GitHub - McIndi/adapt: A lightweight, FastAPI-powered adaptive server that automatically turns files and Python modules into fully functional REST APIs. · GitHub

/" data-turbo-transient="true" />

Skip to content

Type / to search

Sign in<br>Sign upAppearance settings

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

Uh oh!

There was an error while loading. Please reload this page.

McIndi

adapt

Public

Notifications<br>You must be signed in to change notification settings

Fork

Star

main

BranchesTags

Go to file

CodeOpen more actions menu

Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit

History<br>99 Commits<br>99 Commits

.github/workflows

.github/workflows

adapt

adapt

blog-posts

blog-posts

docs

docs

examples

examples

tests

tests

.gitignore

.gitignore

LICENSE

LICENSE

README.md

README.md

pyproject.toml

pyproject.toml

View all files

Repository files navigation

Adapt

Adapt is a FastAPI server that turns files in a directory into APIs and UIs.

Datasets (.csv, .xlsx, .xls, .parquet) become API endpoints and DataTables UIs

Legacy .xls workbooks are read-only. Modern .xlsx workbooks support CRUD operations.

Markdown/HTML become browsable pages

Media files become streaming endpoints and player/gallery UIs

Python files can register custom routers

Everything is searchable in one place via full-text /search

Everything is reachable by agentic tools via an MCP server at /mcp

Quick Start

/path/to/docroot">pip install adapt-server<br>adapt addsuperuser --username admin /path/to/docroot<br>adapt serve /path/to/docroot

# Generate permissions for all discovered resources<br>adapt admin create-permissions /path/to/docroot __all__

# Everything below here can be done in the admin UI at<br># http://localhost:8000/admin/ after logging in with the superuser account.<br># Create a regular user<br>adapt admin create-user --username editor --password secret /path/to/docroot

# Reset an existing password and revoke that user's browser sessions<br>adapt admin change-password --username editor /path/to/docroot

# By default, the editor user has no permissions.<br># See available groups (created by `adapt admin create-permissions`) and assign user to desired group<br>adapt admin list-groups /path/to/docroot<br>adapt admin add-to-group --username editor --group group_name> /path/to/docroot

Useful URLs:

/ landing page

/admin/ admin UI

/api/ resource API

/ui/ resource UI

/schema/ resource schema

/search full-text search across every resource you can read

/mcp MCP server for agentic tools (see MCP Interface below)

What Adapt Generates

From files in your docroot, Adapt auto-discovers resources and mounts routes with extensionless URLs where possible.

Example:

data/<br>employees.csv<br>sales.xlsx<br>video.mp4<br>readme.md<br>stats.py

Rough output:

/api/employees, /ui/employees, /schema/employees

/api/sales/, /ui/sales/

/media/video.mp4, /ui/video.mp4, /ui/media

/readme

/api/stats/*

Current Security Posture

This reflects the current implementation in the codebase.

In Place

Authentication: session cookies, API keys (X-API-Key), and inactive-user enforcement

Authorization: RBAC (users, groups, permissions), plus superuser bypass

Password security: PBKDF2 hashing with per-user salts

Password changes: self-service and administrator resets revoke all browser sessions for the user

Session security: expiration enforcement, sliding renewal, cleanup task

CSRF protection: enforced for cookie-authenticated unsafe methods (POST/PUT/PATCH/DELETE), including mixed session + API-key requests

Redirect hardening: login next paths are validated as local relative paths

Response hardening: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, HSTS (when TLS is enabled)

Host header hardening: Trusted Host middleware

Data integrity: lock-based, atomic writes for mutable dataset plugins

Auditability: audit records for authentication, administration, and successful dataset mutations

Sensitive response cleanup: admin user APIs no longer expose password_hash

Important Deployment Notes

Use TLS in non-local environments (--tls-cert + --tls-key) so secure cookies and HSTS protections are effective.

API-key-only clients are exempt from CSRF checks by design; cookie-auth browser flows require CSRF tokens.

Core Features

Adaptive discovery and route generation

Dataset CRUD with schema exposure

Caching with invalidation on mutations

Built-in admin UI for users/groups/permissions/locks/cache/api keys/audit logs

Plugin architecture with companion overrides in .adapt/

Permission-filtered full-text search across every resource type

MCP server for agentic tool access, mounted alongside the REST API

Full-Text Search

GET /search?q= searches datasets, Markdown, HTML, and media...