# MainSDK docs

> MainSDK is an open-source app runtime SDK for agent-built apps: one SDK gives a TypeScript app sign-in, access, data, AI, payments and more behind standard interfaces with swappable drivers, and checks all of it before every deploy. In-app capabilities are Apache-2.0 and free.

## Start here

- [Five-minute path](https://mainsdk.dev/docs/getting-started/five-minutes.md): From an empty folder to an app with sign-in, a database and a protected route, in four commands and twelve lines you write.
- [Install MainSDK](https://mainsdk.dev/docs/getting-started/installation.md): Install the mainsdk package, CLI and testing kit in a Node.js 22+ TypeScript project and wire it into Next.js, Hono, Express or a worker.
- [Thirty-minute path](https://mainsdk.dev/docs/getting-started/thirty-minutes.md): The shortest route from an empty folder to a passing mainsdk check, with only three ideas to learn.
- [Quickstart](https://mainsdk.dev/docs/getting-started/quickstart.md): Go from an empty folder to a Next.js app with sign-in, Postgres-style data and AI that passes mainsdk check, offline, adding one main.yaml key at a time.
- [Adopt an existing app](https://mainsdk.dev/docs/getting-started/existing-app.md): Bring a Lovable, Bolt, v0 or Cursor app onto MainSDK with mainsdk check and mainsdk adopt, one module and one pull request at a time, no rewrite.
- [Your first check](https://mainsdk.dev/docs/getting-started/first-check.md): Read mainsdk check output, fix a finding with a secret reference, record an expiring exception, check prod settings and run the check in CI with SARIF.
- [Quick start for Next.js](https://mainsdk.dev/docs/getting-started/quickstart-nextjs.md): Add MainSDK to a Next.js App Router app, guard one route with auth.require, run it in local mode with a test user and pass mainsdk check.
- [Quick start for Hono](https://mainsdk.dev/docs/getting-started/quickstart-hono.md): Add MainSDK to a Hono app with one middleware, guard one route with auth.require, run it in local mode with a test user and pass mainsdk check.
- [Quick start for Express](https://mainsdk.dev/docs/getting-started/quickstart-express.md): Add MainSDK to an Express app with one middleware and one error handler, guard a route with auth.require, run it in local mode and pass mainsdk check.
- [Use MainSDK with your coding agent](https://mainsdk.dev/docs/getting-started/with-your-agent.md): Use MainSDK from Claude Code, Cursor, Codex or any MCP agent, with AGENTS.md rules, the MCP server, your actions as tools and the migration skill.

