---
title: "What MainSDK covers"
description: "A map from the needs of a modern app to the MainSDK interfaces, drivers and status that cover them, plus what MainSDK leaves out on purpose."
section: "guides"
canonical: "https://mainsdk.dev/docs/guides/what-is-covered"
updated: "2026-10-28"
---

# What MainSDK covers

> A map from the needs of a modern app to the MainSDK interfaces, drivers and status that cover them, plus what MainSDK leaves out on purpose.

Canonical: https://mainsdk.dev/docs/guides/what-is-covered · Updated: 2026-10-28

Use this page to find which interface covers a need, which drivers sit behind it and how far along it is. It is built from the interface catalog, so every row names a real interface and its real drivers. Where a need has no catalog row yet, the row says so.

> **Note:** MainSDK is pre-release. Every interface below is Planned: specified, not built. "Planned for 0.N" means the spec ships it at milestone 0.N. "Milestone [TBD]" means the interface has no milestone yet. Nothing here is Building or Available.

## Identity and sign-in

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Sign-in with passkeys, social, company SSO or WhatsApp codes, and safe sessions | [`auth`](https://mainsdk.dev/docs/interfaces/auth) | `github`, `clerk`, `auth0`, `better-auth`, `workos`, `supabase`, `local` | Planned for 0.3 | Passkeys by default. SAML, OIDC and SCIM are in the same interface. Native passkeys are planned for a later milestone [TBD]. |
| Confirm a phone, an email or an identity | [`verify`](https://mainsdk.dev/docs/interfaces/verify) | `bird`, `twilio-verify`, `digilocker`, `onfido`, `persona` | Planned (milestone [TBD]) | No spec yet. |
| Wallet sign-in | `auth` with a wallet method | Wallet driver [TBD] | Planned for 0.7 | Spec `web3-ready`. The catalog has no wallet driver yet. See [Wallets and agent payments](https://mainsdk.dev/docs/guides/web3-and-agent-payments). |

## Access and policy

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Decide who can do what to which record | [`access`](https://mainsdk.dev/docs/interfaces/access) | `cedar`, `opa`, `openfga`, `spicedb`, `cerbos`, `permit`, `oso`, `avp` | Planned for 0.3 | Deny by default. Lists are filtered in the database. |
| Decide sensitive calls in process from policies in git | [`policy`](https://mainsdk.dev/docs/interfaces/policy) | `cedar`, `opa` | Planned for 0.2 | Observe, warn and enforce modes. |

## Data

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Private records, stored in the owner's region | [`db`](https://mainsdk.dev/docs/interfaces/db) | `postgres`, `neon`, `supabase`, `sqlite` | Planned for 0.3 | `sqlite` is for local use only. Prisma and Drizzle work through adapters. |
| Small values and cached results with an expiry | [`kv`](https://mainsdk.dev/docs/interfaces/kv) | `upstash`, `redis`, `vercel-runtime-cache`, `cloudflare-kv` | Planned (milestone [TBD]) | No spec yet. |
| Search and vector search | [`search`](https://mainsdk.dev/docs/interfaces/search) | `typesense`, `meilisearch`, `algolia`, `pgvector` | Planned (milestone [TBD]) | No spec yet. Results are limited to the person searching. |
| Runtime settings without a deploy | [`config`](https://mainsdk.dev/docs/interfaces/config) | `files`, `vercel-global-config`, `aws-appconfig`, `cloudflare-kv` | Planned for 0.2 | Typed against a schema. |

## Files and uploads

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Upload files, private to their owner and scanned | [`files`](https://mainsdk.dev/docs/interfaces/files) | `getqr`, `s3`, `uploadthing`, `vercel-blob`, `local` | Planned for 0.3 | `s3` also covers R2, MinIO and B2. See [Upload files](https://mainsdk.dev/docs/guides/file-uploads). |
| Private, expiring share links and QR codes | [`share`](https://mainsdk.dev/docs/interfaces/share) | `getqr` | Planned for 0.3 | Always getqr.id (ADR-0009). |
| Links that open the right screen on web, Android and iOS | [`links`](https://mainsdk.dev/docs/interfaces/links) | `getqr` | Planned (milestone [TBD]) | No spec yet. |
| Resize images, transcode video | [`media`](https://mainsdk.dev/docs/interfaces/media) | `getqr`, `cloudinary`, `mux` | Planned (milestone [TBD]) | No spec yet. |
| Render and sign PDFs | [`pdf`](https://mainsdk.dev/docs/interfaces/pdf) | `builtin`, `docraptor`, `documenso` | Planned (milestone [TBD]) | No spec yet. |
| Protected files that can be revoked | [`protect`](https://mainsdk.dev/docs/interfaces/protect) | `taps-node`, `taps-hosted`, `sovedocs` | Planned for 1.6 | Stability experimental. |

