# MKStack — The Framework Layer

*The React/Vite/Tailwind scaffold every Nostr client on this stack forks from — and the piece that decides whether Claude Code, Cursor, Windsurf, or a custom Dojo-driven orchestrator can build here without Shakespeare, on any model provider.*

**Verified: 2026-07-09 · Delta pass: 2026-07-10** (NostrDeploy.com DNS tripwire; Stacks-platform relationship sharpened)

**Amended: 2026-07-10** (v2 wave) — resolved `.mcp.json` concretely (nostr/js-dev packages + the five nostrbook tools, live-confirmed); cross-referenced new ch. 12 for the full 19-skill enumeration; catalogued all 17 Toybox experiments and disambiguated Chorus/Treasures/Blobbi source status; added the commit-pin + fetch-only-upstream pinning discipline, cross-ref ch. 15; flagged NostrHub's shared license-absence class with MKStack.

Confidence:
- **High** — scaffold anatomy, dependency versions, and the AGENTS.md/`.mcp.json`/`opencode.json` agent-compatibility findings (all fetched directly from the live repo). Also high for mkstack-nsp's AGPLv3 license (full text fetched).
- **Medium-High** — the mkstack template's license *absence*: well-evidenced (four 404s, no SPDX identifier, no GitLab-detected license, silent toolbox page), but Soapbox wasn't asked directly.
- **Medium** — Cursor/Windsurf compatibility: no dedicated rules file found for either; plausible but unconfirmed.
- **Low** — MKStack's exact public launch date: no dedicated announcement post found; repo-creation date used as proxy.

---

## What It Is

MKStack is Soapbox's Nostr client scaffold: a React 19 + Vite + Tailwind v4 template pre-wired with Nostrify, shadcn/ui, and roughly twenty documented NIPs, at `gitlab.com/soapbox-pub/mkstack` [2], marketed at `soapbox.pub/mkstack` [1], product domain `mkstack.xyz` [2][13]. It is a **template you fork, not a standalone CLI** — the CLI that scaffolds it is a separate product, Stacks (`@getstacks/stacks` on npm) [16][17]. Get the direction of that relationship right: **Stacks 1.0 (released 2025-08-20) is the generic template-sharing platform** — templates publish as kind 30717 events and anyone can publish one [17][18] — **and MKStack is just one published stack on it**: Soapbox's own flagship stack, not the platform itself. Shakespeare is one client of a shared protocol, not MKStack's only front door.

| Fact | Value | Source |
|---|---|---|
| Canonical repo | gitlab.com/soapbox-pub/mkstack | [2][10] |
| Product domain | mkstack.xyz | [2][13] |
| Repo created | 2025-04-17 | [10] |
| Commits on main / branches / tags | 509 / 20 / 0 | [10] |
| Last activity | 2026-07-09 — today | [10] |
| GitLab stars / forks | 2 / 2 | [10] |
| GitHub mirror | None found (404 on both mkstack and mkstack-nsp) | [20] |
| package.json name/version | `"mkstack"`, `"0.0.0"`, `private: true` | [4] |

Timeline: mkstack created 2025-04-17 → mkstack-nsp (the NSP backend, AGPLv3) created 2025-06-23 [12] → Shakespeare announced/launched 2025-07-10/14 (ch. 04) → Stacks 1.0 released 2025-08-20 [18] → Shakespeare Act 2, 2025-10-01 (ch. 04) → both repos still live today, mkstack committed *this same day* [10][21].

```mermaid
flowchart TB
    T["mkstack template repo\nReact 19 + Vite + Tailwind v4 + Nostrify\nAGENTS.md + skills + .mcp.json"]
    NSP["mkstack-nsp\nreference Nostr Service Provider, AGPLv3\nDork sandboxed agent, Deno"]
    PROTO["NIP.md protocol (lives in mkstack-nsp)\nkind 31999 discovery\nkind 25742 RPC / 25743 notify"]
    SHAKE["Shakespeare\nbrowser thin-client"]
    STACKSCLI["Stacks CLI\nstacks mkstack / stacks agent"]
    LOCAL["Local agent session\nClaude Code, OpenCode, Cursor, Windsurf"]
    DEPLOY["Deploy\nNostrDeploy.com (⚠ DNS-dead 2026-07-10) + Blossom\nor GitHub Pages / Vercel / anywhere"]
    STACKSCLI -->|"scaffolds from"| T
    LOCAL -->|"git clone, reads AGENTS.md + .mcp.json"| T
    T -->|"CLONE_URL scaffold source"| NSP
    NSP <-->|"speaks"| PROTO
    SHAKE <-->|"speaks"| PROTO
    STACKSCLI -->|"stacks agent talks to chosen NSP"| PROTO
    SHAKE -.->|"generation target"| T
    T --> DEPLOY
```

