Standards your agent can enforce
46 playbooks, 387 rules — each one learned the expensive way, written so a coding agent can verify your repository against it, fix what fails, or build the area right from the first line. Your agent, your plan: FlowKy hands over the standard and the prompt, and never bills a token for the work.
How a playbook runs
Pick a standard in VS Code (Ctrl+Alt+S). FlowKy writes it to .flowky/sota/<id>.md in your repository — yours to edit and version — and hands your own agent (Claude Code, Cursor, Codex, Aider, Gemini) one of three prompts: verify the repo rule by rule with file-level evidence, make it conform, or integrate the area from scratch. Reports land in your repo; a rule the agent cannot determine is reported as unknown, never guessed. And when your agent learns a lesson worth keeping, it writes the lesson back into the playbook — the library improves as you work.
Free for every connected account
The project-kickoff bundle: open an empty folder, describe the tool in one sentence, and your agent scaffolds it to online — stack chosen with reasoning, deploy and CI in the first slice, a landing page with real copy.
CI/CD that fails honestly and deploys boringly
10 rulesPipelines whose green means something, and deploys nobody watches nervously
Landing pages that convert honestly
10 rulesThe hero, the CTA, the proof and the speed — a first page that earns the click it asks for
Product copy that tells the truth
10 rulesInterface text, microcopy and claims — written from the user's side of the screen
Project kickoff that ships
10 rulesStack choice, day-one deploy and the order of work that gets a tool online fast
Secrets hygiene in code, env and CI
10 rulesWhere keys live, who can read them, and how they rotate — before encryption at rest even starts
SEO that survives a crawler
10 rulesMetadata, sitemaps, structured data and rendering — what a crawler actually sees
The full library, on the Pro plan
40 standardsSecurity, reliability, product quality, agents and MCP, and paying down technical debt — cross-referenced so one standard points at its neighbours instead of leaving a half-covered gap.
Accessibility that works under a keyboard
10 rulesFocus, semantics, contrast and honest ARIA — the floor, verified
Agent development: ten rules
8 rulesTen rules that each cost something, with the mechanical check that enforces each
API design that survives its consumers
10 rulesContracts, validation, errors, pagination and idempotency for HTTP APIs
Background jobs that fail loudly and retry safely
10 rulesQueues, idempotency, poison messages and the silence that looks like health
Building an agent-payable API
3 rulesMCP + x402 payments, with the dead ends already explored
Caching without lying to your users
10 rulesKeys, invalidation, stampedes and the staleness you chose versus the staleness you got
Canonical records & push signals
0 rulesDedupe within reach, notify the decider, never fake a permission
Chat UI, composers, overlays and honest copy
6 rulesThe chat surface itself: composers, streaming, overlays, and copy that tells the truth
Consuming MCP servers safely
10 rulesInstalling external MCP tools without handing them the workspace
Credentials & runtime identity
0 rulesRuntime identity without passwords: tokens, sessions, and how they're stored
Dependency hygiene and supply chain
10 rulesLockfiles, update cadence, audit noise and the cost of every install
Envelope encryption for secrets at rest
10 rulesWrapping data keys with master keys, and migrating existing plaintext safely
Errors that surface instead of vanish
10 rulesCatch blocks, retries, timeouts and user-facing failures that tell the truth
Exposing your product as an MCP server
10 rulesMaking your product callable by other agents: identity card, /mcp, tool contracts
Feature flags with a lifecycle
10 rulesFlags that launch, kill and expire — instead of accumulating as permanent forks
Fetching user-supplied URLs without SSRF
7 rulesServer-side fetches of URLs a user typed, without reaching your own network
File uploads without the classic holes
10 rulesValidation, storage, serving and processing of files strangers control
Findings that survive between runs
7 rulesfixed vs withdrawn vs regressed — audit results with an honest lifecycle
Git history someone can debug from
10 rulesCommits, branches and PRs as the forensic record they will eventually need to be
Hot wallets, sweep limits and custody safety
12 rulesHolding value on behalf of users without one bug draining all of it
i18n boundaries
6 rulesWhere translations exist, where they throw, and which strings never leave the code
Login, signup and recovery flows
11 rulesThe account lifecycle — signup, verification, reset, sessions — without the classic holes
Money, credits, secrets and provenance
10 rulesBilling, credit ledgers, secret handling and knowing where every number came from
Never report a limit as a total
8 rulesCounting honestly: capped scans, truncated lists and numbers that lie by omission
Observability that answers questions
10 rulesStructured logs, metrics and traces that debug incidents instead of decorating them
One mark, many surfaces
9 rulesFavicons, icons and brand assets generated from a single master
Operating an agent in public
7 rulesReliability, discovery and trust for an agent other people depend on (§4/§5/§9)
Paying down technical debt
10 rulesFinding, ranking and actually retiring debt — without a rewrite and without pretending
Plant every guarantee
11 rulesTest discipline that finds vacuous tests — checks that pass because nothing ran
Publishing and consuming demand signals
7 rulesDemand signals per the agent standard §6 — asking for work and answering asks
Rate limiting that protects without punishing
10 rulesKeys, algorithms, headers and the endpoints everyone forgets to limit
Schema migrations without downtime
10 rulesExpand/contract, backfills and rollback discipline for production databases
Shipping a VS Code extension
5 rulesManifest contributions, packaging, activation and progress that VS Code actually honours
Single source of truth
5 rulesFacts that must exist exactly once, and the drift that starts when they exist twice
Team & tenancy
0 rulesInvites, workspace switching, and evidence that never auto-joins anyone
The web security baseline
10 rulesCSP, CORS, cookies, XSS and CSRF — the headers and habits that stop the common attacks
Transactional email that arrives
10 rulesDeliverability, idempotent sends, honest templates and the unsubscribe law
Trust boundaries inside an LLM prompt
8 rulesSecure chat integration: who wrote each part of the prompt, made explicit
Web performance on a budget
10 rulesCore Web Vitals, bundle discipline, images and caching — measured, not vibed
Writing a detector that can actually fire
7 rulesChecks, linters and scanners that are proven able to detect what they claim to
Start with the free bundle
Install the extension, connect your account, open an empty folder — the kickoff flow is free end to end. Upgrade when the rest of the library earns it.