# MainSDK

> MainSDK is the open-source app runtime for apps built by AI coding agents: standard interfaces with swappable drivers, one main.yaml manifest, and checks that keep agent-written code safe, reliable and compliant by default.

MainSDK is pre-release. It is in design, no package is published, and these docs describe the planned product. The TypeScript public beta is milestone 0.5; version 1.0 follows an independent audit. It is not yet production-ready.

What it is: an SDK (the npm package `mainsdk`), a CLI and an MCP server that live in your repository. Your app calls one standard interface per capability, 40 in all, such as `auth`, `db`, `ai`, `pay`, `email`, `files` and `log`. A driver connects each interface to the provider you choose in `main.yaml`, so switching providers changes one line, not your code. It is not a framework, a hosting platform or a no-code builder, and it needs no sidecar.

How it works: `npx mainsdk init` finds your framework, writes `main.yaml` and tells your coding agent the rules. You name a driver per capability, such as GitHub for sign-in or Amazon Bedrock for AI. `mainsdk check` runs on your laptop and in CI, fails a change that leaks a key, skips a permission or calls an undeclared host, and hands the fix back to the agent.

Runs on: TypeScript on Node.js 22 or later, with adapters for Next.js (App Router), Hono, Express and Node workers, and Prisma or Drizzle for data. Expo and React Native follow in phase 3; Python, Go, Bun, Deno and Cloudflare Workers in phase 5. Works with any MCP-capable coding agent, including Claude Code, Cursor, Codex and GitHub Copilot.

AI providers: the `ai` interface has drivers for Amazon Bedrock, Anthropic and OpenAI, plus an AI gateway. Keys stay out of code, personal data is redacted before the model sees it, providers that train on or keep prompts are refused, and spend limits apply per user and feature.

Licence and price: everything that runs inside your app is free and open source under Apache-2.0, including every check, driver, the MCP server and the policy engine. MainSDK Cloud has paid plans for hosted history, team workflow and company-wide governance. An app protecting itself is never a paid feature.

Reliability: MainSDK is designed never to sit in the request path. Policy decisions run inside your app, no user request waits on MainSDK Cloud, and the app keeps its last good policy if the Cloud is unreachable. Data is stored by region: US, EU and India.

Made by HubXero (https://github.com/hubxero). Site: https://mainsdk.dev. Docs: https://mainsdk.dev/docs. Source: https://github.com/hubxero/mainsdk. Security: https://mainsdk.dev/security.

Every page below is Markdown. Interface pages include the catalog facts: status, calls, main.yaml, drivers, guarantees, features and check codes.