**Is Shakespeare just a hosted UI over MKStack?** Yes, precisely. mkstack-nsp's own service-discovery event hardcodes the flow identifier `"n": "https://shakespeare.diy/#nsp"` [13] — direct evidence Shakespeare and MKStack's reference NSP share one wire protocol. Shakespeare, the Stacks CLI's `agent` command, and (in principle) any other client can all target the same NSP.

## License — Flagged Loudly

This manual's ch. 01/07 call Soapbox frameworks "permissive," grouped with Nostrify (confirmed MIT). **That does not hold for MKStack's own template repo — it ships no license file at all.** Four filename variants 404 [11]; `package.json` has no `license` field [4]; GitLab's API detects none [10]; the toolbox page states none [19]. The README's only statement on the subject:

> "📄 License: Open source - build amazing Nostr applications and help grow the decentralized web!" [3]

That is marketing language, not an SPDX grant.

| Component | License | Evidence |
|---|---|---|
| **mkstack** (the template you fork) | **No LICENSE file found** | 4× 404 on LICENSE/.md/.txt/COPYING [11]; no `package.json` field [4]; no GitLab-detected license [10] |
| **mkstack-nsp** (the AI-generation backend / NSP) | **AGPLv3 — confirmed, full text present** | Direct fetch: "GNU AFFERO GENERAL PUBLIC LICENSE, Version 3" verbatim [15] |
| Nostrify (`@nostrify/nostrify`, a dependency) | MIT (established ch. 01) | Cross-reference; consistent with its use as a normal npm import [4] |

Practical read, not legal advice: forking the scaffold to start one project mirrors the unenforced norm around tools like `create-vite` — nobody expects a boilerplate's license silence to bind the app built from it, and ch. 04 already found Shakespeare-generated code carries no imposed license either.

**Same license-absence class, same fix in flight: NostrHub.** `nostrhub.io`'s repo (`gitlab.com/soapbox-pub/nostrhub`) was created 2026-06-11 — a one-month-old "2.0" codebase — and shows the identical pattern: no license detected on direct fetch, 0 stars/forks per the GitLab-API sweep this manual's ch. 01 already ran [29][30]. This isn't a separate problem needing a separate email: the pending Soapbox license outreach (ADR 0001, still unsent as of this pass per the maintainers' companion production audit) already covers both mkstack and NostrHub in one ask — send one email, not two [30].

**The sharper exposure is the NSP, not the template.** Self-hosting a modified mkstack-nsp — e.g. wiring a Dojo Gateway adapter in place of its OpenAI/OpenRouter adapters [14] — trips AGPLv3's network-use clause: you'd owe that modified server's source to whoever uses it. Verify template-reuse terms with Soapbox before a commercial closed fork; treat any self-hosted NSP as AGPL-bound from day one.

Confidence: Medium-High — the absence is well-triangulated across four independent checks, but "no license file" was not confirmed *by Soapbox saying so*, only by its repeated absence.

