A control surface you can reason about.

The question you are actually asking: is this a real platform, or low-code with a chat toy in front of it? Short version: your agent talks to the backend through named, authenticated operations, reads structural maps rather than raw solution JSON, and every write is staged, previewable and reversible. Code lives where it should — in custom frontends.

The control surface

The MCP server exposes approximately 100 named operations, grouped by what they touch: solutions, objects, forms, workflows, grids, screens, groups, tenants, environments, transactions. The contract is maps, not JSON: reads return compact structural maps — labels, IDs, relationships — and writes are named for the change they express: add-field-to-form, update-drawer, set-object-permissions.

Solution edits are transactions. begin-solution-edit opens a working copy; preview-solution-edit returns an entity-level diff, never a JSON patch; diff-against-stored is a three-way drift check; commit-solution-edit lands everything as one save, or rollback-solution-edit discards it. One open transaction per solution, out-of-band writes blocked meanwhile with concurrent_mutation_blocked, and sixty seconds of inactivity rolls an abandoned transaction back.

Auth is per request: a bearer token validated on every call; a rejected call gets a bare 401 with no tool list. The agent acts with your permissions — the platform authorizes, the MCP server never decides — and a data write without a tenant context fails fast. The full surface, grouped by what it touches.

Custom frontends and the build pipeline

When the renderer is not enough, write React. The default scaffold is Vite + React + TypeScript; any framework that builds to static output works, with install, build and output directory configurable per app and .nvmrc pins honored. This is the one place your agent writes ordinary code, and the pipeline has no opinion about your component library.

Deploys run a seven-phase pipeline — fetch, install, build, verify, upload, promote, invalidate — from an immutable version snapshot, with the target environment’s variable bundle applied at build. Frontends can call the platform API directly for public object reads, so a dashboard sits on the same tables as the rest of the app. The pipeline in detail.

A documented API

The REST API is documented with Swagger — one documented API across every app in your account. Objects are real Postgres tables — id, tenant column, created and last-modified timestamps on every one — and adding a dimension runs a real ALTER TABLE. Object views are SQL-backed joins with the tenant filter injected. Grids are queried with filter operators — $eq, $contains, $gt, $in — plus ordering and pagination.

Query it, export it, leave with it — the ownership page draws the trade honestly.

Environments, rollback, deploy logs

↩ rollback · owner / editor / viewer · production is owner-only

Custom frontends move develop → staging → production, strictly one way and enforced in code: skipping a tier is a 409, promoting backwards is a 400. An editor can carry a build as far as staging; production, forward or back, belongs to an owner. Rollback is non-destructive — a new deployment pointing at the previous succeeded version — and every deploy, promotion and rollback is an append-only log row: who, when, status, error, URL. Raw build logs and a frozen build-environment snapshot sit with each deploy for the “why did v15 break” conversation.

Platform apps publish differently: publish-solution copies Current → Testing → Production in one step, with frozen Bench snapshots for backups. Environments in full.

Honest limits

• Static frontends only. No server rendering, no backend hosting for a custom frontend. Output is verified at 500 MB with an index.html required.
• Not self-hostable. Apps run on managed cloud infrastructure we operate, built primarily on AWS.
• Custom backend functions are roadmap, not shipped. The MCP server has no function tools yet. Scope and status.
• No custom domains yet. Every environment gets an HTTPS URL on our domain.
• One writer at a time. An edit-session lock (120 seconds, heartbeat-renewed) gates writes on a custom frontend; a write without it is a 423. One writer, many observers — not real-time collaborative editing.
• Staged edits are in memory. An open transaction lives on the MCP server until you commit, and a server restart loses it. Commit what you mean to keep.

Bring the agent you already use

Claude Code today over stdio; any MCP client over HTTP with SSE. The server ships its own domain knowledge — build order, schema prefixes, groups first, tenant selection — so a fresh agent learns the conventions in-band. No tokens. No credits. No meter. You bring the AI subscription you already pay for.

What the organization license covers, and what it does not: how we price  ·  how the category actually bills, with sources.