
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
fastrack-cli
Advanced tools
Plain English CLI + MCP server that builds, runs, fixes, and improves workflows. Model agnostic. Local SQLite memory.
Plain English in the terminal. Workflows out.
FASTRACK is a Node.js CLI tool + MCP server. Describe what you want in plain English — FASTRACK parses your intent, builds a workflow from it, runs it against your connected tools, fixes itself when steps fail, and suggests improvements after a few successful runs.
~/.fastrack/fastrack.db. Nothing leaves your machine except the API calls you ask forfastrack report pulls activity from your tools and delivers a formatted report anywherefastrack note digests notes into decisions and action items, then builds workflows from themnpm install -g fastrack-cli
For development: clone this repo and run npm link.
Requires Node.js >= 22.
Fastest path — zero config. Grab a free key at console.groq.com, then:
export GROQ_API_KEY=gsk_... # PowerShell: $env:GROQ_API_KEY="gsk_..."
fastrack "summarize my open PRs" # works immediately
Or run the interactive setup:
fastrack init
The interactive setup walks you through:
Then just talk to it:
fastrack "summarize my open PRs and add the summary to Notion"
fastrack "every morning at 9am summarize open PRs and add to Notion"
fastrack "what are the recent commits in my repo?"
| Command | What it does |
|---|---|
fastrack init | Interactive setup (model + tools) |
fastrack connect <tool> | Connect github, notion, slack, discord, telegram, linear, airtable, jira, email, or webhook |
fastrack "..." | Any plain English command |
fastrack report | Status report from your tools (--scope "GTM", --send slack,email,notion, --to you@x.com) |
fastrack note | Digest meeting notes (fastrack note "...", --file notes.md, or pipe stdin; --yes to auto-create workflows) |
fastrack workflows list | Table of all saved workflows |
fastrack workflows run <id|name> | Run a saved workflow |
fastrack workflows delete <id|name> | Delete a saved workflow (and its history) |
fastrack workflows share <id|name> | Export a workflow as JSON |
fastrack workflows import <file> | Import a workflow from JSON |
fastrack model add | Add another model |
fastrack model use <provider> | Switch active model |
fastrack model compare "<prompt>" | Run a prompt on every configured model |
fastrack model list | Show configured models |
fastrack memory show | Everything FASTRACK knows |
fastrack memory clear | Wipe the local database |
fastrack daemon | Keep recurring workflows firing (long-running) |
fastrack mcp start | Start the MCP server (stdio) |
All model configs live in ~/.fastrack/fastrack.config.json — never in the repo, never hardcoded. You can register multiple models and FASTRACK routes each request:
fastrack init, or just set GROQ_API_KEY — no setup at all (defaults to llama-3.3-70b-versatile, override with FASTRACK_MODEL)fastrack model compare "..." runs the same prompt on all of them side by sideCustom provider? Any OpenAI-compatible endpoint works:
fastrack model add # pick "custom", paste base URL + key + model name
No model account at all? Use the managed relay (deployed on Vercel by the project owner). It speaks the OpenAI protocol, so it plugs in as a custom provider:
fastrack model add
# provider: custom
# base URL: https://fastrack-relay.vercel.app/v1
# API key: <client token issued by the owner>
# model: openai/gpt-oss-120b
The relay holds the real Groq key server-side, so users never need their own provider account. See relay/README.md for deployment.
The database lives at ~/.fastrack/fastrack.db. fastrack memory clear wipes it. That's the whole surface.
When a step fails, FASTRACK:
failed and you see exactly which step brokeAfter every 3rd successful run, FASTRACK analyzes the last 10 runs and offers an optimization. On the CLI it asks Apply? (y/n); over MCP it includes the suggestion in the response instead of blocking on a prompt.
Recurring workflows need a long-running process — cron timers die when a process exits:
fastrack daemon # dedicated scheduler process
fastrack mcp start # the MCP server also runs schedules in the background
A one-shot CLI call parses and runs, but it cannot keep schedules alive by itself.
fastrack workflows share 3 # writes fastrack-workflow-3.json to the current directory
fastrack workflows import fastrack-workflow-3.json
Shared files contain the workflow definition only — never your credentials.
Add to your Claude Code / Cursor MCP config:
{
"mcpServers": {
"fastrack": {
"command": "fastrack",
"args": ["mcp", "start"]
}
}
}
You then get these tools: fastrack_run, fastrack_workflow_list, fastrack_workflow_run, fastrack_workflow_share, fastrack_memory_show, fastrack_model_compare, fastrack_connect, fastrack_report, fastrack_note.
Everything lives in ~/.fastrack/fastrack.config.json:
{
"models": [{ "provider": "openai", "apiKey": "...", "model": "gpt-4o-mini" }],
"activeModel": "openai",
"connectors": { "github": { "token": "...", "owner": "...", "repo": "..." } },
"preferences": { "autoSelect": true, "simpleModelThreshold": 500 }
}
This file holds API keys — it lives in your home directory, outside any git repo. fastrack.config.json is never created inside the project.
npm test
The suite runs fully offline: a fake OpenAI-compatible model server (test/helpers/fake-model.js) stands in for the LLM, and FASTRACK_HOME redirects all state (config + SQLite) to a temp directory, so your real ~/.fastrack is never touched.
MIT
FAQs
Plain English CLI + MCP server that builds, runs, fixes, and improves workflows. Model agnostic. Local SQLite memory.
We found that fastrack-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.