## Scaffold Anatomy

The live dependency manifest [4] contradicts the template's own README — a sharper version of ch. 09's secondary-source caution, except here it's the repo's *own* marketing copy that's stale against its own `package.json` and `AGENTS.md`:

> README: "MKStack is an AI-powered framework for building Nostr applications with React 18.x, TailwindCSS 3.x, Vite, shadcn/ui, and Nostrify." [3]

> AGENTS.md: "This project is a Nostr client application built with React 19.x, TailwindCSS 4.x, Vite, shadcn/ui, and Nostrify." [5]

`AGENTS.md` and the live manifest agree; the README does not. Trust the manifest.

| Layer | Package | Live version | Note |
|---|---|---|---|
| Framework | react / react-dom | 19.2.5 | README says "18.x" — stale [3][4] |
| Build | vite | 8.0.10 (devDep) | matches ch. 09 |
| Styling | tailwindcss / @tailwindcss/vite | 4.2.4 | README says "3.x" — stale |
| Components | shadcn/ui, unified `radix-ui` pkg | 48+ | not per-package `@radix-ui/react-*` [5] |
| Nostr | @nostrify/nostrify / react / nostr-tools | 0.52.2 / 0.6.2 / 2.23.3 | Nostrify is MIT |
| Data / routing | @tanstack/react-query / react-router-dom | 5.100.5 / 7.14.2 | catch-all `/:nip19` route |
| Forms / charts | react-hook-form+zod / recharts | 7.74/4.3.6 / 3.8.1 | recharts reconfirms ch. 09 |
| Testing / types | vitest+RTL+jsdom / typescript+eslint | see [4] | gated in the `test` script |

The `test` script is a compound gate — `tsc --noEmit && eslint --cache && vitest run … && vite build` [4] — mirroring AGENTS.md's validate-before-commit order exactly [5].

**NIP support out of the box** — "50+ NIPs" is the marketing claim [1]; independently traced to a hook, component, or rule:

| NIP | Feature | Where in scaffold |
|---|---|---|
| 01/02/05 | Profiles, follows, verified IDs | `useAuthor`, `NostrMetadata` [3][5] |
| **07/46** | Extension signing / remote signer | `LoginArea`, `AuthDialog`, `NostrLoginProvider` [3][5] |
| **19** | npub/note/nevent/naddr/nsec | catch-all `/:nip19` route, `nip19-routing` skill [5] |
| 17/44/18/25/23/28/29 | DMs, encryption, reposts, reactions, articles, chat | listed in README + skills [3][5] |
| 31 | `alt` tag on custom kinds | AGENTS.md rule, mandatory [5] |
| **47/57/60/61** | NWC / zaps / Cashu / nutzaps | `useZaps` hook, `nwc` skill [3][8] |
| **65** | Relay list / outbox | `AppProvider`+`NostrSync`, auto-publishes kind 10002 [5] |
| 94 + **Blossom** | File metadata + media storage | `useUploadFile`, `file-uploads` skill [5][8] |

## The Agent Contract: AGENTS.md, Not NIP.md

Correction to this manual's own working assumption (ch. 07: "MKStack's NIP.md agent contract"): **the file that actually governs what a coding agent does inside MKStack is `AGENTS.md`, not `NIP.md`.** `NIP.md` is real, fetched in full below [13] — but it lives in a *different repo* (mkstack-nsp) and documents a *wire protocol*, not coding conventions. `AGENTS.md`, 348 lines, sits at the template repo's root [5] and names its own role directly:

> "The assistant's behavior is defined by this file (AGENTS.md). Edit it directly to change guidelines — updates take effect the next session." [5]

| File | Lives in | What it is | Status |
|---|---|---|---|
| **`AGENTS.md`** (348 ln) | mkstack template | Real system prompt: stack, structure, kind/tag rules, XSS-first security, validate-then-commit | **DOCUMENTED**, native to all [5] |
| **`.mcp.json`** | mkstack template | Claude Code's own MCP config — wires `nostr` + `js-dev` servers | **DOCUMENTED for Claude Code** [6] |
| **`opencode.json`** | mkstack template | OpenCode's own config, same `nostr` server | **DOCUMENTED for OpenCode** [7] |
| `.agents/skills/*/SKILL.md` ×19 | mkstack template | Topic skills, YAML frontmatter | Claude-Skill-shaped format [8] |
| **`NIP.md`** (1,085 ln) | **mkstack-nsp — different repo** | "Nostr SPA Builder" wire protocol, thin-client ↔ NSP RPC (kind 31999/25742/25743) | Not a coding contract [13] |
| `NIP.md` (per-project) | generated in *your* fork | Documents custom kinds your app defines | Per AGENTS.md's own rule [5] |
| `.cursor/rules`, `.windsurfrules` | — | Neither found in the tree | NOT independently confirmed |