## Interfaces

- [Sign-in and sessions](https://mainsdk.dev/docs/interfaces/auth.md) (`auth`, Building for 0.3 · ships as a stable API): Sign people in with GitHub, passkeys, company SSO or WhatsApp, and keep their sessions safe.
- [Connections to other services](https://mainsdk.dev/docs/interfaces/connections.md) (`connections`, Building for 0.3 · ships as a experimental API): Let a person connect Gmail, GitHub or Slack once, so an app agent can act for them within the scopes they agreed to.
- [Phone, email and identity checks](https://mainsdk.dev/docs/interfaces/verify.md) (`verify`, Building for 0.7 · ships as a beta API): Confirm a phone number, an email address or a person's identity at the level a market requires, with no answer that tells who has an account.
- [Tenants](https://mainsdk.dev/docs/interfaces/tenant.md) (`tenant`, Building for 0.3 · ships as a stable API): Give every request a tenant and keep each customer's records, files, keys and logs apart, in the region they chose.
- [API keys for your customers](https://mainsdk.dev/docs/interfaces/apikeys.md) (`apikeys`, Building for 0.3 · ships as a beta API): Issue each customer API keys with scopes, rotation without downtime, instant revoke and a rate limit, and verify them on every call.
- [Permissions](https://mainsdk.dev/docs/interfaces/access.md) (`access`, Building for 0.3 · ships as a stable API): Decide who can do what to which record, with roles, attributes or relations on any engine.
- [Policy decisions](https://mainsdk.dev/docs/interfaces/policy.md) (`policy`, Building for 0.2 · ships as a stable API): Decide every sensitive call in process from policies kept in git, and explain each decision.
- [Context and shared context](https://mainsdk.dev/docs/interfaces/context.md) (`context`, Building for 0.4 · ships as a beta API): One request context every interface reads, and consent-gated, first-party shared context (settings and progress) between peer apps of one owner on one machine.
- [Data and records](https://mainsdk.dev/docs/interfaces/db.md) (`db`, Building for 0.3 · ships as a stable API): Read and write records that are private to their owner, stored in the owner's region, with labelled fields.
- [Calendars](https://mainsdk.dev/docs/interfaces/calendar.md) (`calendar`, Building for 1.2 · ships as a experimental API): Store events with recurrence and time zones, import and export iCalendar, and show free/busy without showing details.
- [Import files and pull data](https://mainsdk.dev/docs/interfaces/imports.md) (`imports`, Building for 0.4 · ships as a beta API): Read CSV, XLSX, JSON and NDJSON files, map their columns with a confirmed mapping, and pull from outside sources on a schedule.
- [Key-value store and cache](https://mainsdk.dev/docs/interfaces/kv.md) (`kv`, Building for 0.3 · ships as a beta API): Keep small values and counters under a key with an optional expiry, scoped to the tenant.
- [Cache](https://mainsdk.dev/docs/interfaces/cache.md) (`cache`, Building for 0.4 · ships as a beta API): Memoise any call with keys that always carry the tenant and region, and keep personal responses out of shared caches.
- [Search](https://mainsdk.dev/docs/interfaces/search.md) (`search`, Building for 0.4 · ships as a beta API): Index records and search them with facets, highlighting and typo tolerance, filtered by tenant and access inside the query.
- [Feeds and timelines](https://mainsdk.dev/docs/interfaces/feeds.md) (`feeds`, Building for 0.4 · ships as a experimental API): Follows, blocks and mutes, home timelines that fan out on write and on read, and trending per region, with a feed that has an end.
- [Offline-first replication](https://mainsdk.dev/docs/interfaces/sync.md) (`sync`, Building for 1.1 · ships as a experimental API): Keep a local copy of a person's rows on their device, work offline, and merge changes back to the server without losing edits.
- [AI calls](https://mainsdk.dev/docs/interfaces/ai.md) (`ai`, Building for 0.3 · ships as a beta API): Call any model through one interface, with keys out of your code, limits per user and every call audited.
- [Actions and agent tools](https://mainsdk.dev/docs/interfaces/action.md) (`action`, Preview · ships as a beta API): Write an action once and get an API endpoint, a server action, a CLI command and an MCP tool with the same checks.
- [App agents](https://mainsdk.dev/docs/interfaces/agents.md) (`agents`, Building for 0.3 · ships as a experimental API): Give each agent your app runs an identity in the audit log, a budget, a person's approval for risky steps and a kill switch.
- [Agent memory](https://mainsdk.dev/docs/interfaces/memory.md) (`memory`, Building for 0.4 · ships as a experimental API): Let app agents remember the people they serve, inside the tenant and the app, with untrusted recall, versions and forgetting you can prove.
- [Playbook advisor](https://mainsdk.dev/docs/interfaces/advisor.md) (`advisor`, Building for 0.6 · ships as a experimental API): Optionally let a model read signals and norms and propose one of the app's declared playbooks with a reason a person approves; off by default.
- [Payments](https://mainsdk.dev/docs/interfaces/pay.md) (`pay`, Building for 0.3 · ships as a stable API): Take payments and subscriptions on the provider's hosted checkout, routed by market, with no card data in your app.
- [Usage metering](https://mainsdk.dev/docs/interfaces/meter.md) (`meter`, Building for 0.3 · ships as a beta API): Record what each tenant uses, idempotently and without slowing a request, read it back by window, and export it to pay for usage billing.
