
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
veryfront
Advanced tools
Veryfront is a full-stack framework for building AI-powered applications and agents with TypeScript and React.
It gives you agents, tools, workflows, and a complete React rendering stack in a single framework. Veryfront runs on Node.js, Deno, and Bun, and can be deployed anywhere or shipped through the Veryfront platform with built-in preview environments and production hosting.
Purpose-built for TypeScript and React, Veryfront gives you everything you need to build agentic full-stack applications out-of-the-box.
Agents — Build autonomous agents with model routing, system prompts, and tool calling. Agents reason about goals and iterate until they reach a final answer.
Tools — Define Zod-validated functions that agents can call. Tools are auto-discovered from the file system with no registration needed.
Workflows — Orchestrate multi-step AI pipelines with branching, parallelism, and human-in-the-loop approval gates.
Multi-Agent — Compose agents that delegate to each other as tools for complex, coordinated tasks.
Memory & Streaming — Give agents conversation history and streaming responses. Built-in chat UI components for React.
MCP Server — Expose agents, tools, and resources via the Model Context Protocol. Connect your coding agent to live errors, logs, and HMR.
Pages & Routing — File-based routing with React Server Components, layouts, and server-side rendering.
Data Fetching & API Routes — Server-side data loading, API route handlers, and middleware with built-in OAuth support.
The recommended way to get started with Veryfront:
npm create veryfront
pnpm create veryfront
yarn create veryfront
bun create veryfront
deno init --npm veryfront
Binary install (recommended for the CLI/TUI):
curl -fsSL https://veryfront.com/install.sh | sh
# or
brew install veryfront/tap/veryfront
Follow the Quickstart guide for step-by-step setup, or explore our templates to start building your first application with Veryfront. For the full documentation, visit veryfront.com/docs/code.
You can find standalone, runnable examples in the veryfront-examples repo.
Looking to contribute? All types of help are appreciated, from coding to testing and feature specification. Read CONTRIBUTING.md for more details on how to get involved.
If you are a developer and would like to contribute with code, please open an issue to discuss before opening a Pull Request.
We have an open community Discord. Come say hello and let us know if you have any questions or need help getting things running.
It's also super helpful if you leave the project a star here at the top of the page.
We are committed to maintaining the security of Veryfront. If you discover a security vulnerability, please responsibly disclose it to us at security@veryfront.com and we will respond within 48 hours.
Apache-2.0
FAQs
The simplest way to build AI-powered apps
The npm package veryfront receives a total of 1,403 weekly downloads. As such, veryfront popularity was classified as popular.
We found that veryfront demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.