ApeAdmin: a FastAPI and Vue 3 admin base that hands its controls to AI agents

The gap ApeAdmin tries to close

ApeAdmin is a Python backend plus Vue 3 frontend starter for internal admin systems. The part that separates it from the long line of CRUD scaffolds is that it treats an AI agent as a first class caller: the README describes a base platform that ships role based access control, menu and department trees, an audit log and a plugin marketplace, then republishes the same management operations as MCP tools an agent can invoke.

The audience is a team that already needs a back office with user administration, menus, departments and logs. If that team also wants a model to act on those operations instead of only reading a dashboard, the gateway is the reason to look here. If a dashboard is all you need, most of this machinery is overhead you will carry without using.

The stack is spelled out precisely. Backend is FastAPI with SQLAlchemy 2.0 in async mode and Alembic for migrations. Frontend is Vue 3.5 with Vite 6, TypeScript 5.7, Element Plus 2.9 and Pinia 2.3, with ECharts 5.6 for charts. Storage is MySQL through aiomysql or SQLite through aiosqlite, with the driver switching automatically. Authentication is a JWT access token with bcrypt password hashing. Redis is optional and falls back to in memory when it is missing, which tells you the cache is an optimisation here rather than a dependency.

How the plugin runtime discovers and loads code

Plugins are Python packages, and the manager finds them with importlib rather than a hand maintained registry. Adding one is a matter of putting a package where the scanner looks. Each plugin moves through a declared lifecycle of load, install, register and uninstall, and the README says enable and disable happen without a restart.

Communication between plugins goes through an EventBus with seven built in events, including APP_STARTUP, DB_READY and USER_LOGIN. A plugin can register its own routes, its own MCP tools and its own event listeners, so a business plugin is not limited to internal calls: it can extend the HTTP surface and the agent surface at the same time.

Distribution is handled in two ways. A plugin can be deployed as its own Docker service, fully decoupled from the base, or installed by uploading a ZIP archive through the admin UI. The marketplace at apehub.finecv.cn/apehub-web/plugins.html is the online catalogue for browsing, searching and downloading community plugins.

What the MCP-SSE gateway exposes to agents

The gateway implements the three MCP primitives: tools for calls, resources for reads and prompts for templates. When a tool is registered, its JSON Schema is inferred from the function signature, so there is no separate schema to write by hand. That convenience cuts both ways: the contract your agent sees is whatever your type hints say, and a loose hint becomes a loose tool contract.

Access is filtered by the same RBAC model that governs the UI. An agent only sees the tools the current user is allowed to call, which is the right default and also means an agent session inherits whatever permissions its token carries. Transport uses a one time SSE ticket instead of a bare JWT in the URL, tool calls time out after 30 seconds, and registration is persisted so a restart restores the tool set. Every call is written to an audit log with the request, the response, the duration and the caller.

The built in tool set is small and administrative: system_health_check and system_list_plugins, then role, department and menu operations for list, create, update and delete, each marked as requiring permission. On the chat side, providers listed are DeepSeek, Tongyi Qianwen, Zhipu GLM, OpenAI and custom endpoints reached over an OpenAI compatible interface, with keys stored encrypted using Fernet with a key derived from JWT_SECRET. Streaming is SSE with Markdown rendering and code highlighting, and function calling stops after at most five rounds of tool calls.

Installing ApeAdmin and reaching the setup wizard

There is an online demo if you want to look before installing. The README gives https://apehub.finecv.cn/admin with account ceshi110 and password ceshi110, and warns that this account carries the viewer role, so it can read every module and change nothing.

