A guided setup process for creating a new web app, from a local code repository through GitHub and AWS deployment. AWS is a cloud platform, and CDK is a way to define cloud resources in code.

It is for bootstrapping web apps with a private GitHub repository, an optional Route 53 domain, and a CodePipeline-driven CDK deployment.

It reduces the manual work and setup errors involved in creating repositories, cloud accounts, domains, and automated deployments. It pauses for confirmation before billable, long-lived, or destructive actions.

new-app — Skill for Claude Code by jpd44/mesh44-plugins

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add jpd44/mesh44-plugins --skill new-app

Clone the repo

git clone --depth 1 https://github.com/jpd44/mesh44-plugins

Made for: Claude Code.

Or install app-kit, the plugin that ships this one along with the rest of its 6 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/jpd44/mesh44-plugins/new-app/github.svg)](https://agentmods.dev/skills/jpd44/mesh44-plugins/new-app)

Your own site

<a href="https://agentmods.dev/skills/jpd44/mesh44-plugins/new-app"><img src="https://agentmods.dev/badge/skills/jpd44/mesh44-plugins/new-app/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/jpd44/mesh44-plugins/new-app"><img src="https://agentmods.dev/badge/skills/jpd44/mesh44-plugins/new-app.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 53 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,952 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00053	$0.02952
Opus 5.5	$0.00021	$0.01181
Sonnet 5.5	$0.00011	$0.00590
Haiku 4.5	$0.00005	$0.00295

Measured 1mo ago against content hash e859a8197f51, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

new-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

app-kit/skills/new-app/SKILL.md · 126 lines

How it starts

The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/app-kit:new-app — full app bootstrap

You are bootstrapping a new web app the way the reference apps daily-deutsch and munichmotoclub are set up. You must execute the local steps and prompt the user before any step that costs money, creates a long-lived AWS resource, or registers a domain. The user has opted into "execute with confirmation."

Assumed starting state

The user has a populated ~/.config/mesh44/config.json (copied from config.json.example and filled in). Preflight loads it and fails fast if it's missing.
The user is sitting in developer_dir from that config (or one of developer_dir_symlinks). All new apps go into ./<app-name> from there.
The user is signed into the AWS management account via AWS_PROFILE=mgt. Preflight verifies the account ID matches aws.mgt_account_id from config.
The user is signed into gh and is a member of github.org (from config) with repo + admin:org (or write:org) scopes. Preflight verifies this too.

If any of these are missing, preflight stops the run before any directory is created.

Step 0. Preflight — run before anything else

Invoke the preflight skill. It checks the config file, local CLIs, AWS mgt SSO session, GitHub auth + configured-org membership, and the CDK toolchain.

If preflight returns READY, continue to "Inputs to gather first" below.
If preflight returns NEEDS ATTENTION, stop — print the fix list it produced and wait for the user. Don't ask the app-name question yet, and don't run any other step. Once the user says they've fixed things, re-run preflight; only proceed when it comes back READY.

The reason: every later step assumes AWS_PROFILE=mgt works and gh can push to your configured org. Tearing down a half-created AWS account is much more painful than fixing an expired SSO token up front.

Inputs to gather first

Ask in two AskUserQuestion turns. Split deliberately so creative inputs don't sit next to billable infra decisions.

Read the full file on GitHub · 126 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 126 lines · 53 tokens per session scan A e859a8197f51

Subscribe to this mod's changes

new-app is a skill published in the GitHub repository jpd44/mesh44-plugins (2 stars, last pushed 2mo ago), licensed MIT. It adds 53 tokens to every session and 2,952 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

CI and CD Cloud DevOps and cloud Planning

mirrord-prev-env

Help users create and manage mirrord preview environments — running a modified service as an isolated pod in a shared Kubernetes cluster, scoped by an environment key and HTTP/queue traffic filtering, so teams can validate and review changes against real traffic without affecting live services. Use when a developer…

metalbear-co/mirrord · 122 tokens

mirrord-chaos

Help users chaos test their app with mirrord: inject artificial latency or connection errors into a mirrord session's outgoing traffic via per-session chaos rules managed with the mirrord chaos CLI. Use when a user wants to add latency or delay to outgoing connections or a dependency (e.g. a slow database), simulate…

metalbear-co/mirrord · 119 tokens

new-app