Roadmap

Vector RAG Chunking Chunk & embed documents for semantic retrieval

Split documents on semantic boundaries, embed the chunks, and rank by vector similarity — retrieval that understands meaning, not just keywords. Pairs with the Runbook knowledge base and the existing search_* MCP tools so Claude answers from your own content.

SmallStack Tabler A professional-theme edition for UI-forward apps

A downstream starter that forks and tracks this repo, swapping the admin chrome for Tabler — dashboards, charts, kanban, and calendar for when the UI is the product.

Authentication & Profiles Login, signup, password reset, and user profiles — ready out of the box

Login, signup, password reset, email verification. User profiles with auto-creation signals. Staff and superuser roles built in.

Activity Tracking See who's doing what with a built-in staff dashboard

Request-level activity logging with a staff dashboard. Tracks page views, user actions, and provides audit trail visibility with auto-pruning.

Theming & Templates Dark/light mode, sidebar layout, and branding you can customize with CSS variables

Dark and light mode with CSS variables. Admin-style sidebar layout with template inheritance. Breadcrumbs, nav helpers, and branding system.

Database Backups Scheduled SQLite backups with a dashboard and email alerts

SQLite backup with management command, web dashboard, cron scheduling, retention policies, and email failure notifications. Staff-only access.

Deployment (Docker + Kamal) Zero-downtime Docker deploys with Kamal, SSL, and health checks

Docker container with Kamal for zero-downtime deploys. Let's Encrypt SSL, health checks, persistent volumes, and local registry — all preconfigured.

Background Tasks Database-backed task queue — no Redis or Celery needed

Django 6's built-in task framework with database-backed queue. Worker process included in Kamal deployment. No Redis or Celery required.

CRUD Library (CRUDView) Build data views without boilerplate — list, detail, create, edit, delete

Reusable views for list, detail, create, edit, and delete — with pagination, search, and form styling that matches the SmallStack theme. Build data-driven apps without writing boilerplate views.

User Manager Manage accounts, roles, and permissions without Django Admin

Staff-facing UI for managing user accounts, roles, and permissions. View user activity, toggle active status, assign staff/superuser roles, and manage profiles — without reaching for Django Admin.

Help System & Slides Markdown docs, search, slide decks, and custom content sections

The help app renders Markdown files with YAML front-matter, section-based navigation, search, and syntax highlighting. The slide deck system turns Markdown into interactive presentations with progress tracking.

API Framework Integration DRF or Django Ninja — preconfigured to match SmallStack conventions

API framework with serializers, viewsets or endpoints, authentication, and pagination — preconfigured to match SmallStack conventions. Build hybrid apps that serve both templates and JSON.

CORS, Auth & API Docs Token auth, CORS, and auto-generated API docs for hybrid apps

CORS configuration for cross-origin requests. Token-based authentication for API clients. Auto-generated API documentation. Support for hybrid apps that serve both templates and API endpoints.

Token Manager Staff UI for issuing, revoking, and managing API tokens

Staff-facing interface for managing API tokens. Issue, revoke, and track token usage without touching the database directly. Integrates with the authentication system for secure API access control.

Runbook — Versioned Docs In-app markdown knowledge base with version history and search

Write operational docs in Markdown right in the app. Every save keeps an immutable version you can restore; full-text search finds anything; retention policies prune the rest. Reach the same document from the web UI, REST API, the rb CLI, or Claude over MCP — and export a runbook to a portable ZIP whenever you need it offline.

SmallStack CLI (sc) A fifth surface over the CRUDView registry — your whole app from the terminal

manage.py sc (or the sc console script) is a thin skin over the same CRUDView registry as web, REST, and MCP. Read with ls, get, describe, and search; write with staff-gated new/set/rm through the model's form validation and audit log. Operational verbs (doctor, backup, token, status) front the framework commands, and --json is on every read.

SearchBuilder — Custom Search Programmable search variants, each with its own MCP tool

Beyond enable_search = True, an optional SearchBuilder lets a model define tailored search variants (admin, public, api, mcp) with computed fields, custom display, and cross-model orchestration. Each variant auto-generates its own MCP tool for agent workflows, and results serialize to JSON natively — no DRF dependency.

