by crbnos
Carbon is an open source ERP, MES and QMS for manufacturing. Perfect for complex assembly, contract manufacturing, and configure to order manufacturing.
# Add to your Claude Code skills
git clone https://github.com/crbnos/carbonLast scanned: 5/1/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@aws-sdk/xml-builder: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@novu/node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@vercel/react-router: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@vercel/static-config: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-xml-parser: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "liquidjs: liquidjs has a Denial of Service via circular block reference in layout",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-01T06:37:38.871Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}We built Carbon after years of building end-to-end manufacturing systems with off-the-shelf solutions. We realized that:
We built Carbon to solve these problems ☝️
Carbon is designed to make it easy for you to extend the platform by building your own apps through our API. We provide some examples to get you started in the examples folder.
Features:
Technical highlights:
No comments yet. Be the first to share your thoughts!
The monorepo follows the Turborepo convention of grouping packages into one of two folders.
/apps for applications/packages for shared code/apps| Package Name | Description | Local Command |
| ------------ | --------------- | --------------------- |
| erp | ERP Application | npm run dev |
| mes | MES | npm run dev:mes |
| academy | Academy | npm run dev:academy |
| starter | Starter | npm run dev:starter |
/packages| Package Name | Description |
| ------------------- | -------------------------------------------------------------------------- |
| @carbon/database | Database schema, migrations and types |
| @carbon/documents | Transactional PDFs and email templates |
| @carbon/ee | Integration definitions and configurations |
| @carbon/config | Shared configuration (vitest, tsconfig, tailwind) across apps and packages |
| @carbon/jobs | Background jobs and workers |
| @carbon/logger | Shared logger used across apps |
| @carbon/react | Shared web-based UI components |
| @carbon/kv | Redis cache client |
| @carbon/lib | Third-party client libraries (slack, resend) |
| @carbon/stripe | Stripe integration |
| @carbon/utils | Shared utility functions used across apps and packages |
Clone the repo into a public GitHub repository (or fork https://github.com/crbnos/carbon/fork). If want to make the repo private, you should acquire a commercial license to comply with the AGPL license.
git clone https://github.com/crbnos/carbon.git
Go to the project folder
cd carbon
Make sure that you have Docker installed on your system since this monorepo uses the Docker for local development.
In addition you must configure the following external services:
| Service | Purpose | URL | | ------- | -------------------------- | -------------------------------------------------------------- | | Posthog | Product analytics platform | https://us.posthog.com/signup | | Stripe | Payments service | https://dashboard.stripe.com/login | | Resend | Email service | https://resend.com | | Novu | Notifications service | https://dashboard.novu.co/auth/sign-in |
Posthog has a free tier which should be plenty to support local development. If you're self hosting and you don't want to use Posthog, it's pretty easy to remove the analytics.
First download and initialize the repository dependencies.
$ nvm use # use node v20
$ npm install # install dependencies
$ npm run db:start # pull and run the containers
Create an .env file and copy the contents of .env.example file into it
$ cp ./.env.example ./.env
Authorized JavaScript origins to only http://127.0.0.1:54321Authorized redirect URIs to http://127.0.0.1:54321/auth/v1/callbackSUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_ID="******.apps.googleusercontent.com"SUPABASE_AUTH_EXTERNAL_GOOGLE_CLIENT_SECRET="GOCSPX-****************"npm run db:start. Find the following values in its output to set the supabase entries:SUPABASE_SERVICE_ROLE_KEY=[service_role key]SUPABASE_ANON_KEY=[anon key]REDIS_URL=[redis://user:password@host:port]POSTHOG_API_HOST=[https://[region].posthog.com]POSTHOG_PROJECT_PUBLIC_KEY=[Project API Key starting 'phc*']STRIPE_SECRET_KEY from the Stripe Settings > Developers interfaceSTRIPE_SECRET_KEY="sk_test_*************"RESEND_API_KEY="re_**********"RESEND_DOMAIN="carbon.ms" (or your domain, no trailing slashes or protocols)RESEND_AUDIENCE_ID="*****" (Optional - required for contact management in packages/jobs)Resend is used for transactional emails (user invitations, email verification, onboarding). All three variables are stored in packages/auth/src/config/env.ts.
NOVU_APPLICATION_ID="********************" (Client-side, public)NOVU_SECRET_KEY="********************" (Server-side secret, backend only)Novu is used for in-app notifications and notification workflows. After standing up the application and tunnelling port 3000, sync your Novu workflows:
npm run novu:sync
This command syncs your Novu workflows with the Carbon application using the bridge URL.
Finally, start the apps and packages:
$ npm run dev
$ npm run dev:mes # npm run dev in all apps & packages
After installation you should be able run the apps locally. | Application | URL | | --------------- | ------------------------------------------------------------------------------------------------------------------ | |