Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fusebase-dev/fusebase-flow/app-backendnpx skills add fusebase-dev/fusebase-flow --skill app-backendgit clone --depth 1 https://github.com/fusebase-dev/fusebase-flowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00092 | $0.11978 |
| Opus 5 | $0.00046 | $0.05989 |
| Sonnet 5 | $0.00018 | $0.02396 |
| Haiku 4.5 | $0.00009 | $0.01198 |
Grade A, and why
app-backend scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
When the app needs to receive webhooks from a third-party service (Asana, GitHub, Stripe, Monday, etc.), register the subscription with that provider **yourself** as part of the deploy — do not hand the user a `curl` / a How it starts
The opening of the file, as written. The whole thing — 976 lines — stays where its author put it; the contents beside it link to each section on GitHub.
App Backend
Multi-User Architecture
Apps are always multi-user. The backend serves requests from many users concurrently. Every design decision must account for this.
Per-user vs. shared state:
| Storage | Scope | Use for |
|---|---|---|
| httpOnly cookies | Per-user (per browser) | OAuth tokens, user preferences, session data |
| Dashboard rows (keyed by user ID) | Per-user (persistent) | User settings, saved state |
| Fusebase secrets / env vars | Shared (all users) | API keys, service-account credentials |
| In-memory variables | Shared (all users, lost on restart) | Short-lived caches only |
Common mistakes:
- ❌ Storing a user's OAuth token in an env var or in-memory config → all users share one token
- ❌ Storing a user's preference in a module-level variable → last user's preference wins for everyone
- ❌ Using env vars for per-user settings or selections → same value for everyone
- ❌ Using session/token-derived values (
ft:*, JWT pieces, rotating token IDs) as persistent row partition keys - ✅ Store per-user data in cookies or dashboard rows keyed by user
- ✅ Use env vars only for credentials/config shared across all users (e.g. OAuth client ID/secret)
Stable key as partition key (required)
For any persisted per-user data, derive the partition key from stable identity only:
- Use
userId/orgUserIdfrom a stable identity endpoint (getMe-style call) - Normalize to a canonical key (example:
user:<userId>) in one helper - Use the same key on all read/write paths
Do not derive partition keys from runtime app/session tokens. Tokens rotate, so token-derived keys cause "missing records after relogin" while data still exists under old keys.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 976 lines · 92 tokens per session scan A 137e7b07cb35
app-backend is a skill published in the GitHub repository fusebase-dev/fusebase-flow (9 stars, last pushed 7d ago), licensed MIT. It adds 92 tokens to every session and 11,978 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
lov-app-generator
Use when the user asks for "App生成器", "生成 Web App", "生成 Tauri App", "生成原生 macOS App", "Finder Quick Action", "只创建 web", or to standardize an existing app with branding, CI/CD, native integration, and Lovinsp where applicable.
lov-integrate-lovinsp
幂等集成 lovinsp (click-to-code) 到当前前端项目，并支持从 code-inspector 自动迁移。 Use when the user asks to "装 lovinsp"、"集成 lovinsp"、"接入点击跳转源码"、"click to code"、 "从 code-inspector 迁移"，or when scaffolding/upgrading a browser-rendered app that needs click-to-source support. Also trigger when another skill (例如 lov-app-generator) requires…
chrome-devtools
Use Chrome DevTools MCP to control and inspect a live Chrome instance for network, console, performance, rendering, and Deep debugging. Pairs with playwright-cli (deterministic interaction/E2E) — complements, not duplicates.
upload-report
Run automation and upload or verify Katalon Platform reports for Katalon Studio/KRE, JUnit XML, and Playwright reports. Use when you need to combine Katalon MCP project/result discovery with Katalon CLI execution, Katalon Report Uploader, or @katalon/playwright-reporter; configure report folders, report types…
playwright-execute
Run Playwright tests or suites and upload the resulting report to Katalon True Platform. Use when you need to execute Playwright scripts, package scripts, spec files, projects, or suites, configure or verify @katalon/playwright-reporter, upload Playwright reports with Katalon CLI/reporter commands, and verify uploaded…
test-case-to-playwright
Convert Katalon True Platform/TestOps manual test cases, test suites, or requirement-linked cases into Playwright TypeScript automation. Use when you need to fetch/read Katalon Platform test cases and implement Playwright scripts, create or adapt a Playwright framework, apply Page Object Model and fixtures, or…