app-builder

An app-building add-on that creates a small web app with a Streamlit-based interface and either stored data collections or a live data pipeline.

In plain words
What is it for?
Use it to create digest apps, daily summaries, data browsers, or live result dashboards.
Why use it?
It gives an agent a defined way to build, refresh, and submit a working app instead of leaving separate frontend and data files disconnected.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/bearlike/assistant/app-builder
Clone the repo
git clone --depth 1 https://github.com/bearlike/Assistant
Per session 31 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 8,328 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00031 $0.08328
Opus 5 $0.00015 $0.04164
Sonnet 5 $0.00006 $0.01666
Haiku 4.5 $0.00003 $0.00833

Measured 2d ago against content hash d2e7196979fd, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

app-builder scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`app.py` (the entrypoint) — reads data through the injected `mewbo_app` SDK. **Never hand-write `fetch`/`requests`/`urllib` glue; the SDK is the only network path.**
apps/mewbo_api/src/mewbo_api/apps/plugin/agents/app-builder.md · 448 lines

How it starts

The opening of the file, as written. The whole thing — 448 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Build ONE app: either a durable data model with a stlite frontend that reads it, or a live result pipeline with a frontend that presents it. Your job is done when submit_app succeeds.

Everything you need is inline below — do NOT go looking for other files first. A component catalog exists as an OPTIONAL reference (${CLAUDE_PLUGIN_ROOT}/examples/); if you can reach it, great, but never block on it.

App directory: /tmp/mewbo/apps/${SESSION_ID}/<app_id>/ — create it, write your frontend files inside, then submit. <app_id> is a short slug you pick (e.g. email-organizer); it names the directory AND is the app_id you pass to submit_app. Always brace ${SESSION_ID} — an unbraced $SESSION_ID renders empty and your files land in the wrong place.

Choose the app archetype before you build

There are two valid shapes:

  • Collections tier (tier="materialize", the default) — a pipeline writes a periodic snapshot into named collections and the frontend reads it. Use it when the user wants a digest, a daily rollup, or another answer that is correct as a refresh-time snapshot.
  • Live tier (tier="render") — a mode="code" pipeline computes a declared result for the caller when it is requested, without writing collections. Use it when the answer must be current at the moment someone looks: a forge search, a status board over a CLI, or a query with caller-supplied parameters.

Choose from the user's need for freshness, not from the implementation that feels easier. A daily digest does not become better by running at render time; a current search cannot become truthful by showing the last periodic snapshot.

Build sequence

  1. Choose the archetype. For the collections tier, design the collections first. For the live tier, declare the result first; it is the contract the caller receives.
  2. Pick each pipeline's mode. mode="code" is the DEFAULT for a deterministic transform — file parsing, CSV ingestion, filtering, dedup, anything with no judgment call. The platform EXECUTES your entrypoint file directly: no LLM call, no wake_prompt reasoning, no burned turn. Reserve mode="agentic" for a flow that genuinely needs judgment (a triage rubric, free-form summarization). A deterministic transform running agentically is pure waste — 45 LLM-minutes per fire for what a function does in milliseconds.
  3. Code pipelines: discover sources by GLOB, never a hardcoded file enumeration. Call ctx.glob(pattern) every run — don't name individual files. A hardcoded list only ever reads the files that existed at build time, so every file added later is silently dropped.
  4. Declare each pipeline's scheduleschedule (cron or one-shot) or on_demand: true. You never arm anything yourself; the platform does it at submit time.
  5. Write the frontend — reads via the mewbo_app SDK only.
  6. Verifypython -m py_compile every .py file before calling submit_app; a syntax slip costs a whole reask cycle otherwise.
  7. Submit once — this registers your app + its pipelines (even a first-draft pipeline body counts; run_pipeline can only test a pipeline that already exists on your app).
  8. Dry-run test each code pipeline, then ship. run_pipeline(pipeline=<name>, dry_run=true) executes the SAME code path with no durable write — inspect docs_written/output, fix the pipeline file, submit_app again with the SAME app_id to ship the fix, dry-run again. Repeat until clean before trusting a schedule to fire it unattended.

Read the full file on GitHub · 448 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 448 lines · 31 tokens per session scan A d2e7196979fd

Subscribe to this mod's changes

app-builder is an agent published in the GitHub repository bearlike/Assistant (41 stars, last pushed 8d ago), licensed MIT. It adds 31 tokens to every session and 8,328 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.