Bundled API Clients (JS + Python) Typed TypeScript/JS SDK and a single-file Python client

Talk to the REST API from any external app with the clients shipped under clients/: a TypeScript/JavaScript SDK (with a built dist/, SSR-safe) and a single-file Python client. The same clients power the React, Svelte, Solid, and Streamlit frontend guides.

Recurring & Scheduled Tasks Define recurring jobs in Python with @scheduled — no cron

A @scheduled primitive for jobs that run themselves — cron, interval, or once — declared straight from Python. A themed schedule UI at /smallstack/scheduler/, REST + MCP tools, and a per-minute tick, all on the same database-backed worker. No crontab, no external beat process. Each job opens onto a control console: Run now leads the page, the cadence editor sits beside a live next-five-runs preview, and a fire that has come and gone reads as overdue rather than hiding a stalled worker behind a future-looking date.

Webhooks — Inbound & Outbound A foundational integration surface — signed delivery + receivers

Flip enable_webhooks = True for signed outbound delivery on model changes; receive and verify inbound events with @webhook_handler. Four extension seams turn Zapier, n8n, Stripe, Slack, and Event Grid into plug-ins, with first-class SmallStack↔SmallStack pairing, stable event_id dedupe, and bulk dead-letter replay. Which events an endpoint receives is a checkbox picker that annotates every option in plain English, and a malformed pattern is rejected when you save instead of quietly matching nothing.

RSS / Atom Feeds Publish any model as a feed, or consume external feeds on a schedule

Publish a curated Feed over your own scoped queryset as RSS 2.0 or Atom 1.0 (enclosures and podcasts included), or register an external feed source and let the collector pull it into a model on a schedule. First-party publish and consume, both directions.

Datasets (@dataset) Expose a filtered queryset as typed rows/columns for dashboards & charts

The @dataset primitive turns a filtered queryset into typed rows and columns — with bucketed grouping, drilldown, ratio measures, and date ranges — served over REST and MCP with schema introspection. The clean seam a dashboard, report, or chart UI builds on.

Approvals — Human-in-the-Loop A person says yes before the risky step runs — and an agent can wait for them

A side-car approval gate for any action that needs a human first: refund the order, publish the schedule, let the agent run the destructive operation. Declare a kind with @approval_kind, file a request with request_approval(), and a person decides in the themed console or inside your own page via the {% approval_card %} embed. Your code reacts through a per-kind callback, a signal, a webhook event, or a polled REST/MCP status — what “approved” means stays app-owned.

The canonical AI pattern is built in: an agent calls the request_approval MCP tool and polls get_approval until a human decides, so an autonomous workflow pauses on a real decision instead of guessing. Every transition is race-safe and audited, and fans out to in-app notifications and branded email.

Notifications — Bell & Inbox One notify() call becomes a topbar badge and an inbox row that links back

A generic in-app notification primitive. Call notify() and the recipients get a topbar bell badge plus an inbox row that deep-links to the page that matters. It never raises — a notification failure can't break the action that caused it — and it skips the actor, inactive accounts, and duplicate recipients on its own. Approvals is the first producer; the same call works for anything a signed-in user should notice on their next visit.

Logs & Telemetry Read your logs without a shell — from the browser, REST, the CLI, or an agent

Log lines are written to the database as well as the stream, so they stay readable from inside the app — the answer when the container is locked down or the platform gives you no shell. The staff viewer at /smallstack/logs/ filters by level, logger, and time, searches messages and tracebacks, and expands a row to its full traceback and structured extra fields. The baseline is WARNING; a capture window turns it up for a fixed period and closes itself.

Correlation is wired in: every request's X-Request-ID is injected into each log line emitted while handling it, and background tasks and scheduler ticks get a trace_id bound automatically. All of it is machine-drivable — /api/logger/ for CI or a dev panel, five MCP tools so an agent can turn capture up, reproduce, correlate, and turn it back down, and manage.py logs from the shell.