
Security News
Deno Goes the Way of the Dinosaur
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.
create-cmp-cli
Advanced tools
The AI delivery harness for Kotlin/Compose Multiplatform — scaffolds a green-building app (Android + iOS) in minutes and holds AI-driven changes to a machine-enforced verify lane with a committed evidence receipt. Installs the `create-cmp` command.
The AI delivery harness for Kotlin/Compose Multiplatform — scaffold a green-building app (Android + iOS) in minutes, with best practices your AI is mechanically held to.
Toolchain auto-bootstrapped · Navigation & insets pre-solved · Clean Architecture wired · Test pyramid + E2E flows included · AI-native inspector & verification lane.
Starting a Compose Multiplatform project is slow and flaky — not because the knowledge is hard, but because it isn't reproducible. Kotlin ↔ KSP ↔ CMP ↔ Room ↔ AGP must all agree or the build dies; the iOS shell (XcodeGen + CocoaPods + Firebase pods + AppDelegate + framework embedding) is a multi-step minefield; edge-to-edge insets get re-debugged on every project; and the toolchain itself is a cliff most scaffolders leave to you. That friction is why greenfield mobile apps quietly default to React Native.
create-cmp removes the friction. It stamps a frozen, CI-verified golden template (it does not
freehand-generate your project), bootstraps the toolchain, and proves a green build before it
reports success.
And it goes further than scaffolding: create-cmp is an AI delivery harness. In the age of
AI-driven development, the scarce thing isn't code — it's a machine-enforceable definition of
correct. Every generated project ships the architecture patterns as running exemplars (with
tests), the best practices as executable conformance checks, generation tools so the AI extends
the app right-by-construction, an AI-native structural inspector, and a verification lane that
refuses "done" without evidence. See docs/HARNESS-PLAN.md for the
full product definition.
Full usage in one place:
docs/USAGE.mdis the single entry point — setup, every CLI command, all 8 skills, the 14-toolcmp-inspectorMCP, and the workflows that tie them together. Read it and you can drive create-cmp end to end (agents included).
npx create-cmp-cli@latest
…or non-interactively:
npx create-cmp-cli@latest --name Acme --package com.acme.app --yes --verify
The scaffolder interviews you (or takes flags), runs the toolchain doctor, stamps the template, and builds the app to prove it's green.
On the package name: it publishes as
create-cmp-cli— the bare namecreate-cmpis held by an unrelated placeholder, andcreate-cmp-appis a real, unrelated CMP generator, so we didn't reuse either. The installed command is stillcreate-cmp. You can also run straight from GitHub with no install:npx github:kvdm-co-pilot/create-cmp, or use the Claude Code plugin.
create-cmp is useful across the whole life of a project, not just day one — and every command
except create works on any KMP project, not only ones it scaffolded:
| Command | What it does |
|---|---|
create-cmp [dir] / create-cmp create | Scaffold a new app from the frozen golden template (the default command). |
create-cmp doctor [--fix] | Toolchain preflight (JDK/SDK/Xcode/Appium — legacy driver install for the pre-Maestro path, consent-gated installs) plus project diagnosis when run inside a Gradle project: kotlin↔ksp lockstep, drift vs proven-green sets, the KSP2/iOS catch-22, sdk.dir, ~/.konan bloat, disk space. --fix applies the safe heals. |
create-cmp upgrade [--dry-run] | Migrate gradle/libs.versions.toml to the next proven-green version set — diff table first, surgical in-place edits with .bak-upgrade backups, kotlin↔ksp lockstep guardrail, --verify to prove the result. |
create-cmp clean | Cache & build-output hygiene: stale ~/.konan toolchains + project build//.gradle/ dirs (sizes shown, consent-gated); ~/.gradle/caches is size-reported only. |
create-cmp verify [--target-dir .] | Run the green-build gate (Android, and iOS on macOS) against an existing project. |
North-star (a goal, measured honestly — not a benchmark): time-to-green — a running app on the Android emulator and the iOS simulator, smoke-passing, with zero manual steps modulo the one Xcode App Store install. Target: under 5 minutes on a clean machine. Every scaffold ends with a
--verifybuild gate, so success is proven, not assumed.
Everything below is stamped from a template that builds green on Android + iOS — not regenerated per run, so it can't silently drift:
ksp.useKSP2=true). Frozen and CI-gated.project.yml (XcodeGen), Podfile (Firebase static
linkage), Info.plist, iOSApp.swift (AppDelegate + FirebaseApp.configure() before Koin),
ContentView.swift (ComposeUIViewController bridge).AndroidManifest, MainActivity with enableEdgeToEdge(), Application
starting Koin + Room, adaptive-icon structure.BaseScreen Scaffold owning window insets /
status- and nav-bar padding, plus a data-driven AppShell + bottom nav fed by your tabs list
(not role-hardcoded), with type-safe routes.core / data{local,remote} / domain{model,repository,usecase} / presentation{components,theme,navigation,<feature>} / di with Koin modules registered and one
example feature wired end-to-end as the copy-paste pattern.<Prefix>Theme, <Prefix>Tokens, <Prefix>Colors, DM Sans.specs/*.spec.md, Given/When/Then, stable clause ids) so a
specCoverage gate catches untested or untraceable behavior — plus the verify lane
(qa/verify.mjs) that runs it all and emits a typed PASS/FAIL/SKIP verdict + evidence receipt.add-feature/add-screen/add-repository skills (backed by the deterministic
qa/scaffold-feature.mjs stamper) that clone the exemplar feature end-to-end: Screen →
ViewModel → UseCase → Repository → DI → nav, tests at every layer, golden baseline included..claude/settings.json Stop hook
refuses "done" unless a fresh, evidence-bound PASS receipt covers the changed surface (content-
hash bound, rebase/merge-proof), and CI independently re-checks the committed receipt still
attests HEAD. Proven against real violations: hardcoded colors, illegal layer imports, deleted
spec tests, and structural regressions are each refused and named by clause, 4/4 in the
repo's refusal-demo script.curl -fsSL https://get.maestro.mobile.dev | bash.127.0.0.1:9500, loopback, structurally absent from release). An agent runs connect_live and
reads the running UI as JSON — hierarchy, geometry, resolved design tokens, real navigation
state. Never screenshots. Toggle with --no-inspector; create-cmp doctor verifies it stays
debug-only and that every declared theme token is served on /inspect/design-system.http://127.0.0.1:9500/inspect/remote
(after adb forward tcp:9500 tcp:9500) to watch the real device and click the image to tap it,
while the agent drives navigate_and_inspect on the semantics tree and proves every change with
prove_change. Pixels for the human, structure for the AI../gradlew :composeApp:hotRunDesktop --auto); Firebase never initializes on desktop
(offline DI fakes). Toggle with --no-dev-client.google-services.json / GoogleService-Info.plist are intentionally not real — you get
placeholders and clear "drop your Firebase config here" instructions.