- [Plans and entitlements](https://mainsdk.dev/docs/interfaces/entitlements.md) (`entitlements`, Building for 0.3 · ships as a beta API): Say what each plan includes, check it in one line, and set a tenant's plan from its subscription.
- [App licensing](https://mainsdk.dev/docs/interfaces/licence.md) (`licence`, Building for 0.4 · ships as a experimental API): Sell your app with signed licence files that switch features on, verify offline against a pinned key, and keep serving through a grace period.
- [Notifications](https://mainsdk.dev/docs/interfaces/notify.md) (`notify`, Building for 0.3 · ships as a stable API): Reach a person on push, WhatsApp, SMS or email with one call that respects their preferences and quiet hours.
- [Engagement journeys](https://mainsdk.dev/docs/interfaces/engagement.md) (`engagement`, Building for 0.4 · ships as a experimental API): Bring people back with reminder ladders that obey a weekly limit, quiet hours and a stop after ignored messages, with strict rules for children and no dark patterns.
- [Email](https://mainsdk.dev/docs/interfaces/email.md) (`email`, Building for 0.3 · ships as a stable API): Send transactional and marketing email, with one-click unsubscribe and no tracking pixels by default.
- [Inbound mail and mailboxes](https://mainsdk.dev/docs/interfaces/mail.md) (`mail`, Building for 1.2 · ships as a experimental API): Receive email through your mail provider's webhook, keep it in mailboxes with threads and attachments, and pull people's existing mailboxes over IMAP or JMAP.
- [Realtime updates](https://mainsdk.dev/docs/interfaces/realtime.md) (`realtime`, Building for 0.3 · ships as a beta API): Push live updates from your server to browsers over server-sent events, checked per channel and tenant.
- [File uploads](https://mainsdk.dev/docs/interfaces/files.md) (`files`, Building for 0.3 · ships as a stable API): Upload files to your own bucket, Uploadthing, Vercel Blob or getqr.id, scanned and private to their owner, with short-lived links to read them.
- [Share links and QR codes](https://mainsdk.dev/docs/interfaces/share.md) (`share`, Building for 0.3 · ships as a stable API): Share any record, file or screen as a private, expiring getqr.id link and QR code, run offline QR placements, and get first-party open counts with consent; the only way an app hands out a link.
- [Invite, deep and sign-in links](https://mainsdk.dev/docs/interfaces/links.md) (`links`, Building for 0.4 · ships as a beta API): Send invite links, deep links that open the right screen on the web, Android and iOS, and sign-in links that hand off to auth, all minted by getqr.id through share.
- [Images, video and audio](https://mainsdk.dev/docs/interfaces/media.md) (`media`, Building for 0.4 · ships as a beta API): Resize images to AVIF and WebP and transcode video and audio to HLS as workflows, with output through files and metadata stripped by default.
- [Moderation](https://mainsdk.dev/docs/interfaces/moderate.md) (`moderate`, Building for 0.4 · ships as a experimental API): Take reports, review them in a queue, decide and take appeals with a statement of reasons, and hold uploads until a pre-screen clears them.
- [PDF documents](https://mainsdk.dev/docs/interfaces/pdf.md) (`pdf`, Preview · ships as a beta API): Render PDFs from templates in the reader's language; the rendering half of documents.
- [Document reading](https://mainsdk.dev/docs/interfaces/documents.md) (`documents`, Preview · ships as a beta API): Read PDFs, Office files and scans into text, tables and layout, with OCR from the driver you pick and active content never run.
- [Webhooks](https://mainsdk.dev/docs/interfaces/webhooks.md) (`webhooks`, Preview · ships as a stable API): Send signed webhooks with retries and verify incoming ones before your handler runs.
- [Durable workflows](https://mainsdk.dev/docs/interfaces/workflows.md) (`workflows`, Preview · ships as a beta API): Write a multi-step flow as one function that waits for days and resumes after a crash, with each finished step journaled and never run twice.
- [Remote GPU and long jobs](https://mainsdk.dev/docs/interfaces/compute.md) (`compute`, Building for 0.6 · ships as a experimental API): Run GPU and long jobs on your own Modal, Replicate or RunPod account, or a local program, as workflows with progress, cancel, cost limits and results in files.
- [Events and background jobs](https://mainsdk.dev/docs/interfaces/jobs.md) (`jobs`, Building for 0.3 · ships as a stable API): Publish events, fan small messages out to every instance, and run background jobs that retry, survive restarts and never run twice for the same key.
- [Secrets](https://mainsdk.dev/docs/interfaces/secrets.md) (`secrets`, Building for 0.2 · ships as a stable API): Read provider keys on the server from your secrets manager, never from code or the browser.
- [Encryption keys](https://mainsdk.dev/docs/interfaces/keys.md) (`keys`, Building for 0.3 · ships as a beta API): Encrypt records with their own data keys, wrapped by a regional KMS key, with per-user keys for erasure.
- [Cryptography](https://mainsdk.dev/docs/interfaces/crypto.md) (`crypto`, Building for 0.3 · ships as a beta API): Encrypt fields, sign and verify, hash passwords and make tokens with modern algorithms only.
- [End-to-end encryption](https://mainsdk.dev/docs/interfaces/e2e.md) (`e2e`, Building for 1.2 · ships as a experimental API): Encrypt messages and records on people's devices with keys only they hold, using MLS for groups, so the server can't read them.