## Common tasks

- [Start from an empty folder](https://mainsdk.dev/docs/getting-started/thirty-minutes.md): The shortest route from an empty folder to a passing mainsdk check, with only three ideas to learn.
- [Upload files with S3, Uploadthing, Vercel Blob or getqr.id](https://mainsdk.dev/docs/guides/file-uploads.md): Add private avatar uploads to a Next.js app on S3 or getqr.id, test them offline, and swap stores by changing one line of main.yaml.
- [Build a SaaS, an AI chat, a marketplace or a wallet app](https://mainsdk.dev/docs/guides/stack-recipes.md): Seven end-to-end MainSDK recipes for SaaS, AI chat, marketplace, realtime, Expo, wallet and AI with uploads, each with main.yaml, code and a verify command.
- [Copy-paste prompts for a coding agent](https://mainsdk.dev/docs/agents/prompts.md): Ten copy-paste prompts for a coding agent on MainSDK, sign-in, data, AI, uploads, MCP, payments, jobs, repairs and adoption. Each ends with a check.
- [Fix check findings in a loop](https://mainsdk.dev/docs/agents/repair-loop.md): What mainsdk check --json --agent prints, how a coding agent reads each field, when it must ask a person, and how to use the same output in CI.
- [Give an app agent an identity, a budget and approvals](https://mainsdk.dev/docs/agents/governance.md): Give an app agent an audit identity, a spend budget, human approval for risky steps and a kill switch, and see a support bot refund an order end to end.
- [Expose actions as MCP tools or call other MCP servers](https://mainsdk.dev/docs/agents/mcp.md): Expose your actions to agents as MCP tools behind OAuth 2.1 and confirmation, and let your app call other MCP servers from an allowlist with pinned tools.
- [Wallet sign-in, token gates and agent payments](https://mainsdk.dev/docs/guides/web3-and-agent-payments.md): Add wallet sign-in, token-gated access and agent payments inside a budget, with chains kept in drivers and no custody, token issuance or chain RPC in MainSDK.
- [Allow only certain hosts, IPs and ranges](https://mainsdk.dev/docs/guides/restrict-network.md): Allow only named hosts, IPs and CIDR ranges, roll the rule out from observe to enforce, and export it as Kubernetes or AWS security group rules.
- [See every call, decision and change in your own tools](https://mainsdk.dev/docs/guides/see-what-your-app-does.md): Get a full picture of a MainSDK app - destinations, drivers, access decisions and a tamper-evident audit log - in your own OpenTelemetry stack or SIEM.
- [All how-to guides by use case](https://mainsdk.dev/docs/guides/index.md): Step-by-step guides by use case - build, store files, add AI, secure and govern, ship and hand over - each ending in a passing mainsdk check.
- [Is my need covered by an interface](https://mainsdk.dev/docs/guides/what-is-covered.md): A map from the needs of a modern app to the MainSDK interfaces, drivers and status that cover them, plus what MainSDK leaves out on purpose.
- [The words we use](https://mainsdk.dev/docs/concepts/vocabulary.md): The fixed vocabulary of MainSDK docs, specs and code, with the words to avoid, so a developer or an agent can search one word for one thing.
- [catalog.json](https://mainsdk.dev/catalog.json): every interface and driver with calls, main.yaml, status, codes and doc links, as JSON
- [docs-index.json](https://mainsdk.dev/docs-index.json): every docs page with title, description, section, status and Markdown URL, as JSON

## Get started

- [Agent skill](https://mainsdk.dev/skill/SKILL.md): the MainSDK skill for coding agents; copy it with [references/interfaces.md](https://mainsdk.dev/skill/references/interfaces.md) to .claude/skills/mainsdk/
- [Five-minute path](https://mainsdk.dev/docs/getting-started/five-minutes.md): From an empty folder to an app with sign-in, a database and a protected route, in four commands and twelve lines you write.
- [Install MainSDK](https://mainsdk.dev/docs/getting-started/installation.md): Install the mainsdk package, CLI and testing kit in a Node.js 22+ TypeScript project and wire it into Next.js, Hono, Express or a worker.
- [Thirty-minute path](https://mainsdk.dev/docs/getting-started/thirty-minutes.md): The shortest route from an empty folder to a passing mainsdk check, with only three ideas to learn.
- [Quickstart](https://mainsdk.dev/docs/getting-started/quickstart.md): Go from an empty folder to a Next.js app with sign-in, Postgres-style data and AI that passes mainsdk check, offline, adding one main.yaml key at a time.
- [Adopt an existing app](https://mainsdk.dev/docs/getting-started/existing-app.md): Bring a Lovable, Bolt, v0 or Cursor app onto MainSDK with mainsdk check and mainsdk adopt, one module and one pull request at a time, no rewrite.
- [Your first check](https://mainsdk.dev/docs/getting-started/first-check.md): Read mainsdk check output, fix a finding with a secret reference, record an expiring exception, check prod settings and run the check in CI with SARIF.
- [Quick start for Next.js](https://mainsdk.dev/docs/getting-started/quickstart-nextjs.md): Add MainSDK to a Next.js App Router app, guard one route with auth.require, run it in local mode with a test user and pass mainsdk check.
- [Quick start for Hono](https://mainsdk.dev/docs/getting-started/quickstart-hono.md): Add MainSDK to a Hono app with one middleware, guard one route with auth.require, run it in local mode with a test user and pass mainsdk check.
- [Quick start for Express](https://mainsdk.dev/docs/getting-started/quickstart-express.md): Add MainSDK to an Express app with one middleware and one error handler, guard a route with auth.require, run it in local mode and pass mainsdk check.
- [Use MainSDK with your coding agent](https://mainsdk.dev/docs/getting-started/with-your-agent.md): Use MainSDK from Claude Code, Cursor, Codex or any MCP agent, with AGENTS.md rules, the MCP server, your actions as tools and the migration skill.

