Project structure

10xgraph init --template production writes a complete project: a graph package with a tool, a state class and input validators, plus evals, tests, lint and pre-commit config, an env template and an 10xgraph.json. This page lists every generated file and explains each key in the config.

How do I generate it?

10xgraph init --template production --auth jwt --rate-limit redis --yes

--yes makes init use your flags instead of asking questions. Without --yes or --non-interactive, init runs its interactive prompts. --auth accepts none, jwt or custom. --rate-limit accepts none, memory or redis. Both flags need the production template. Add --name to set the agent name, --path <dir> to scaffold into another directory and --dry-run to list the files without writing them.

What files does it create?

The auth/ folder is skipped for --auth none and --auth jwt. The lifecyle.py spelling is how the template names that file.

What does each file do?

graph/agent.py

This is the entry point. It builds a ReactAgent with a WeatherState, a MessageContextManager that keeps the last 20 messages, the get_weather tool and a callback manager, then compiles it:

app = react_agent.compile(
    checkpointer=checkpointer,  # InMemoryCheckpointer() by default
    callback_manager=callback_manager,
)

The app variable is what "agent": "graph.agent:app" in 10xgraph.json points at. The template uses InMemoryCheckpointer, so swap in a durable checkpointer before production (see Memory: hot and cold).

graph/state.py and graph/tools/

state.py subclasses AgentState and adds a user_location field that the system prompt reads. tools/weather_tool.py holds get_weather, which simulates a flaky API: it fails at random and the tool retries up to three times before returning an apology. Replace it with your own tools.

graph/validators/

validators.py defines a PromptInjectionValidator with strict_mode=True, a max_length of 1000 and a list of suspicious keywords. manager.py registers it as an input validator on a CallbackManager, together with the AgentLifecycleHook from lifecyle.py. Edit the keyword list: it includes words such as “free” and “token”, which are tuned for the weather example and may block legitimate input in your domain.

graph/thread_name_generator.py

A ThreadNameGenerator subclass whose generate_name returns a fixed placeholder string. Implement it to name threads from the first messages.

auth/agent_auth.py

Present with --auth custom. It subclasses BaseAuth, logs a warning at startup and answers every request with 401 until you implement authenticate. The returned user_id becomes the thread and memory owner, so derive it from a verified credential and never from a client-supplied field.

evals/ and tests/

evals/ holds two example evaluation files. Run them with 10xgraph eval. tests/ holds the pytest suite, run with 10xgraph test. Check the generated tests against your graph layout before relying on them.

.env.example

App settings, CORS, request limits, security headers, Snowflake ID settings, a Sentry DSN and GOOGLE_API_KEY. The REDIS_URL block appears only with --rate-limit redis, and the JWT_SECRET_KEY and JWT_ALGORITHM block only with --auth jwt. Origins and allowed hosts default to *, with a TODO to restrict them in production.

What is in the generated 10xgraph.json?

For the command above, init writes:

{
  "agent": "graph.agent:app",
  "env": ".env",
  "auth": "jwt",
  "thread_name_generator": "graph.thread_name_generator:MyNameGenerator",
  "ag_ui": { "enabled": false },
  "authorization": "ownership",
  "injectq": "graph.agent:container",
  "rate_limit": {
    "enabled": true,
    "backend": "redis",
    "requests": 100,
    "window": 60,
    "by": "ip",
    "trusted_proxy_headers": false,
    "exclude_paths": ["/ping", "/docs", "/redoc", "/openapi.json"]
  }
}

Other keys, such as checkpointer, store and redis, are optional and are not written by init. You can add them by hand.

Related pages