- [Network permissions](https://mainsdk.dev/docs/interfaces/network.md) (`network`, Building for 0.3 · ships as a beta API): Allow outbound calls only to the hosts you and your drivers declare, and block everything else.
- [Local files](https://mainsdk.dev/docs/interfaces/disk.md) (`disk`, Building for 0.3 · ships as a beta API): Read and write only the folders your server app declares; user uploads go through files, not here.
- [Server facts and programs](https://mainsdk.dev/docs/interfaces/system.md) (`system`, Building for 0.3 · ships as a beta API): Read the facts about the server and run the programs you declare, with every URL they are given checked against the network list.
- [TCP, UDP and unix sockets](https://mainsdk.dev/docs/interfaces/net.md) (`net`, Building for 0.4 · ships as a beta API): Open TCP connections, run TCP servers, send UDP datagrams and use unix domain sockets, each checked against the protocols, ports and directions main.yaml declares.
- [Worker threads and cluster](https://mainsdk.dev/docs/interfaces/workers.md) (`workers`, Building for 0.4 · ships as a beta API): Run CPU-heavy work on a pool of worker threads or processes, and run one server instance per core, declared in main.yaml and carrying the tenant.
- [Code sandboxes](https://mainsdk.dev/docs/interfaces/sandbox.md) (`sandbox`, Building for 0.4 · ships as a beta API): Run untrusted or AI-written code in a sandbox with time, memory and cost limits, no secrets, and only the hosts you allow.
- [Rate limits and quotas](https://mainsdk.dev/docs/interfaces/limits.md) (`limits`, Building for 0.3 · ships as a beta API): Rate-limit requests, enforce quotas and take locks from named policies, with standard 429 answers and a declared mode for when the store is down.
- [Protected files](https://mainsdk.dev/docs/interfaces/protect.md) (`protect`, Building for 0.4 · ships as a experimental API): Protect a file so it opens only under its policy, at its release time, can be revoked in seconds and shows who opened it.
- [Privacy and data rights](https://mainsdk.dev/docs/interfaces/privacy.md) (`privacy`, Building for 0.3 · ships as a beta API): Export or erase a person's data across every driver with one call, and record their consent.
- [Backups and restore drills](https://mainsdk.dev/docs/interfaces/backup.md) (`backup`, Building for 1.2 · ships as a beta API): Declare how much data you can lose and how fast you must restore, and prove it with timed restore drills.
- [Deploy config and serverless schedules](https://mainsdk.dev/docs/interfaces/deploy.md) (`deploy`, Building for 0.4 · ships as a beta API): Write the platform's own deploy files from main.yaml for Vercel, Cloudflare Workers, Fly.io and Docker, wake schedules through one tick route, check the build before it ships and diff two environments.
- [Health, resources and status page](https://mainsdk.dev/docs/interfaces/status-page.md) (`status`, Building for 0.4 · ships as a beta API): Serve health probes, drain cleanly on shutdown, track SLO burn, watch CPU, event-loop delay and memory. An app status page with incidents is planned for phase 2 and not built yet.
- [Security events](https://mainsdk.dev/docs/interfaces/security.md) (`security`, Building for 0.3 · ships as a beta API): Write security events in OCSF with ATT&CK tags, detect brute force, stuffing and probing in the app, and stream them to your own SIEM.
- [Incident controls](https://mainsdk.dev/docs/interfaces/incident.md) (`incident`, Building for 0.4 · ships as a beta API): Switch off one action, route, interface, driver or agent, put the app in read-only mode, or sign everyone out, in seconds and without a deploy.
- [Exfiltration guard and canaries](https://mainsdk.dev/docs/interfaces/canary.md) (`canary`, Building for 0.4 · ships as a beta API): Stop a stolen secret or a bulk copy of personal data leaving your app, and plant records and keys that raise an alarm when an intruder touches them.
- [Alerts](https://mainsdk.dev/docs/interfaces/alerts.md) (`alerts`, Building for 0.4 · ships as a beta API): Route SLO burn, downed dependencies, security detections and your own alerts to email, Slack, PagerDuty, Opsgenie or a webhook, once.
- [Signals](https://mainsdk.dev/docs/interfaces/signals.md) (`signals`, Building for 0.4 · ships as a beta API): Say what the app noticed (an attack, CPU pressure, a downed dependency, a rotated key, an anomaly) as one typed, signed, short-lived signal that the app, its other instances and its neighbour apps hear.
- [Playbooks](https://mainsdk.dev/docs/interfaces/playbooks.md) (`playbooks`, Building for 0.4 · ships as a beta API): Declare in main.yaml what the app does when a signal arrives, with dry-run, approval, an audit trail and automatic rollback; every step only tightens and expires.
- [Logs, audit and telemetry](https://mainsdk.dev/docs/interfaces/log.md) (`log`, Building for 0.2 · ships as a stable API): Log with redaction built in, keep a tamper-evident audit log and export telemetry to any OpenTelemetry backend.
- [Observe the SDK](https://mainsdk.dev/docs/interfaces/observe.md) (`observe`, Building for 0.3 · ships as a beta API): Subscribe to every decision and side effect the SDK makes on node:diagnostics_channel, with a bounded queue, redacted payloads and no cost when nobody listens.
- [Product analytics](https://mainsdk.dev/docs/interfaces/analytics.md) (`analytics`, Building for 0.3 · ships as a beta API): Track product events, metrics and usage, private by default, with nothing recorded before consent where it is required.