**`.mcp.json` resolved concretely (2026-07-10):** the file wires exactly two stdio MCP servers, both launched via `npx`:

| Server | Package | Tools |
|---|---|---|
| `nostr` | `@nostrbook/mcp@latest` | `read_nip`, `read_kind`, `read_tag`, `read_protocol`, `read_nips_index` — live-confirmed byte-identical to the tool set documented at nostrbook.dev/mcp [28] |
| `js-dev` | `@soapbox.pub/js-dev-mcp@latest` | Not independently enumerated this pass |

Practical read: a Claude Code session in a fresh MKStack clone can query live NIP/kind/tag/protocol docs and the full NIPs index without leaving the editor — the same reference material this manual's own research draws on, available to any agent session directly.

`NIP.md` (mkstack-nsp) opens with:

> "This document defines a Nostr Service Provider that generates, deploys, and makes updates to single-page web applications (SPAs) using AI." [13]

It specifies discovery (kind 31999), encrypted RPC (`start_project`, `send_project_message`, `get_models`… over kind 25742), and notifications (25743) [13] — relevant only if you're building your *own* NSP or thin client; irrelevant to a Claude Code session editing files locally.

```mermaid
flowchart LR
    A["git clone mkstack\nor: stacks mkstack"] --> B["npm install"]
    B --> C["Agent reads AGENTS.md\nloads .mcp.json nostr + js-dev servers\npulls .agents/skills as needed"]
    C --> D["Agent edits src/\nfollows kind-range + tag rules\nupdates NIP.md if a new kind is added"]
    D --> E["Validate gate, in order:\n1 tsc --noEmit\n2 vite build\n3 eslint\n4 vitest run"]
    E -->|"fail"| D
    E -->|"pass"| F["git commit\nnon-negotiable per AGENTS.md"]
    F --> G{"Deploy path"}
    G --> H["Stacks: npm run deploy\nBlossom + NostrDeploy.com (⚠ DNS-dead 2026-07-10)"]
    G --> I["Raw: GitHub Pages CI\nor Vercel / Netlify / nsite"]
```

Nineteen skills live under `.agents/skills/` — testing, theming, encryption, relay-pools, security, nip19-routing, file-uploads, NWC, and eleven more [8] — each a `SKILL.md` with YAML frontmatter (`name`, `description`), structurally identical to Claude Code's own Skill format. AGENTS.md defers to them by name ("load the nostr-security skill") rather than inlining every detail [5]. This chapter fetched and confirmed only one skill file in full (`testing/SKILL.md` [8]) — **ch. 12 (new) enumerates all 19 as the curriculum's definition-of-done checklist**; treat that chapter, not this "eleven more," as the authoritative skill directory going forward.

Confidence: High for Claude Code and OpenCode (direct config files, unambiguous). Medium for the broader "any AGENTS.md-aware agent" claim — the convention exists and is used correctly here, but per-tool adoption wasn't verified.

## Provider-Agnostic Lanes

The operator's question — can Claude Code, Cursor, Windsurf, or a Dojo-driven orchestrator build MKStack apps directly, on any model provider — resolves cleanly once the AGENTS.md/NIP.md split is clear. Four lanes exist; only two touch a Soapbox-controlled model roster.

| Lane | Driver | Model source | Deploy path | License exposure |
|---|---|---|---|---|
| Hosted Shakespeare | Dork, via Shakespeare's SPA-Builder client | Free Gemini / BYOK / local / paid ("shakespeare"/"tybalt" aliases) [13] | 1-click `*.shakespeare.wtf`, or export (ch. 04) | None on generated code |
| Stacks CLI + Dork | `stacks agent`, terminal | `stacks configure`: **OpenRouter**, Routstr, PayPerQ [3][17] | `npm run deploy` → Blossom + NostrDeploy.com — **⚠ tripwire, see Deploy + Distribution** | No LICENSE file (§2) |
| Self-hosted NSP | Your server, `CLONE_URL`-pointed at any template | `AI_PROVIDER=openai\|openrouter` today; 3rd adapter buildable [14] | Whatever your NSP implements | **AGPLv3 — must publish server changes to users** [15] |
| **Local IDE/CLI agent** | `git clone` + Claude Code / OpenCode / Cursor / Windsurf, reading `AGENTS.md` + `.mcp.json` | **100% yours** — Dojo Gateway, Anthropic, OpenRouter, local Ollama, anything | GitHub Pages (shipped CI), Vercel/Netlify, or nsite | Same as Stacks lane; none from tooling |

