.yml (XcodeGen), Podfile (Firebase static
linkage), Info.plist, iOSApp.swift (AppDelegate + FirebaseApp.configure() before Koin),
ContentView.swift (ComposeUIViewController bridge).AndroidManifest, MainActivity with enableEdgeToEdge(), Application
starting Koin + Room, adaptive-icon structure.BaseScreen Scaffold owning window insets /
status- and nav-bar padding, plus a data-driven AppShell + bottom nav fed by your tabs list
(not role-hardcoded), with type-safe routes.core / data{local,remote} / domain{model,repository,usecase} / presentation{components,theme,navigation,<feature>} / di with Koin modules registered and one
example feature wired end-to-end as the copy-paste pattern.<Prefix>Theme, <Prefix>Tokens, <Prefix>Colors, DM Sans.127.0.0.1:9500, loopback, structurally absent from release). An agent runs connect_live and
reads the running UI as JSON — hierarchy, geometry, resolved design tokens, real navigation
state. Never screenshots. Toggle with --no-inspector; create-cmp doctor verifies it stays
debug-only and that every declared theme token is served on /inspect/design-system.http://127.0.0.1:9500/inspect/remote
(after adb forward tcp:9500 tcp:9500) to watch the real device and click the image to tap it,
while the agent drives navigate_and_inspect on the semantics tree and proves every change with
prove_change. Pixels for the human, structure for the AI../gradlew :composeApp:hotRunDesktop --auto); Firebase never initializes on desktop
(offline DI fakes). Toggle with --no-dev-client.google-services.json / GoogleService-Info.plist are intentionally not real — you get
placeholders and clear "drop your Firebase config here" instructions.
| Option | Choices | Default |
|---|---|---|
| Platforms | Android (always) + iOS | iOS on |
| App name / package / iOS bundle id | — | required / derived |
| Firebase region | any Firebase region | us-central1 |
| Firebase (GitLive KMP) | on / off | on |
| Auth | email / phone / both / none | both |
| Firebase services | Firestore · Storage · Functions · FCM | all on |
| Room local cache | on / off | on |
| Appium harness | on / off | on |
| Bottom-nav tabs | label + icon, any count | Home, Profile |
(Web/PWA is intentionally out of scope — Android + iOS only.)
create-cmp also ships as a Claude Code plugin — one
shared engine, two front doors. Install from the bundled marketplace:
/plugin marketplace add kvdm-co-pilot/create-cmp
/plugin install create-cmp
It bundles eight skills (plus the cmp-inspector MCP server), each with a deterministic engine
behind it:
navigate_and_inspect), wireframe rendering, and prove_change — the verified dev loop../gradlew :composeApp:hotRunDesktop --auto) — the Expo-style dev loop for KMP.This isn't a knock on React Native — it's about defaults. The only place CMP loses to RN on a new
app is time-to-first-green-build, and that's a tooling problem, not a merits problem. With
create-cmp, CMP's npx-and-go is competitive:
If create-next-app made React the default for the web by removing setup friction, the goal here is
the same for multiplatform mobile.
Front doors: npx create-cmp-cli + Claude Code plugin (cmp-new / cmp-doctor / cmp-qa-prep)
│ one shared engine, two front doors
Engine (Node, deterministic): copy → token-replace → rename packages → toggle features → VERIFY
Golden template (frozen, CI'd): pinned versions · iOS shell · nav+insets · Clean Arch · DI · Appium
The engine never puts an LLM in the hot path: it copies the template, replaces placeholders in file
contents and paths, atomically renames package directories, toggles features (Firebase / auth type
/ Room / Appium), and runs the verify build. Determinism is the moat. See
docs/ARCHITECTURE.md for the full design.
doctor detects and (with your consent) installs. Xcode itself must be installed from the
App Store; the doctor surfaces that as the one manual step.The full plan — six pillars from scaffold to store release, and the sequencing — lives in
docs/ROADMAP.md. Near-term:
create-cmp-cli (npx create-cmp-cli) — release cut, publish pending.npx create-cmp-cli → green Android + iOS).docs/INSPECTOR-PLAN.md.Issues and PRs welcome — see CONTRIBUTING.md and our Code of Conduct. The golden template is CI-gated: an upstream version bump must fail CI, not your generated project.
MIT © Karel van der Merwe and create-cmp contributors.
FAQs
Create production mobile apps (Android + iOS, one Kotlin codebase) with AI — the delivery harness for Compose Multiplatform, the current generation of cross-platform (Google-backed KMP, iOS stable since May 2025). A deterministic, non-interactive generato
The npm package create-cmp-cli receives a total of 0 weekly downloads. As such, create-cmp-cli popularity was classified as not popular.
We found that create-cmp-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.