## Payments

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Cards and subscriptions on a hosted checkout | [`pay`](https://mainsdk.dev/docs/interfaces/pay) | `stripe`, `razorpay`, `paddle`, `local` | Planned for 0.3 | No card data in your app. Routed by market. |
| UPI in India | `pay` | `razorpay` | Planned for 0.3 | `payments: { driver: razorpay, methods: [upi, cards] }` in the India overlay. |
| Agent payments inside an agent budget | `pay` with an agent-payment driver | Driver [TBD] | Planned for 0.7 | Spec `web3-ready`. Not yet a catalog call. |
| Usage metering | [`meter`](https://mainsdk.dev/docs/interfaces/meter) | `stripe-meters`, `lago` | Planned (milestone [TBD]) | No spec yet. |

## Email, notifications and WhatsApp

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Transactional and marketing email | [`email`](https://mainsdk.dev/docs/interfaces/email) | `resend`, `ses`, `local`, `postmark`, `bird`, `smtp` | Planned for 0.3 | One-click unsubscribe, no tracking pixels by default. |
| Push, WhatsApp, SMS and email with preferences | [`notify`](https://mainsdk.dev/docs/interfaces/notify) | `whatsapp-cloud`, `bird`, `msg91`, `twilio`, `local`, `fcm`, `apns`, `expo`, `resend`, `ses`, `onesignal` | Planned for 0.3 | WhatsApp only with recorded consent and approved templates. Push through FCM, APNs and Expo is planned for milestone 1.1. |

## Realtime

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Live updates to connected clients | [`realtime`](https://mainsdk.dev/docs/interfaces/realtime) | `pusher`, `ably`, `supabase-realtime` | Planned (milestone [TBD]) | No spec yet. Collaboration and presence come later [TBD]. |

## AI and LLMs

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Call a model with keys out of code, spend limits per user and an audit | [`ai`](https://mainsdk.dev/docs/interfaces/ai) | `bedrock`, `anthropic`, `openai`, `gateway`, `local` | Planned for 0.3 | Streaming, typed output, spend limits and the prompt-injection check are in the spec. |
| Embeddings | `ai` | Same drivers | Planned for 0.3 | `ai.embed()`. |
| Tools a model may call | [`action`](https://mainsdk.dev/docs/interfaces/action) | `mcp`, `http`, `server-action`, `cli` | Planned for 0.3 | `ai.tool()` only takes actions declared with `action()`. |
| Budgets, approvals and a kill switch for app agents | Spec `agent-governance` | None | Planned for 0.3 | A `main.yaml` key, not an interface in the catalog. See [Agents with an identity, a budget and approvals](https://mainsdk.dev/docs/agents/governance). |

## MCP server and client

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Expose actions as MCP tools | [`action`](https://mainsdk.dev/docs/interfaces/action) | `mcp`, `http`, `server-action`, `cli` | Planned for 0.3 | OAuth 2.1 on the endpoint, signed tool descriptions, a person's yes for destructive actions. |
| Call other MCP servers from your app | Spec `mcp-client` | None | Planned for 0.3 | `mcp.client(name)`, stability experimental. No catalog row yet. |

## Background jobs, workflows and webhooks

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Events and background jobs that retry and never run twice | [`jobs`](https://mainsdk.dev/docs/interfaces/jobs) | `inngest`, `vercel-queues`, `local`, `trigger-dev`, `sqs` | Planned for 0.3 | `trigger-dev` and `sqs` are deferred to the driver kit. Multi-step workflows as a separate interface are not in the catalog. |
| Send and receive signed webhooks | [`webhooks`](https://mainsdk.dev/docs/interfaces/webhooks) | `builtin`, `svix` | Planned for 0.3 | Replays older than 5 minutes are refused. |

## Feature flags, analytics and i18n

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Feature flags per user or market | [`flags`](https://mainsdk.dev/docs/interfaces/flags) | `openfeature`, `posthog`, `vercel-flags` | Planned (milestone [TBD]) | No spec yet. Targeting stays in your tool. |
| Product analytics with consent | [`analytics`](https://mainsdk.dev/docs/interfaces/analytics) | `posthog`, `plausible`, `google-analytics`, `segment`, `mainsdk` | Planned (milestone [TBD]) | No spec yet. |
| Active users by country and version | [`analytics`](https://mainsdk.dev/docs/interfaces/analytics) (`analytics.query`) | `builtin` | Planned for 0.3 (spec `analytics`) | Folded into analytics (ADR-0031). |
| Translation and locale formats | [`i18n`](https://mainsdk.dev/docs/interfaces/i18n) | `files`, `tolgee`, `crowdin`, `lokalise`, `ai-draft` | Planned (milestone [TBD]) | No spec yet. See [Languages and formats](https://mainsdk.dev/docs/guides/i18n). |
| Coarse location hint | [`geo`](https://mainsdk.dev/docs/interfaces/geo) | `platform-headers`, `mapbox`, `google-maps` | Planned (milestone [TBD]) | Never used for access. |
| Update prompts and version blocking | [`updates`](https://mainsdk.dev/docs/interfaces/updates) | `expo-updates`, `app-store`, `google-play`, `tauri` | Planned (milestone [TBD]) | No spec yet. |
| Feedback and support tickets | [`feedback`](https://mainsdk.dev/docs/interfaces/feedback) | `builtin`, `intercom`, `zendesk`, `plain` | Planned (milestone [TBD]) | No spec yet. |

