# Fastify Best Practices

> Use when building, organizing, or debugging Fastify applications. Covers plugins, routes, schemas, hooks, errors, auth boundaries, logging, testing, and deployment decisions for Fastify backends.

- **Type:** Skill
- **Install:** `agentstack add skill-andrewsrigom-agent-skills-fastify-best-practices`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [andrewsrigom](https://agentstack.voostack.com/s/andrewsrigom)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [andrewsrigom](https://github.com/andrewsrigom)
- **Source:** https://github.com/andrewsrigom/agent-skills/tree/main/fastify/fastify-best-practices
- **Website:** https://andrewsrigom.github.io/agent-skills/

## Install

```sh
agentstack add skill-andrewsrigom-agent-skills-fastify-best-practices
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Fastify Best Practices

Use this skill for Fastify-specific architecture and implementation choices.

## Scope

- app bootstrapping and plugin boundaries
- route organization and schema-first handlers
- request lifecycle hooks and decorators
- auth, cookies, sessions, CORS, and security headers
- testing with `inject()`
- logging, performance, and deployment decisions

## Default path

1. Confirm whether the task is about app structure, a single route, a plugin, or runtime behavior.
2. Keep the app split by plugin boundary, not by random file size.
3. Define request and response schemas before handler logic when validation matters.
4. Prefer decorators and plugins for shared behavior instead of utility imports passed everywhere.
5. Use hooks intentionally:
   - `onRequest` for auth and cheap request guards
   - `preHandler` for work that depends on parsed input
   - `onSend` only when the response must be shaped late
6. Keep handlers thin and move business logic behind a service boundary when the route starts doing orchestration.
7. Test route behavior with `fastify.inject()` before introducing network-level tests.

## When to deviate

- Keep a route local and simple only when it truly has no reusable boundary.
- Use heavier lifecycle hooks only when cheaper ones cannot express the requirement.
- Move to auth skill when the main challenge becomes OAuth or token/session design.

## Guardrails

- Prefer Fastify plugins and encapsulation over global mutable state.
- Treat schemas as part of the contract, not optional documentation.
- Do not scatter auth logic across handlers if the same rule can live in a hook or plugin.
- Keep logger usage structured. Do not rely on string-only logs for important events.
- Register plugins in a deterministic order when one plugin depends on another.
- Avoid doing expensive work in decorators or plugin registration if it can happen lazily at request time.

## Avoid

- using global mutable state instead of plugin encapsulation
- pushing orchestration into handlers that should stay thin
- scattering schemas away from the route contract
- choosing hooks by habit instead of request-lifecycle cost

## Verification checklist

- plugin boundaries are intentional
- schemas are part of the route contract
- hook choice matches the lifecycle need
- handlers stay thin
- route behavior can be tested with `inject()`

## Common Routing Cues

- routes, handlers, `fastify.register`, plugin encapsulation, decorators, hooks, schemas, serializer, `inject()`, Pino, auth hooks, `@fastify/*`

## Output Shape

When answering with this skill, prefer:

- the recommended plugin or route shape
- the right lifecycle hook for the job
- where schemas belong
- what should be tested
- what should stay out of handlers

## Official Docs

- https://fastify.dev/docs/latest/
- https://fastify.dev/docs/latest/Reference/Plugins/
- https://fastify.dev/docs/latest/Reference/Routes/
- https://fastify.dev/docs/latest/Reference/Validation-and-Serialization/
- https://fastify.dev/docs/latest/Guides/Testing/

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [andrewsrigom](https://github.com/andrewsrigom)
- **Source:** [andrewsrigom/agent-skills](https://github.com/andrewsrigom/agent-skills)
- **License:** MIT
- **Homepage:** https://andrewsrigom.github.io/agent-skills/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-andrewsrigom-agent-skills-fastify-best-practices
- Seller: https://agentstack.voostack.com/s/andrewsrigom
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.