## How-to guides

- [How-to guides](https://mainsdk.dev/docs/guides/index.md): Step-by-step guides by use case - build, store files, add AI, secure and govern, ship and hand over - each ending in a passing mainsdk check.
- [What MainSDK covers](https://mainsdk.dev/docs/guides/what-is-covered.md): A map from the needs of a modern app to the MainSDK interfaces, drivers and status that cover them, plus what MainSDK leaves out on purpose.
- [Recipes by app type](https://mainsdk.dev/docs/guides/stack-recipes.md): Seven end-to-end MainSDK recipes for SaaS, AI chat, marketplace, realtime, Expo, wallet and AI with uploads, each with main.yaml, code and a verify command.
- [Start a project and add interfaces](https://mainsdk.dev/docs/guides/start-a-project.md): Create main.yaml, add an interface with its local driver and a test, and check the machine and project.
- [Build a multi-tenant app](https://mainsdk.dev/docs/guides/build-a-multi-tenant-app.md): Give every customer a tenant, issue API keys, gate features by plan and invite teammates, with isolation enforced for you.
- [Deploy on Vercel](https://mainsdk.dev/docs/guides/deploy-vercel.md): Ship a MainSDK app on Vercel with secrets as references, a production overlay, mainsdk check on every pull request and a second network wall.
- [Ship with deploy config](https://mainsdk.dev/docs/guides/ship-with-deploy-config.md): Generate Vercel, Cloudflare, Fly or Docker files from main.yaml, run schedules on a serverless platform, fail the build on a missing secret and review a staging to production change.
- [Upload files with S3 or getqr.id](https://mainsdk.dev/docs/guides/file-uploads.md): Add private avatar uploads to a Next.js app on S3 or getqr.id, test them offline, and swap stores by changing one line of main.yaml.
- [Share anything](https://mainsdk.dev/docs/guides/share-anything.md): Share a record, a file or a screen as a private, expiring getqr.id link and QR code, print QR codes for posters, count opens with consent, send invite, deep and sign-in links, and do it all offline with the local driver.
- [Add sign-in to a page](https://mainsdk.dev/docs/guides/sign-in-page.md): Mount the sign-in routes with an adapter, then sign people in from the browser with passkeys, WhatsApp codes or an emailed link using the small client.
- [Extract structured data from text](https://mainsdk.dev/docs/guides/extract-structured-data.md): Turn an inbound email into a typed invoice. Try a pattern first, fall back to a model when it misses, and check both with one schema.
- [Swap a driver](https://mainsdk.dev/docs/guides/swap-a-driver.md): Change the provider behind an interface by editing main.yaml, prove it with tests and mainsdk check, and fail over or route by market.
- [Eject](https://mainsdk.dev/docs/guides/eject.md): Leave MainSDK for one interface or all of them. mainsdk eject writes plain provider SDK code in place of MainSDK calls and keeps your tests passing.
- [Give an app agent memory](https://mainsdk.dev/docs/guides/give-an-agent-memory.md): Let a support agent remember each customer's preferences, recall them into the next model call as data, keep tool-supplied facts quarantined, and forget a person with a signed receipt.
- [Require sign-in on your routes](https://mainsdk.dev/docs/guides/require-sign-in.md): Turn on passkeys and WhatsApp codes, guard a route with auth.require, read the session, and test the signed-out and signed-in cases.
- [Hand a project to a client](https://mainsdk.dev/docs/guides/client-handover.md): End an agency job cleanly. Eject to plain provider code, transfer the project to the client's organisation on free view-only seats, and hand over evidence.
- [Mount MainSDK in your framework](https://mainsdk.dev/docs/guides/mount-mainsdk-in-your-framework.md): Add the adapter for Next.js, Hono, Express, Cloudflare Workers or a job worker so every request carries a trace, a context and a problem response.
- [Set up a team on Teams](https://mainsdk.dev/docs/guides/set-up-a-team.md): Create an organisation, invite people, sign in with your identity provider, sync groups with SCIM, understand active developers and the yearly cap, and push audit evidence.
