by crbnos
Carbon is an open source ERP, MES and QMS for manufacturing. Perfect for complex assembly, contract manufacturing, and configure to order manufacturing.
# Add to your Claude Code skills
git clone https://github.com/crbnos/carbonLast scanned: 5/1/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@aws-sdk/xml-builder: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@novu/node: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@vercel/react-router: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@vercel/static-config: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-xml-parser: fast-xml-parser XMLBuilder: XML Comment and CDATA Injection via Unescaped Delimiters",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "liquidjs: liquidjs has a Denial of Service via circular block reference in layout",
"severity": "high"
},
{
"type": "npm-audit",
"message": "nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-01T06:37:38.871Z",
"semgrepRan": false,
"npmAuditRan": true,
"pipAuditRan": true
}carbon is an open-source ai agents skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by crbnos. Carbon is an open source ERP, MES and QMS for manufacturing. Perfect for complex assembly, contract manufacturing, and configure to order manufacturing. It has 2,134 GitHub stars.
carbon returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/crbnos/carbon" and add it to your Claude Code skills directory (see the Installation section above).
carbon is primarily written in TypeScript. It is open-source under crbnos on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other AI Agents skills you can browse and compare side by side. Open the AI Agents category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh carbon against similar tools.
No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
We built Carbon after years of building end-to-end manufacturing systems with off-the-shelf solutions. We realized that:
We built Carbon to solve these problems ☝️
Carbon is designed to make it easy for you to extend the platform by building your own apps through our API. We provide some examples to get you started in the examples folder.
Features:
Technical highlights:
The monorepo follows the Turborepo convention of grouping packages into one of two folders.
/apps for applications/packages for shared code/apps| Package Name | Description | How to run |
|---|---|---|
erp |
ERP Application | pnpm dev (boots stack + ERP via crbn up picker) |
mes |
MES | pnpm dev (select MES in picker, or both) |
academy |
Academy | pnpm dev:academy |
starter |
Starter | pnpm dev:starter |
pnpm dev runs the per-worktree dev CLI (crbn up). ERP and MES are first-class — the CLI boots the docker stack, applies migrations, regenerates types/swagger, and spawns the selected apps behind portless. Academy and starter are standalone Turborepo entries.
/packages| Package Name | Description |
|---|---|
@carbon/database |
Database schema, migrations and types |
@carbon/documents |
Transactional PDFs and email templates |
@carbon/ee |
Integration definitions and configurations |
@carbon/config |
Shared configuration (vitest, tsconfig, tailwind) across apps and packages |
@carbon/jobs |
Background jobs and workers |
@carbon/logger |
Shared logger used across apps |
@carbon/react |
Shared web-based UI components |
@carbon/kv |
Redis cache client |
@carbon/lib |
Third-party client libraries (slack, resend) |
@carbon/stripe |
Stripe integration |
@carbon/utils |
Shared utility functions used across apps and packages |
Clone the repo into a public GitHub repository (or fork https://github.com/crbnos/carbon/fork). If want to make the repo private, you should acquire a commercial license to comply with the AGPL license.
git clone https://github.com/crbnos/carbon.git
Go to the project folder
cd carbon
Make sure that you have Docker installed on your system since this monorepo uses the Docker for local development.
In addition you must configure the following external services:
| Service | Purpose | URL |
|---|---|---|
| Posthog | Product analytics platform | https://us.posthog.com/signup |
| Stripe | Payments service | https://dashboard.stripe.com/login |
| Resend | Email service | https://resend.com |
Posthog has a free tier which should be plenty to support local development. If you're self hosting and you don't want to use Posthog, it's pretty easy to remove the analytics.
First download and initialize the repository dependencies.
This repo uses pnpm as its package manager. Enable Corepack so the correct pnpm version (pinned via packageManager in package.json) is used automatically:
$ corepack enable # one-time: activates pnpm shim from packageManager field
Then install dependencies:
$ nvm use # use node v22
$ pnpm install # install dependencies
The dev stack (Postgres, GoTrue, Kong, Storage, Inngest, Inbucket, Studio, Realtime) is booted later by crbn up — see Local dev CLI below. There is no separate "start the database" step.
crbn)crbn is a small CLI at packages/dev/bin/crbn that wraps two things:
carbon-<slug> compose project. Routing is handled by portless (a local HTTPS reverse proxy that serves *.dev hostnames on :443 with locally-trusted certs — installed automatically on first crbn up).Windows users: the dev CLI (
crbn,setup.sh) is POSIX-only and expects WSL or Git Bash. Native cmd.exe / PowerShell shells are not supported. From a WSL/Git Bash prompt, the standard flow (./setup.sh,pnpm dev,crbn checkout …) works the same as on macOS/Linux.
Run setup.sh once to put crbn on your $PATH and install the crbn shell function (so crbn checkout can change cwd):
$ ./setup.sh # writes a sentinel block to ~/.zshrc or ~/.bashrc
$ source ~/.zshrc # or open a new shell
$ crbn # shows commands
Common flows:
$ crbn checkout sid/cool-thing # cd into worktree (creates if missing,
# auto-fetches from origin if needed)
$ crbn checkout -b feat/new-thing # new branch off origin/main + worktree
$ crbn checkout sid/cool-thing --up # …and boot the stack inside it
$ crbn checkout 760 # fetch GitHub PR #760 into a `pr-760`
# branch + worktree (fork PRs work too)
$ crbn copy # re-sync .env from main checkout
$ crbn up | down | reset | status # per-worktree compose stack
$ crbn new | list | remove # interactive worktree management
crbn up flags:
--no-migrate — skip supabase migration up (use when schema is already current and you just want to re-boot containers fast)--no-regen — skip regenerating packages/database/src/types.ts + swagger-docs-schema.ts (auto-skipped when --no-migrate is set, since no schema change implies no type drift)Files synced by crbn copy are listed under package.json#crbn.copy (defaults to [".env"]). To uninstall the rc block: ./setup.sh --uninstall.
Create an .env file and copy the contents of .env.example