- [Behaviour norms](https://mainsdk.dev/docs/interfaces/norms.md) (`norms`, Building for 0.4 · ships as a beta API): Learn what normal looks like for the app (traffic, errors, latency, CPU, loop delay, memory) by hour of week, deterministically and with no model, and emit an anomaly signal when it leaves the range.
- [Languages and formats](https://mainsdk.dev/docs/interfaces/i18n.md) (`i18n`, Preview · ships as a beta API): Translate messages and format money, dates and numbers for each locale, with right-to-left and Indian scripts.
- [Location](https://mainsdk.dev/docs/interfaces/geo.md) (`geo`, Building for 0.7 · ships as a beta API): Get a coarse location hint from the declared platform's headers and geocode addresses through network, never for access decisions.
- [App updates and version blocking](https://mainsdk.dev/docs/interfaces/updates.md) (`updates`, Building for 0.7 · ships as a beta API): Tell users an update is ready, block old versions on the server as well as in the app, and roll releases out by percentage and market.
- [Feedback and support](https://mainsdk.dev/docs/interfaces/feedback.md) (`feedback`, Building for 0.6 · ships as a beta API): Let users report a problem or open a ticket, with the trace attached and screenshots redacted.
- [Neighbour apps](https://mainsdk.dev/docs/interfaces/neighbours.md) (`neighbours`, Building for 0.4 · ships as a beta API): Let MainSDK apps on one machine hear each other's signals on user-only sockets and, between declared peers, ask for status, a raised posture or shed load, and nothing else.
- [App registry and link](https://mainsdk.dev/docs/interfaces/apps.md) (`apps`, Building for 0.4 · ships as a beta API): See every MainSDK app on a machine from one local folder, and let two apps that declare each other prove who they are and call each other's exposed actions.
- [Ops server](https://mainsdk.dev/docs/interfaces/ops.md) (`ops`, Building for 0.4 · ships as a beta API): Let a coding agent ask a running app how it is, what it has seen and what a playbook would do, through nine MCP tools on a user-only socket, with every change waiting for a person.
- [Connected devices](https://mainsdk.dev/docs/interfaces/device.md) (`device`, Building for 1.3 · ships as a beta API): Optional plumbing for any fleet of devices or agents your app manages - enrolment, device identity and attestation, signed telemetry, policy sync, approved commands and health - with nothing loaded until you declare it.
- [Runtime settings](https://mainsdk.dev/docs/interfaces/config.md) (`config`, Building for 0.2 · ships as a stable API): Change typed runtime settings without a deploy, with every change audited.
- [Schema and parsers](https://mainsdk.dev/docs/interfaces/schema.md) (`schema`, Building for 0.2 · ships as a beta API): Describe app data once with s, get a strict check, a type and a JSON Schema, and turn raw text into checked values without a model.
- [Feature flags](https://mainsdk.dev/docs/interfaces/flags.md) (`flags`, Preview · ships as a beta API): Turn features on for some users, a market or a share of users, and change them while the app runs.
- [Typed API and OpenAPI document](https://mainsdk.dev/docs/interfaces/api.md) (`api`, Building for 0.3 · ships as a beta API): Turn the app's actions into REST routes, one OpenAPI document and a typed client, with idempotent writes and breaking changes caught before release.
- [Testing kit](https://mainsdk.dev/docs/interfaces/testing.md) (`testing`, Building for 0.4 · ships as a stable API): Test against in-memory fakes of every interface, control time and inject provider outages.
- [Framework adapters](https://mainsdk.dev/docs/interfaces/adapters.md) (`adapters`, Building for 0.2 · ships as a beta API): One import wires MainSDK into Next.js, Hono or Express, with a request context, a trace, ordered hooks and problem-detail errors.
- [Dependency checks](https://mainsdk.dev/docs/interfaces/deps.md) (`deps`, Building for 0.5 · ships as a beta API): Catch made-up, brand-new and look-alike packages, known advisories, denied licences and unreviewed install scripts in your dependencies when you run mainsdk check, offline-friendly and never in the app.
- [Upgrades](https://mainsdk.dev/docs/interfaces/upgrade.md) (`upgrade`, Building for 0.5 · ships as a beta API): Move every MainSDK package to a new release together with one command that applies the release's codemods and main.yaml moves and opens a pull request, and learn when a security release is out.
- [Adopt an existing app](https://mainsdk.dev/docs/interfaces/adopt.md) (`adopt`, Building for 0.5 · ships as a beta API): Bring an existing Next.js or Node app, including one from Lovable, Bolt or v0, onto MainSDK one module and one pull request at a time, with its behaviour locked first and its coding agent driving the steps.
- [Bot defence](https://mainsdk.dev/docs/interfaces/bots.md) (`bots`, Building for 0.3 · ships as a beta API): Score the sign-in, sign-up, reset and invite doors in process, challenge or refuse bots with a proof-of-work, and stop SMS and WhatsApp pumping before a message is paid for.
- [Connectors to GRC, privacy, vulnerability and ticket tools](https://mainsdk.dev/docs/interfaces/connectors.md) (`connectors`, Building for 1.2 · ships as a beta API): Push assure evidence to your GRC tool, run privacy requests from Transcend or OneTrust, send SBOM and VEX to your vulnerability tool, and open one ticket per failure.

