PlugWiki

tanstack-start-best-practices Skill (DeckardGer) for Claude: What It Does and How to Install It

Makes Claude follow 32 TanStack Start rules for server functions, middleware, SSR, authentication and deployment.

Installs
9.9K
on skills.sh
Stars
228
on GitHub
Files
32
besides SKILL.md
Updated
Sep 2026
last repo commit

This skill is a rulebook for TanStack Start. It has 32 rules in 10 categories, ranked from critical to low. The critical ones cover server functions and security. Each rule file shows a bad example, a good example and when to apply it.

It triggers when you build full-stack apps with TanStack Start. It is not made by TanStack. It bundles no scripts, only SKILL.md and 32 rule files.

Good for

  • React developers building full-stack apps with TanStack Start
  • Teams adding auth, sessions and middleware to a Start app
  • Anyone reviewing server functions and SSR setup for mistakes

Install tanstack-start-best-practices

Claude Code

  1. 1

    Copy this prompt.

    Install the tanstack-start-best-practices skill in Claude Code. Run this command:

npx skills add https://github.com/deckardger/tanstack-agent-skills --skill tanstack-start-best-practices

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

From its listing on skills.sh. Source.

What's in the skill

When it loads

TanStack Start best practices for full-stack React applications. Server functions, middleware, SSR, authentication, and deployment patterns. Activate when building full-stack apps with TanStack Start.

Sections in SKILL.md

  1. When to Apply
  2. Rule Categories by Priority
  3. Quick Reference
  4. Server Functions (Prefix: sf-)
  5. Security (Prefix: sec-)
  6. Middleware (Prefix: mw-)
  7. Authentication (Prefix: auth-)
  8. API Routes (Prefix: api-)
  9. SSR (Prefix: ssr-)
  10. Environment (Prefix: env-)
  11. Error Handling (Prefix: err-)
  12. File Organization (Prefix: file-)
  13. Deployment (Prefix: deploy-)
  14. How to Use
  15. Full Reference

Key facts

Author
DeckardGer (repo owner)
License
MIT
Installs on skills.sh
9,886 (Nov 2, 2026)
GitHub stars
228 for the whole deckardger/tanstack-agent-skills repo (Nov 2, 2026)
Last repo commit
Sep 9, 2026
Audits on skills.sh
Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass
What it includes
33 files including SKILL.md: 32 rule files in rules/ (no scripts)
Part of
The DeckardGer/tanstack-agent-skills repo, which has 4 skills (query, router, start, integration)

What it includes

  • createServerFn, input validation, method choice, errors, response headers

    Prefix sf-.

    Write · Server Functions (5 rules, CRITICAL)

  • Validate inputs, auth middleware, server-only secrets, CSRF protection

    Prefix sec-.

    Write · Security (4 rules, CRITICAL)

  • Request and function middleware, context flow, composition

    Prefix mw-.

    Write · Middleware (4 rules, HIGH)

  • Sessions, route protection with beforeLoad, server-side checks, cookie settings

    Prefix auth-.

    Write · Authentication (4 rules, HIGH)

  • Routes for external consumers

    Rule api-routes.

    Write · API Routes (1 rule, MEDIUM)

  • Data loading, hydration safety, streaming, selective SSR, prerendering

    Prefix ssr-.

    Write · SSR (5 rules, MEDIUM)

  • Server errors, redirects, not-found

    Prefix err-.

    Write · Error Handling (3 rules, MEDIUM)

  • Environment functions for configuration

    Rule env-functions.

    Write · Environment (1 rule, MEDIUM)

  • Separate server and client code, .functions.ts files, shared validation

    Prefix file-.

    Write · File Organization (3 rules, LOW)

  • Environment variables and deployment adapters

    Adapters are set in vite.config.ts, per deploy-adapters.md.

    Write · Deployment (2 rules, LOW)

From the official docs

Permissions

Medium risk

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • It changes your app code, including auth and secrets handling

    The rules cover server functions, auth middleware, sessions, cookie settings, CSRF protection and server-only secrets (SKILL.md categories Security and Authentication). Claude applies them by writing or editing your code, so review auth, cookie and secrets changes before you ship. github.com

  • A rule file shows dependency install commands

    rules/deploy-adapters.md includes pnpm add -D @cloudflare/vite-plugin wrangler and npm install -D @netlify/vite-plugin-tanstack-start as examples. If Claude follows them, it installs third-party packages into your project. github.com

Security advisories

No published security advisories as of Nov 2, 2026.

Technical details
Turning on read-onlyNo read-only mode. You can ask Claude to review code against the rules without editing it.
Sign-in and keysSKILL.md does not mention any account or key.
Scopes

  • Writes TanStack Start application code in your project, including server functions, middleware, session and cookie handling

  • Its deploy-adapters rule shows package install commands for Cloudflare and Netlify adapters

Questions

What does the tanstack-start-best-practices skill do?

It gives Claude 32 rules for building full-stack React apps with TanStack Start. The rules cover server functions, security, middleware, authentication, SSR, error handling and deployment. Each rule has a bad and a good example.

Is this made by TanStack?

No. It is not by TanStack. It is by the repo owner, DeckardGer, in the tanstack-agent-skills repo.

How do I install it?

Use the install box at the top of this page. The README's command, npx skills add DeckardGer/tanstack-agent-skills, installs the whole repo, which has 4 TanStack skills. The box installs just this one.

Do I need the other TanStack skills in the repo?

No. SKILL.md does not require them. The repo also has skills for TanStack Query, Router and a Query plus Router plus Start integration, which are useful if you use those libraries.

Which clients does it work in?

The README says it works with any agent that supports AGENTS.md, including Claude Code, Codex and Opencode. It also mentions Cursor for a manual setup.

Are the rules current?

The deploy-adapters rule calls the old app.config.ts preset pattern no longer valid and uses vite.config.ts with tanstackStart(). Check the rules against the TanStack docs for your version.

Is it safe?

It bundles no scripts, only SKILL.md and 32 rule files. Claude will write server code that handles sessions and secrets for your app, so review auth and cookie code before you ship it.

Information

updated Nov 2, 2026

Repository
deckardger/tanstack-agent-skills
Folder
skills/tanstack-start

deckardger/tanstack-agent-skillsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4
  1. tanstack-start SKILL.md · github.com
  2. tanstack-agent-skills README · github.com
  3. sec-csrf-protection.md · github.com
  4. deploy-adapters rule · github.com

Updated Nov 2, 2026.