## Observability and audit

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Logs with redaction, a tamper-evident audit log, OpenTelemetry export | [`log`](https://mainsdk.dev/docs/interfaces/log) | `terminal`, `otel`, `mainsdk` | Planned for 0.2 | Nothing goes to MainSDK Cloud without login and opt-in. |
| Health checks and a status page | [`status`](https://mainsdk.dev/docs/interfaces/status-page) | `builtin`, `provider` | Planned (milestone [TBD]) | No spec yet. |
| Backups and timed restore drills | [`backup`](https://mainsdk.dev/docs/interfaces/backup) | `neon-pitr`, `supabase-pitr`, `pgbackrest`, `aws-backup`, `object-lock` | Planned for 1.2 | The provider runs backups, not MainSDK. |

## Secrets, keys and security

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Provider keys from your secrets manager, never from code | [`secrets`](https://mainsdk.dev/docs/interfaces/secrets) | `vault`, `aws-secrets-manager`, `gcp-secret-manager`, `azure-key-vault`, `doppler`, `infisical`, `env`, `local` | Planned for 0.2 | A key in code fails the check. |
| Encryption keys, per-user keys and crypto-erasure | [`keys`](https://mainsdk.dev/docs/interfaces/keys) | `aws-kms`, `gcp-kms`, `azure-keyvault`, `vault-transit`, `local` | Planned for 0.3 | Chain signing profiles are spec `web3-ready`, planned for 0.7. |
| Encrypt fields, sign, hash passwords | [`crypto`](https://mainsdk.dev/docs/interfaces/crypto) | `cloud-kms`, `vault-transit`, `libsodium` | Planned (milestone [TBD]) | No spec yet. |
| Allow outbound calls only to declared hosts | [`network`](https://mainsdk.dev/docs/interfaces/network) | `builtin` | Planned for 0.3 | Deny by default. |
| Rate limits, locks and quotas | [`limits`](https://mainsdk.dev/docs/interfaces/limits) | `builtin`, `upstash`, `arcjet` | Planned (milestone [TBD]) | No spec yet. |

## Privacy and erasure

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Export or erase a person's data, record consent | [`privacy`](https://mainsdk.dev/docs/interfaces/privacy) | `builtin` | Planned for 0.3 | Erasure is confirmed by every driver, with a signed record. |

## Testing

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Test against fakes of every interface, control time, inject outages | [`testing`](https://mainsdk.dev/docs/interfaces/testing) | `fakes` | Planned for 0.4 | `createTestApp()` from `@mainsdk/testing`. See [Testing](https://mainsdk.dev/docs/guides/testing). |

## Deploy on Vercel

MainSDK is a library, not a host, so there is no deploy interface. Vercel is covered by guidance and by drivers: `vercel-queues` for `jobs`, `vercel-global-config` for `config`, `vercel-runtime-cache` for `kv`, `vercel-flags` for `flags` and `vercel-blob` for `files`. See [Deploy on Vercel](https://mainsdk.dev/docs/guides/deploy-vercel).

## Mobile (Expo)

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| An Expo app with sign-in, consent and push | Spec `expo-adapter` | `expo`, `fcm`, `apns` (for `notify`), `expo-updates` (for `updates`) | Planned for 1.1 | Imports from `mainsdk/expo`. An adapter, not an interface. |

## Web3

| Need | Interface | Drivers | Status | Notes |
| --- | --- | --- | --- | --- |
| Wallet sign-in, token gates, chain signing keys, agent payments | Spec `web3-ready` across `auth`, `access`, `keys` and `pay` | Chain and wallet drivers [TBD] | Planned for 0.7 | Stability experimental. No Web3 interface in the catalog. Chains are drivers (ADR-0011). See [Wallets and agent payments](https://mainsdk.dev/docs/guides/web3-and-agent-payments). |

## Not covered, by design

- **Hosting.** MainSDK runs inside your app. You deploy on Vercel or anywhere else.
- **UI components.** MainSDK ships no design system. The only components are `<Upload/>`, `<ShareBar/>` and `<QRCode/>` from `@getqr/react`.
- **ORM design.** `db` enforces owner scope, labels and regions. You keep Prisma or Drizzle through adapters; MainSDK does not replace them.
- **A CMS.** There is no content-management interface.
- **Chain RPC, indexing and contract tooling.** Use your own library through `raw()` (ADR-0011).
- **Custody and token issuance.** MainSDK never holds funds or private keys and never issues tokens.
- **Running your backups.** The provider does that; `backup` only declares and proves it.

## Covered by escape hatch

When a need falls outside an interface, `raw()` returns the provider's own client: `auth.raw()`, `db.raw()`, `files.raw()`, `pay.raw()`, `email.raw()`, `ai.raw()` and `access.raw()`. Every use is logged and listed by `mainsdk check`, so you always know where your app depends on one provider.

## Next

- [Recipes by app type](https://mainsdk.dev/docs/guides/stack-recipes)
- [Interfaces and drivers](https://mainsdk.dev/docs/concepts/interfaces-and-drivers)
- [Quickstart](https://mainsdk.dev/docs/getting-started/quickstart)