INFERRED, practical read: the fourth lane is where Dojo orchestration slots in natively — Claude Code already speaks this repo's `.mcp.json` out of the box, and "any provider" is trivially true because MKStack imposes none on a local session. Only the third lane needs new code: mkstack-nsp documents exactly two adapters today (OpenAI, OpenRouter) [14]; a Dojo Gateway adapter would need to match one of those shapes, or be added as a third — unattempted by anyone found this pass.

Confidence: High for lanes 1, 2, and 4 (each directly documented). Medium for lane 3's Dojo-adapter feasibility — the extension point is real and documented, but untested by anyone found in this research pass.

## Deploy + Distribution

| Path | Mechanism | Target | Evidence |
|---|---|---|---|
| Stacks / NostrDeploy | `npm run deploy` — script is added by the Stacks CLI scaffold; **absent from a raw clone's `package.json`** [4] | Blossom upload + relay-published pointer event, listed on NostrDeploy.com — **⚠ domain dead as of 2026-07-10, see tripwire below** | [3][16][26] |
| GitHub Pages (shipped CI) | `.github/workflows/deploy.yml`, triggers on push to `main` | `actions/deploy-pages`, standard `dist/` build | [9] |
| Anywhere static | Plain `npm run build` → `dist/` | Vercel, Netlify, Cloudflare Pages, or nsite/Blossom manually (ch. 04 precedent) | [4][21] |
| Listing | NostrHub 31990 app-listing kind (ch. 05) + `t:mkstack` tag browse | `nostrhub.io/apps/t/mkstack/` | [3] |

> **⚠ Tripwire (2026-07-10): `nostrdeploy.com` does not resolve.** A direct check hit DNS failure (ENOTFOUND) — the domain doesn't resolve at all, which reads as dead-or-broken domain, not a server outage [26]. Every mention of the `npm run deploy` → NostrDeploy lane in this manual (this table, the lanes table above, and ch. 04's decentralized-deploy route) is therefore **unverifiable and possibly dead**. Until the domain resolves again: don't promise this lane to a client, don't build a runbook on it, and re-check DNS before any workflow that assumes it. The GitHub Pages CI and plain-static paths are unaffected. One untested nuance: the Blossom+relay substrate underneath is content-addressed and may still work even if the NostrDeploy.com index/gateway is gone — that distinction has not been exercised.

A raw `git clone` gets a *normal Vite project with no deploy script at all* — `npm run deploy` is injected by the Stacks CLI during scaffolding, not shipped in the template's git history. A local agent lane adds its own step or rides the shipped GitHub Pages workflow. Custom-domain mechanics repeat ch. 04's open question — asserted [16] but no runbook found; verify live before promising a client one.

## Extensibility for the Mod Plan

| Addition | Scaffold conflict? | Evidence |
|---|---|---|
| i18next (ch. 08's Agora-pattern fork) | **None found** — zero i18n deps today, no `LocaleProvider` in `App.tsx`'s provider stack, AGENTS.md silent on locale | [4][5] — independently corroborates ch. 08 |
| Recharts | Already present, 3.8.1 | [4] — reconfirms ch. 09 |
| MapLibre GL / PMTiles | **None found** — zero map deps today; one flagged CSS gotcha (`isolate` + negative z-index, called out generically in the `theming` skill) applies to any full-bleed canvas | [4][5] |

Nothing in AGENTS.md's provider stack [5] structurally fights either addition — both are standard Vite/React npm installs. The one warning is procedural, not technical: "Never write over `App.tsx`, `AppRouter.tsx`, or `NostrProvider` without first reading their contents" [5] — read before wiring in a `LocaleProvider` or a map canvas.

