Craft Engine v3.21.0
The Python Framework for Expressive Web Applications
Build elegant, production-grade applications in Python with familiar MVC conventions. Craft ORM with dual-key UUIDs, Forge templates, Active Defense WAF, and visual CRUD builder — batteries included.
from craft.facades import Route, Auth, DB
from craft.orm.model import Model
class Post(Model):
__table__ = "posts"
fillable = ["title", "body", "user_id"]
def author(self):
return self.belongs_to(User)
# Expressive REST & Admin Routing
Route.resource("posts", PostController, write_middleware="auth")
Route.get("/admin", [AdminController, "index"])
.middleware("auth", "role:admin", "firewall")Up and Running in Seconds
From zero to a running application with migrations, seed data, and administrative UI — in four simple steps.
Clone & Configure
git clone https://github.com/msrjson/craftengine.gitcd craftengine/data && cp .env.example .envpython dev.py key:generateMigrate & Seed
python dev.py migrate --seedServe Local App
python dev.py serveRun with Docker
docker compose up -d --buildApp ready on localhost:9000
Everything You Need, Nothing You Don't
A full-featured framework that respects your time. Familiar MVC conventions tailored for Python developers who demand speed, clarity, and security.
Active Record & Dual-Key UUID
High-performance ORM with eager loading, relationships, soft deletes, query builder, and automatic UUID public resolution — on SQLite, PostgreSQL and MySQL.
Async ASGI Performance
A high-throughput ASGI core: synchronous controllers run in parallel on a thread pool, each borrowing a pooled database connection, with asynchronous controller support.
Active Defense & WAF Firewall
Built-in Web Application Firewall (SQLi, XSS, SSRF protection), honeypot attacker trapping, brute-force cooldown, and audit logging.
Visual & Terminal CRUD Builder
Generate full vertical slices in one command or via the visual web builder: DDL migrations, Models, FormRequests, Resources, and Admin UI.
Forge Template Engine
Expressive, autoescaped templates with directives such as @csrf, @auth, @guest, @can, @honeypot and component layouts.
Developer Console & CLI
Comprehensive CLI tooling: generators, interactive tinker console, database migrator, queue workers, task scheduler, and firewall management.
Security Is Part of the Engine
The dangerous defaults are closed before you write your first route — not left as a checklist for later.
Argon2id Password Hashing
Memory-hard hashing for new passwords; older bcrypt and PBKDF2 hashes stay verifiable and are upgraded on the next login.
AES-256-GCM Credential Vault
Third-party API keys and OAuth secrets are encrypted at rest with a key derived from the application key — never stored in plaintext.
Context-Bound Signed Tokens
Password-reset and verification tokens are bound to their purpose and context, with optional expiry, so a leaked token cannot be replayed elsewhere.
CSRF, Honeypot & Anti-Spam
Every state-changing form carries @csrf; public forms add honeypot and anti-spam checks compared in constant time, with every trigger recorded as a security event.
Authorization, Not Just Authentication
Gates, policies and role: middleware; the build fails if an admin route is ever declared without an authorizing guard.
Absolute Data Persistence
Forward-only migrations and soft deletes. Destructive commands such as migrate:fresh and db:wipe are banned in every environment.
A Skeleton You Copy, Not a Library You Fight
The repository is the base skeleton for a new application. Clone it, rename it, and the same codebase carries you from a blog to multi-tenant scale.
- data/the application, mounted as /app
- data/engine/the core, imported as craft.*
- data/app/controllers, models, policies, plugins
- data/routes/web and API routes
- data/resources/views/Forge templates
- data/database/forward-only migrations and seeders
- data/documentation/35+ guides and llms.txt
- data/tests/1,500+ pytest cases
- data/dev.pythe developer CLI
- .claude/rules/governance and quality gates
- .agents/skills for AI coding agents
Modules, Plugins, Container
Core engine, business modules and removable capability plugins, wired through a dependency-injection container and static facades — every service can be mocked in pytest.
Database-Backed i18n
Translations live in the database, not in flat files. Every project is born trilingual — English source, Brazilian Portuguese default, Spanish alternative — with ICU plurals.
Governed Releases
Version, release counter and changelog move together; tests, lint and the language gate must pass before a release is cut. English code, zero hardcoded user-facing copy.
Built for Humans and Coding Agents
Conventions a model already understands, documentation written for machines as well as people, and first-class agent tooling inside the framework.
Model Context Protocol
Declare RBAC-guarded AgentTool classes and expose them over MCP, so assistants and IDEs discover and call your application's tools securely.
Provider-Agnostic AI SDK
One AI facade for text generation and an agent orchestrator, with swappable drivers instead of vendor lock-in.
Machine-Readable Docs
llms.txt, llms-full.txt, CRAFT_ENGINE.md and agent skills give a coding agent the build loop, the limits and what is not built yet.
Parallel Requests on One Worker
Measured on the sample application with the bundled load tester, after moving the controller chain onto a thread pool with pooled connections.
Get Started
Install the framework and start building expressive applications.
Documentation
Comprehensive architectural and API guides for every component.
Source on GitHub
Read the code, open an issue, or send a pull request. MIT licensed.
Battle-Tested Codebase
1,500+ automated tests across SQLite, PostgreSQL, and modern Python runtimes.