## Questions

### Who is MainSDK for?

MainSDK is for people who ship apps with AI coding agents. That includes founders and builders with little coding background, freelancers and agencies who rescue and ship client apps, teams who build together, and security and platform teams who govern many apps. Builders start free, and teams and companies pay only for what MainSDK Cloud runs for them.

### Is MainSDK open source?

Yes. MainSDK is licensed under Apache-2.0, and everything that runs inside your app is open source: the TypeScript SDK and core, the CLI, the checks, the drivers, the MCP server and the policy engine. Contributions carry a DCO sign-off. MainSDK Cloud, the hosted service for teams and companies, is where the paid plans apply.

### How does MainSDK work?

MainSDK works in three steps. First, npx mainsdk init finds your framework, writes main.yaml and tells your coding agent the rules. Second, you name a driver for each capability, such as GitHub for sign-in or Amazon Bedrock for AI, one line each. Third, mainsdk check runs the same checks on your laptop and in CI, and a change ships only when it passes.

### Which frameworks and runtimes does MainSDK support?

MainSDK targets TypeScript on Node.js 22 or later, with adapters for Next.js, Hono, Express and Node workers, and Prisma or Drizzle for data. An Expo and React Native adapter for mobile follows in phase 3. Bun, Deno and Cloudflare Workers as runtimes, and native Rust, Python and Go SDKs, follow in phase 5.

### What is main.yaml?

main.yaml is the one file that declares what a MainSDK app is, needs and may do, like a mobile app's manifest. It names the driver for each interface, the hosts the app may call, its data labels and its permissions. Overlays such as main.in.yaml hold what differs by market, segment or environment, and the most specific file wins.

### What does mainsdk check do?

mainsdk check verifies an app before it ships, on your laptop and in CI. It fails on problems such as a key in code, an action without a permission or a call to an undeclared host, and explains the fix. It runs in observe, warn or enforce mode and writes SARIF for CI. Every check is free and runs on your own machine.

### Does MainSDK lock me in?

No. Every provider sits behind a contract you can swap, everything inside your app is Apache-2.0, and mainsdk eject leaves MainSDK for one interface or all of them. Eject writes plain provider code in place of MainSDK calls and keeps your tests, so leaving is a supported path, not a rewrite.

### Where does MainSDK store data?

Data is stored by region: US, EU and India. The db interface keeps one store per region and writes each record to its owner's region, and mainsdk check refuses queries that join across regions. MainSDK Cloud runs in the same three regions. Personal data is labelled in the schema, so one call can export or erase a person everywhere.

## More

- [Every integration](https://mainsdk.dev/docs/integrations/index.md)
- [llms.txt](https://mainsdk.dev/llms.txt)
- [llms-full.txt](https://mainsdk.dev/llms-full.txt)