## Maturity + Community

| Signal | Value | Source |
|---|---|---|
| GitLab stars / forks | 2 / 2 | [10] |
| Commits / branches / tags | 509 / 20 / 0 | [10] |
| Last activity | 2026-07-09 — same day as this research | [10] |
| GitHub mirror | None (404) | [20] |
| Real apps built on it | **Chorus** (community organizing + Cashu wallet for activists), **Blobbi** (persistent virtual pet), **Treasures** (decentralized geocaching) | [3][24] |
| One-prompt demos (README) | Group chat app, "Bookstr" (Goodreads-alike via OpenLibrary API), chess with NIP-64 | [3] |
| Docs surface | 237-line README + 348-line AGENTS.md + 19 skill files + dedicated tutorial post | [3][5][8][16] |

Star counts read small by GitHub norms, but Soapbox operates GitLab-first and Nostr-native by design (ch. 01) — commit velocity and shipped apps are the more honest signal, and both are strong: 500+ commits in fifteen months, one landing again today. Zero tags means no formal release process — a rolling-main template, consistent with the "ship fast, trust-based" culture ch. 01 and ch. 04 already established.

**Toybox vs. "real apps built on it," disambiguated (2026-07-10):** the table row above names three MKStack-built apps from the README, but only Treasures is actually a Toybox entry. Soapbox's Toybox page (`soapbox.pub/toybox`) catalogues **17 experiments**, live-reconfirmed this pass: Treasures, Birdstar, Surveil, Espy, Blobbi Island, Lief, Nests, Nostrdamus, Polaroids, Plektos, ZapTrax, Podstr, Color Slide, Relaying Earth, Clawstr, Zappix, Bookstr [27]. **Chorus is a flagship product positioned outside Toybox entirely** — it doesn't appear on the Toybox page at all [27] — and its source-code status, like Blobbi's, remains **unconfirmed** (no public repo located in this manual's research to date). **Treasures is confirmed public source**, and better than expected: it's third-party-built ("Built by Chad," `gitlab.com/chad.curtis/treasures` [27]) — an independent developer's real MKStack app, arguably a *stronger* teardown candidate than a Soapbox-authored one for proving the scaffold works for outside builders, not just its creators.

**Pinning discipline, reconfirmed 2026-07-10:** zero tags (still true, live-rechecked) means there is no version to pin to in the conventional sense — the house answer is a **commit-SHA pin + a fetch-only `upstream` remote** (push disabled), which makes `git diff <pin> upstream/main` a real, runnable command rather than a note nobody checks. This is now configured on `trespies-stack`; ch. 15 (new) covers the full per-component exit-playbook this discipline feeds, including when to re-pin.

## Open Questions

- Whether Soapbox would explicitly license the mkstack template if asked directly — the absence may be oversight, not decision; no dedicated "Introducing MKStack" post was found either, unlike Shakespeare's.
- The exact runbook for a fully custom domain on either deploy path — mirrors ch. 04's identical open question.
- Whether Cursor or Windsurf have been used against this scaffold in practice — plausible, not documented the way Claude Code and OpenCode are.
- Whether anyone has built a third `AI_PROVIDER` adapter for mkstack-nsp (Dojo-Gateway-shaped or otherwise) — not found this pass.
- Whether the `"shakespeare"`/`"tybalt"` aliases in `get_models` still map to the Claude-Sonnet-4/free-Gemini tiers ch. 04 documented — not re-confirmed.
- Whether NostrDeploy.com's DNS death (ENOTFOUND, 2026-07-10 [26]) is a transient misconfiguration or a discontinued service — and whether the Blossom+pointer-event substrate under `npm run deploy` still works without the NostrDeploy.com gateway. Re-check before relying on the Stacks deploy lane.
- Whether Chorus or Blobbi Island have public repos — not located this pass; if found, both become teardown candidates alongside Treasures.
- The full tool list for the `js-dev` MCP server (`@soapbox.pub/js-dev-mcp@latest`) — not independently enumerated this pass, unlike the `nostr` server's five tools.

