
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
render-create
Advanced tools
CLI to scaffold and deploy applications on Render with best practices, Cursor rules, and Infrastructure as Code
CLI tool to scaffold Render projects with Cursor rules, linting configs, and templates. Supports both preset-based and composable project creation.
npx render-create my-app
That's it. You'll get an interactive prompt to choose your stack, and a fully configured project ready to deploy.
render.yaml Blueprint# Interactive mode (recommended)
npx render-create my-app
# Use a preset directly
npx render-create my-app --preset fastify-api
# Composable mode - pick your own stack
npx render-create my-app --composable
# Keep existing project rules in sync
npx render-create sync
# Check if rules are up to date (CI-friendly)
npx render-create check --ci
| Preset | Stack | Database |
|---|---|---|
next-fullstack | Next.js + Tailwind + Drizzle | PostgreSQL |
next-frontend | Next.js + Tailwind (static) | - |
vite-spa | Vite + React + Tailwind | - |
fastify-api | Fastify + Drizzle + Zod | PostgreSQL |
fastapi | FastAPI + SQLAlchemy | PostgreSQL |
multi-api | Fastify + FastAPI side-by-side | - |
Build exactly what you need by mixing components:
npx render-create my-app --composable
Every project includes:
my-app/
├── src/ # Your application code
├── .cursor/rules/ # AI coding assistance rules
├── render.yaml # Infrastructure as Code
├── biome.json / ruff.toml # Linting configuration
└── package.json # Dependencies
The generated render.yaml defines your entire infrastructure:
services:
- type: web
name: my-app
runtime: node
buildCommand: npm install && npm run build
startCommand: npm start
healthCheckPath: /health
envVars:
- key: DATABASE_URL
fromDatabase:
name: my-app-db
property: connectionString
databases:
- name: my-app-db
postgresMajorVersion: 16
AI-assisted development with framework-specific guidance:
| Rule | Description |
|---|---|
general.mdc | Project conventions and patterns |
typescript.mdc | TypeScript best practices |
react.mdc | React and component patterns |
nextjs.mdc | Next.js App Router conventions |
fastify.mdc | Fastify API patterns |
drizzle.mdc | Drizzle ORM usage |
workflows.mdc | Render Workflows SDK |
After scaffolding, deploy in one click:
Or connect your repo to Render and it will automatically detect the render.yaml Blueprint.
render-create [name]Create a new project. If no name is provided, you'll be prompted.
Options:
-p, --preset <name> - Use a preset (skip prompts)-c, --composable - Enable composable mode-y, --yes - Accept defaultsrender-create syncUpdate Cursor rules to the latest version.
Options:
-f, --force - Overwrite without prompting--dry-run - Preview changesrender-create checkVerify rules are in sync.
Options:
--ci - Exit code 1 if out of syncWe welcome contributions!
# Clone and setup
git clone https://github.com/R4ph-t/render-create-demo.git
cd render-create-demo
npm install
# Build and test
npm run build
npm test
# Test locally
npm link
render-create my-test-app
To create a new release:
npm run release:patch # 1.0.0 → 1.0.1
npm run release:minor # 1.0.0 → 1.1.0
npm run release:major # 1.0.0 → 2.0.0
This will automatically:
package.jsonGitHub Actions will then create a release with auto-generated release notes.
MIT - see LICENSE for details.
FAQs
CLI to scaffold and deploy applications on Render with best practices, Cursor rules, and Infrastructure as Code
The npm package render-create receives a total of 1 weekly downloads. As such, render-create popularity was classified as not popular.
We found that render-create demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.