| Option | Choices | Default |
|---|---|---|
| Platforms | Android (always) + iOS | iOS on |
| App name / package / iOS bundle id | — | required / derived |
| Firebase region | any Firebase region | us-central1 |
| Firebase (GitLive KMP) | on / off | on |
| Auth | email / phone / both / none | both |
| Firebase services | Firestore · Storage · Functions · FCM | all on |
| Room local cache | on / off | on |
| E2E flows (Maestro) | on / off | on |
| Bottom-nav tabs | label + icon, any count | Home, Profile |
(Web/PWA is intentionally out of scope — Android + iOS only.)
create-cmp also ships as a Claude Code plugin — one
shared engine, two front doors. Install from the bundled marketplace:
/plugin marketplace add kvdm-co-pilot/create-cmp
/plugin install create-cmp
No /plugin UI available (headless/non-interactive sessions)? See
the settings.json fallback in docs/USAGE.md — it's a real two-step
install (marketplace registration, then plugin install), not a one-line tweak.
It bundles eight skills (plus the cmp-inspector MCP server), each with a deterministic engine
behind it:
navigate_and_inspect), wireframe rendering, and prove_change — the verified dev loop../gradlew :composeApp:hotRunDesktop --auto) — the Expo-style dev loop for KMP.This isn't a knock on React Native — it's about defaults. The only place CMP loses to RN on a new
app is time-to-first-green-build, and that's a tooling problem, not a merits problem. With
create-cmp, CMP's npx-and-go is competitive:
If create-next-app made React the default for the web by removing setup friction, the goal here is
the same for multiplatform mobile.
Front doors: npx create-cmp-cli + Claude Code plugin (cmp-new / cmp-doctor / cmp-qa-prep)
│ one shared engine, two front doors
Engine (Node, deterministic): copy → token-replace → rename packages → toggle features → VERIFY
Golden template (frozen, CI'd): pinned versions · iOS shell · nav+insets · Clean Arch · DI · test pyramid
The engine never puts an LLM in the hot path: it copies the template, replaces placeholders in file
contents and paths, atomically renames package directories, toggles features (Firebase / auth type
/ Room / the e2e harness — feature key e2e, renamed from appium in 0.3.0; the old
--no-appium flag still works as a deprecated alias), and runs the verify
build. Determinism is the moat. See
docs/ARCHITECTURE.md for the full design, and
docs/DOCUMENTATION.md for the map of every doc — what's
authoritative for what, and the standards each implements.
doctor detects and (with your consent) installs. The E2E flows
themselves run on Maestro, installed separately with
curl -fsSL https://get.maestro.mobile.dev | bash. Xcode itself must be installed from the App
Store; the doctor surfaces that as the one manual step.The full plan — six pillars from scaffold to store release, and the sequencing — lives in
docs/ROADMAP.md. The AI delivery harness itself (exemplars → conformance
gates → in-project generation → mechanical enforcement → observability) is complete — see
docs/HARNESS-PLAN.md for the per-layer detail. Near-term:
create-cmp-cli (npx create-cmp-cli@latest) — live on the registry;
0.3.0 (the harness release) is prepared and pending its own publish.docs/INSPECTOR-PLAN.md.create-cmp-cli@0.3.0 to npm (needs an interactive OTP session) + record the
asciinema demo (scaffold → add-feature → gate refuses a violation → fix → PASS).Issues and PRs welcome — see CONTRIBUTING.md and our Code of Conduct. The golden template is CI-gated: an upstream version bump must fail CI, not your generated project.
MIT © Karel van der Merwe and create-cmp contributors.
FAQs
Create production mobile apps (Android + iOS, one Kotlin codebase) with AI — the delivery harness for Compose Multiplatform, the current generation of cross-platform (Google-backed KMP, iOS stable since May 2025). A deterministic, non-interactive generato
The npm package create-cmp-cli receives a total of 0 weekly downloads. As such, create-cmp-cli popularity was classified as not popular.
We found that create-cmp-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.

Security News
Anthropic’s free OSS Scanner uses Mythos and other Claude models to find open source vulnerabilities and send maintainers reports with proposed fixes.

Security News
On Front Lines’ Early Adopters: CISO podcast, Andrew Becherer shares lessons from Datadog, weighs the long-term costs of AI-built tools, and explains how founders can actually gain a CISO’s trust.