## Sources

1. [MKStack — AI-Powered Nostr App Framework](https://soapbox.pub/mkstack) — product marketing page: "AI-first" framing, 50+ NIPs claim, Dork branding. Accessed 2026-07-09.
2. [gitlab.com/soapbox-pub/mkstack](https://gitlab.com/soapbox-pub/mkstack) — repo homepage, description confirming `mkstack.xyz` as the product domain. Accessed 2026-07-09.
3. [gitlab.com/soapbox-pub/mkstack — README.md (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/README.md) — full 237-line README: quick start, tech stack (stale versions), NIP list, real-world examples, License section. Accessed 2026-07-09.
4. [gitlab.com/soapbox-pub/mkstack — package.json (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/package.json) — live dependency manifest: React 19.2.5, Vite 8.0.10, Tailwind 4.2.4, Recharts 3.8.1, Nostrify, TanStack Query, no i18n packages, no `license` field, no `deploy` script. Accessed 2026-07-09.
5. [gitlab.com/soapbox-pub/mkstack — AGENTS.md (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/AGENTS.md) — full 348-line agent contract: stack (accurate versions), project structure, Nostr kind/tag rules, security model, validate-then-commit workflow, skill references. Accessed 2026-07-09.
6. [gitlab.com/soapbox-pub/mkstack — .mcp.json (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/.mcp.json) — Claude Code project-scoped MCP config, wiring `nostr` and `js-dev` servers. Accessed 2026-07-09.
7. [gitlab.com/soapbox-pub/mkstack — opencode.json (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/opencode.json) — OpenCode agent config, wiring the same `nostr` MCP server. Accessed 2026-07-09.
8. [gitlab.com/soapbox-pub/mkstack — .agents/skills/ tree + testing/SKILL.md (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/.agents/skills/testing/SKILL.md) — 19-skill directory listing (via GitLab API) plus full content of one skill file confirming `SKILL.md` YAML-frontmatter format. Accessed 2026-07-09.
9. [gitlab.com/soapbox-pub/mkstack — .github/workflows/deploy.yml (raw)](https://gitlab.com/soapbox-pub/mkstack/-/raw/main/.github/workflows/deploy.yml) — GitHub Pages deploy workflow, triggers on push to main. Accessed 2026-07-09.
10. GitLab API project metadata — `https://gitlab.com/api/v4/projects/soapbox-pub%2Fmkstack` and its `/repository/tree` endpoint — created_at, star/fork counts, commit/branch/tag counts, last_activity_at, absence of a `license` field, full root file tree. Accessed 2026-07-09.
11. LICENSE / LICENSE.md / LICENSE.txt / COPYING at `gitlab.com/soapbox-pub/mkstack/-/raw/main/` — all four return HTTP 404, confirmed via direct request. Accessed 2026-07-09.
12. [gitlab.com/soapbox-pub/mkstack-nsp](https://gitlab.com/soapbox-pub/mkstack-nsp) + GitLab API metadata — repo description ("Nostr Service Provider for generating Nostr web clients with AI"), created 2025-06-23, last activity 2025-09-02. Accessed 2026-07-09.
13. [gitlab.com/soapbox-pub/mkstack-nsp — NIP.md (raw, full 1,085 lines)](https://gitlab.com/soapbox-pub/mkstack-nsp/-/raw/main/NIP.md) — the "Nostr SPA Builder" wire-protocol spec: service discovery (kind 31999), encrypted RPC (kind 25742, incl. `get_models` returning `"shakespeare"`/`"tybalt"` model aliases), notifications (kind 25743), security considerations. Accessed 2026-07-09.
14. [gitlab.com/soapbox-pub/mkstack-nsp — README.md (raw)](https://gitlab.com/soapbox-pub/mkstack-nsp/-/raw/main/README.md) — Deno/TypeScript NSP reference implementation: `AI_PROVIDER=openai|openrouter` adapter config, `CLONE_URL`-configurable base template, Stripe/Lightning credit system. Accessed 2026-07-09.
15. [gitlab.com/soapbox-pub/mkstack-nsp — LICENSE (raw)](https://gitlab.com/soapbox-pub/mkstack-nsp/-/raw/main/LICENSE) — full GNU Affero General Public License v3 text, confirmed present (HTTP 200) and verbatim. Accessed 2026-07-09.
