Documentation
Build with MainSDK
One SDK gives your TypeScript app sign-in, access, data, AI and payments behind standard interfaces, with swappable drivers, and checks all of it before every deploy.
Start in 5 minutes
Three ideas and one passing check, then the full quickstart app and your first check in CI.
- Thirty-minute pathThe shortest route from an empty folder to a passing mainsdk check, with only three ideas to learn.
- QuickstartGo from an empty folder to a Next.js app with sign-in, Postgres-style data and AI that passes mainsdk check, offline, adding one main.yaml key at a time.
- Your first checkRead mainsdk check output, fix a finding with a secret reference, record an expiring exception, check prod settings and run the check in CI with SARIF.$
npx mainsdk check --env prod
Choose your path
Four routes through the docs, in reading order.
Running an agency
Building app agents and Web3
Securing for enterprise
You are a coding agent
Popular tasks
Interfaces
86 interfaces in 12 categories, all free in your app. Filter interfaces or browse 164 integrations.
Identity and access8
- Sign-in and sessions
authBuilding for 0.3+3 - Connections to other services
connectionsBuilding for 0.3+8 - Phone, email and identity checks
verifyBuilding for 0.7+5 - Tenants
tenantBuilding for 0.3+1 - API keys for your customers
apikeysBuilding for 0.3+2 - Permissions
accessBuilding for 0.3+7 - Policy decisions
policyBuilding for 0.2+2 - Context and shared context
contextBuilding for 0.4+1
Data8
- Data and records
dbBuilding for 0.3+1 - Calendars
calendarBuilding for 1.2+3 - Import files and pull data
importsBuilding for 0.4+4 - Key-value store and cache
kvBuilding for 0.3+1 - Cache
cacheBuilding for 0.4+2 - Search
searchBuilding for 0.4+2 - Feeds and timelines
feedsBuilding for 0.4+2 - Offline-first replication
syncBuilding for 1.1+3
Security and privacy15
- Moderation
moderateBuilding for 0.4+4 - Secrets
secretsBuilding for 0.2+5 - Encryption keys
keysBuilding for 0.3+2 - Cryptography
cryptoBuilding for 0.3+3 - End-to-end encryption
e2eBuilding for 1.2+2 - Code sandboxes
sandboxBuilding for 0.4+2 - Rate limits and quotas
limitsBuilding for 0.3+2 - Protected files
protectBuilding for 0.4+4 - Privacy and data rights
privacyBuilding for 0.3+1 - Security events
securityBuilding for 0.3+1 - Incident controls
incidentBuilding for 0.4+1 - Exfiltration guard and canaries
canaryBuilding for 0.4+1 - Dependency checks
depsBuilding for 0.5+2 - Bot defence
botsBuilding for 0.3+4 - Connectors to GRC, privacy, vulnerability and ticket tools
connectorsBuilding for 1.2+11
Platform, OS and network11
- Network permissions
networkBuilding for 0.3+1 - Local files
diskBuilding for 0.3+1 - Server facts and programs
systemBuilding for 0.3+1 - TCP, UDP and unix sockets
netBuilding for 0.4+1 - Worker threads and cluster
workersBuilding for 0.4+1 - Languages and formats
i18nPreview+4 - Location
geoBuilding for 0.7+2 - App updates and version blocking
updatesBuilding for 0.7+1 - Neighbour apps
neighboursBuilding for 0.4+1 - App registry and link
appsBuilding for 0.4+1 - Connected devices
deviceBuilding for 1.3+2
Developer experience8
- Runtime settings
configBuilding for 0.2+3 - Schema and parsers
schemaBuilding for 0.2+1 - Feature flags
flagsPreview+2 - Typed API and OpenAPI document
apiBuilding for 0.3+1 - Testing kit
testingBuilding for 0.4+1 - Framework adapters
adaptersBuilding for 0.2+3 - Upgrades
upgradeBuilding for 0.5+2 - Adopt an existing app
adoptBuilding for 0.5+1
For coding agents
The same docs, in the forms agents read best.
Go deeper
How-to guidesUse cases, step by step
- How-to guides
- What MainSDK covers
- Recipes by app type
- Start a project and add interfaces
- Build a multi-tenant app
- Deploy on Vercel
- Ship with deploy config
Build with agentsAgents that build and agents inside your app
ConceptsThe ideas behind one SDK
- The words we use
- Interfaces and drivers
- Categories
- The main.yaml file
- The check
- Never in the request path
- Main 27 and the Main mark
ReferenceEvery command, key and code
All 8 pagesQuestions
Every answer comes from facts.yaml, the same facts the landing and llms.txt use.
Who is MainSDK for?
MainSDK is for people who ship apps with AI coding agents. That includes founders and builders with little coding background, freelancers and agencies who rescue and ship client apps, teams who build together, and security and platform teams who govern many apps. Builders start free, and teams and companies pay only for what MainSDK Cloud runs for them.
Is MainSDK open source?
Yes. MainSDK is licensed under Apache-2.0, and everything that runs inside your app is open source: the TypeScript SDK and core, the CLI, the checks, the drivers, the MCP server and the policy engine. Contributions carry a DCO sign-off. MainSDK Cloud, the hosted service for teams and companies, is where the paid plans apply.
How does MainSDK work?
MainSDK works in three steps. First, npx mainsdk init finds your framework, writes main.yaml and tells your coding agent the rules. Second, you name a driver for each capability, such as GitHub for sign-in or Amazon Bedrock for AI, one line each. Third, mainsdk check runs the same checks on your laptop and in CI, and a change ships only when it passes.
Which frameworks and runtimes does MainSDK support?
MainSDK targets TypeScript on Node.js 22 or later, with adapters for Next.js, Hono, Express and Node workers, and Prisma or Drizzle for data. An Expo and React Native adapter for mobile follows in phase 3. Bun, Deno and Cloudflare Workers as runtimes, and native Rust, Python and Go SDKs, follow in phase 5.
What is main.yaml?
main.yaml is the one file that declares what a MainSDK app is, needs and may do, like a mobile app's manifest. It names the driver for each interface, the hosts the app may call, its data labels and its permissions. Overlays such as main.in.yaml hold what differs by market, segment or environment, and the most specific file wins.
What does mainsdk check do?
mainsdk check verifies an app before it ships, on your laptop and in CI. It fails on problems such as a key in code, an action without a permission or a call to an undeclared host, and explains the fix. It runs in observe, warn or enforce mode and writes SARIF for CI. Every check is free and runs on your own machine.
Does MainSDK lock me in?
No. Every provider sits behind a contract you can swap, everything inside your app is Apache-2.0, and mainsdk eject leaves MainSDK for one interface or all of them. Eject writes plain provider code in place of MainSDK calls and keeps your tests, so leaving is a supported path, not a rewrite.
Where does MainSDK store data?
Data is stored by region: US, EU and India. The db interface keeps one store per region and writes each record to its owner's region, and mainsdk check refuses queries that join across regions. MainSDK Cloud runs in the same three regions. Personal data is labelled in the schema, so one call can export or erase a person everywhere.