For a local install the README recommends the wizard route. Start the backend first:

cd backend
python -m venv .venv && .venv/bin/activate    # Windows: .venv\Scripts\activate
pip install -e .
uvicorn src.main:app --reload --host 0.0.0.0 --port 8000

That puts the API on port 8000. Then start the frontend in a second shell:

cd frontend
npm install --legacy-peer-deps
npm run dev

Open http://localhost:5173 and an unconfigured system redirects to the setup wizard at /setup. The wizard runs in three steps: pick a database, either SQLite with no configuration or MySQL with connection details and automatic database creation using utf8mb4, then set the site name, administrator account and access address, then finish, which writes configuration and creates the tables. JWT_SECRET is generated randomly into .env, and a setup.lock file prevents the wizard from running twice. The README asks you to restart the backend afterwards, after which the administrator account and base data initialise.

Constraints that show up before production

Several limits are visible in the documentation and worth weighing early. The chat loop caps function calling at five rounds of tool calls, so an agent workflow that needs a longer chain of lookups and edits will stop partway. The 30 second tool call timeout is short for admin operations that touch large tables or external services. Both are tunable in code, but neither is presented as configurable in the README.

Packaging is split in a way that surprises people. The production deployment package contains only the base platform, meaning RBAC, menus, the plugin framework and the MCP gateway, with no business plugins. Those are installed afterwards through ZIP upload or the marketplace. That keeps the base small and means a fresh deployment is an empty shell until you add plugins.

Maturity is the third concern. The README badge shows version 0.2.0 and the repository publishes no releases, so there is no tagged version to pin and no release notes to read for upgrade impact. The README is Chinese first with a separate README.en.md, so English documentation can lag behind. The project also states openly that it is developed with AI assistance, with humans responsible for product direction, architecture review, quality verification and final decisions, which is a disclosure you should read as a signal about how the code was produced.

React-admin sits on the other side of the split

React-admin is the comparison that matters, because it solves the same surface from the opposite end. It is a frontend framework: you build the admin UI in React and point it at an API you already have through a data provider. It ships no backend, no permission model and no agent interface, so users, roles, menus and departments are whatever your own service implements.

ApeAdmin inverts that. It ships the backend and the permission model first, including the five table RBAC structure of user, role, menu, department and their association table, four permission layers from no login through no auth, rule auth and data scope, and a menu tree typed as directory, menu or button with a v-permission directive for button level visibility. The trade is clear: React-admin is lighter and fits an existing backend, ApeAdmin is heavier and gives you the backend plus an agent gateway in one repository. If you already run a service with its own auth, React-admin is less to absorb. If you are starting from nothing and want agents to act on the admin, ApeAdmin arrives with that wiring done.

Version, licence and what upkeep looks like

The requirements are narrow and current: Python 3.11 or newer for the backend, Vue 3.5 on the frontend, and Windows, Linux or macOS as platforms. The last push was on 2026-09-16, so the code is moving, but with no published releases an upgrade means pulling the default branch and running Alembic migrations rather than moving between tagged versions. The repository tree includes deploy/ with a DEPLOY.md covering one click deployment, package building and SQLite to MySQL migration, which is where production installation is documented.

On licensing there is a discrepancy worth resolving before you build on it. The README displays an MIT badge, while the repository's licence field on GitHub is empty. Both facts are consistent with an uncommitted LICENSE file, and until you confirm that file exists you do not have a granted licence, only an intention stated in a badge. This is not legal advice, but it is a cheap check that removes a real risk.

Day to day upkeep centres on the plugin boundary, since business logic lives in separate packages with their own lifecycle, and on the audit log, which records request duration and caller for both API traffic and MCP tool calls.

Editorial conclusion

Adopt ApeAdmin if you need a role checked admin base on FastAPI and Vue 3 and you want an LLM agent to call those admin operations rather than only read them, and if you can live on Python 3.11+ with a 0.2.0 codebase. Skip it if you want a tagged release to pin, English-first documentation, or nothing more than a dashboard, since a plain frontend framework covers that with far less machinery. Before committing, check that the repository actually carries a LICENSE file, because GitHub reports no licence even though the README shows an MIT badge, and confirm the business plugin you need is listed in the marketplace at apehub.finecv.cn/apehub-web/plugins.html.

Frequently asked questions

Official sources

1. Issues
2. KevinLiss/ApeAdmin on GitHub
3. README