16. [MKStack: Vibe Coding for Everyone — Soapbox Blog](https://soapbox.pub/blog/mkstack-tutorial/) — step-by-step Stacks CLI workflow (`npm install -g @getstacks/stacks`, `stacks mkstack`, `stacks agent`, `npm run deploy`), cost-discipline warning, NostrDeploy.com mechanics. Accessed 2026-07-09.
17. [Stacks — AI-First Development Platform](https://soapbox.pub/tools/stacks/) — Stacks CLI product page: `stack.json`/`agent.json`/`CONTEXT.md`, Dork provider list (OpenRouter, PayPerQ, Routstr), kind-30717 template publishing. Accessed 2026-07-09.
18. [Stacks 1.0 Released — Soapbox Blog](https://soapbox.pub/blog/announcing-stacks-1.0/) — published 2025-08-20; multi-provider support, "your own custom models," MKStack framed as "one such stack." Accessed 2026-07-09.
19. [Soapbox Toolbox](https://soapbox.pub/toolbox) — full tool inventory; MKStack/Stacks/Nostrify one-line descriptions, no license stated for any. Accessed 2026-07-09.
20. `github.com/soapbox-pub/mkstack` and `github.com/soapbox-pub/mkstack-nsp` — both return HTTP 404, confirming no GitHub mirror exists; Soapbox is GitLab-only for these repos. Accessed 2026-07-09.
21. This manual, [ch. 04 — Shakespeare](04-shakespeare.md) — cross-referenced for Shakespeare's launch timeline, the "MKStack + Claude Sonnet 4" paid-NSP finding, and the AGPLv3-tool/no-license-on-output distinction reused here.
22. This manual, [ch. 08 — i18n Integration](08-i18n-integration.md) — cross-referenced; its citation of mkstack-nsp's `NIP.md` (independently re-fetched in full for this chapter) and its zero-i18n-dependency finding on MKStack, independently reconfirmed here via live `package.json`.
23. This manual, [ch. 09 — Visualization Integration](09-visualization-integration.md) — cross-referenced; its prior live `package.json` fetch (React 19.2.5/Vite 8.0.10/Tailwind 4.2.4/Recharts 3.8.1) matches this chapter's independent fetch exactly, and its stale-secondary-source caution is echoed here against the template's own README.
24. Web search aggregate (Soapbox blog index, NostrHub app listings, general web) — corroborating descriptions of Chorus (community organizing + Cashu wallet), Blobbi (persistent virtual pet), and Treasures (geocaching) as real MKStack-built apps named in the README. Accessed 2026-07-09.
25. `mkstack.xyz` — canonical product domain, referenced throughout the repo description and `NIP.md` asset URLs; page itself did not render in this pass (TLS handshake failure on direct fetch) — cited as the documented canonical domain, not independently rendered live.
26. `nostrdeploy.com` — direct resolution/fetch attempt: DNS lookup fails (ENOTFOUND); the domain does not resolve at all. Checked 2026-07-10. Supports: the deploy-lane tripwire — NostrDeploy.com unreachable, service possibly dead.
27. [soapbox.pub/toybox](https://soapbox.pub/toybox) — accessed 2026-07-10 — live re-fetch: full 17-item Toybox roster reconfirmed; Treasures' public source link (`gitlab.com/chad.curtis/treasures`, third-party-built) found on-page; Chorus does not appear on this page.
28. [nostrbook.dev/mcp](https://nostrbook.dev/mcp) — accessed 2026-07-10 — live tool-list confirmation for the `nostr` MCP server: `read_nip`, `read_kind`, `read_tag`, `read_protocol`, `read_nips_index`, matching `.mcp.json`'s `@nostrbook/mcp@latest` package exactly.
29. [gitlab.com/soapbox-pub/nostrhub](https://gitlab.com/soapbox-pub/nostrhub) — accessed 2026-07-10 — repo created 2026-06-11, no license detected on direct fetch.
30. Maintainers' internal production-secrets-longevity audit note (companion document, not part of this public chapter set) — pre-positioning checklist (commit-pin + fetch-only-upstream discipline, now configured on trespies-stack; ADR 0001 license-outreach status covering mkstack + NostrHub) and correction log (NostrHub license-absence finding, 0 stars/forks per the ch. 01 GitLab-API sweep). Accessed/authored 2026-07-10.