- [Migrate from raw provider SDKs](https://mainsdk.dev/docs/guides/migrate-from-raw-providers.md): Move Stripe, Auth0 or Clerk, and OpenAI SDK calls onto MainSDK pay, auth and ai, one module per pull request, with before and after code.
- [Migrate from Supabase](https://mainsdk.dev/docs/guides/migrate-from-supabase.md): Move Supabase database, auth, storage and realtime calls onto MainSDK db, auth, files and events, then keep what has no interface behind raw().
- [Migrate from Firebase](https://mainsdk.dev/docs/guides/migrate-from-firebase.md): Move Firestore, Firebase Auth and Storage calls onto MainSDK db, auth and files, with the codemod, the report and a pull request.
- [Migrate from Clerk](https://mainsdk.dev/docs/guides/migrate-from-clerk.md): Move Clerk sign-in, route protection and sign-in tokens onto the MainSDK auth interface and switch drivers when you choose.
- [Migrate from Auth0](https://mainsdk.dev/docs/guides/migrate-from-auth0.md): Move Auth0 sessions, the auth route handler and the Management API onto MainSDK auth, with a guided user move and a rollback.
- [Migrate from Auth.js](https://mainsdk.dev/docs/guides/migrate-from-authjs.md): Move Auth.js (NextAuth) sessions and adapters onto the MainSDK auth and db interfaces, with the codemod and a pull request.
- [SaaS web app reference](https://mainsdk.dev/docs/guides/reference-saas-web.md): Next.js on Vercel with Postgres, sign-in, organisations, Stripe checkout and email, on the SOC 2 baseline.
- [Verify a release](https://mainsdk.dev/docs/guides/verify-a-release.md): Check a MainSDK release before you install it: checksums, Sigstore signatures, SLSA provenance and the SBOM, with one command.
- [API service reference](https://mainsdk.dev/docs/guides/reference-api-service.md): A Node API with signed webhooks, jobs with a dead-letter queue and an outbound partner call, on the SOC 2 baseline.
- [Migrate from Better Auth](https://mainsdk.dev/docs/guides/migrate-from-better-auth.md): Move Better Auth server and client sign-in calls onto the MainSDK auth interface, keeping your users until you choose to move them.
- [Try a policy in the playground](https://mainsdk.dev/docs/guides/try-a-policy-in-the-playground.md): Run a Cedar or Rego policy on a request in the browser or the terminal, see the line that decided, run its tests, replay recorded decisions and share the state as a link.
- [Migrate from Stripe](https://mainsdk.dev/docs/guides/migrate-from-stripe.md): Move Stripe checkout, refunds and webhooks onto MainSDK pay with hosted checkout, idempotency keys and verified webhooks.
- [Payments checkout reference](https://mainsdk.dev/docs/guides/reference-payments-checkout.md): Hosted card fields, one charge per order and keys in KMS, in SAQ A scope for PCI DSS 4.0.1.
- [AI agent app reference](https://mainsdk.dev/docs/guides/reference-ai-agent.md): MCP tools from actions, agent identity and budget, human confirmation for destructive calls, EU AI Act disclosure.
- [Test your app](https://mainsdk.dev/docs/guides/testing.md): Test Pinecart with createTestApp from @mainsdk/testing - in-memory fakes, assertions, time control, chaos drills and policy tests, with no provider keys.
- [Call a model](https://mainsdk.dev/docs/guides/call-a-model.md): Call a model through ai with limits and audit, and get typed output.
- [Monorepos](https://mainsdk.dev/docs/guides/monorepos.md): Run several MainSDK apps in one repository with a shared main.workspace.yaml, one main.lock, and mainsdk check only on what a change touches.
- [Generate a video](https://mainsdk.dev/docs/guides/generate-a-video.md): Start a video job with ai.video, let the host finish it, and get a labelled file back.
- [Build a voice agent](https://mainsdk.dev/docs/guides/build-a-voice-agent.md): Answer phone calls with an AI agent that says it is AI, runs your actions as tools, and never records without consent.
- [Take a payment](https://mainsdk.dev/docs/guides/take-a-payment.md): Send a customer to a hosted checkout, handle the verified result and refund an order, with no card data in your app.
- [Wallets, token gates and agent payments](https://mainsdk.dev/docs/guides/web3-and-agent-payments.md): Add wallet sign-in, token-gated access and agent payments inside a budget, with chains kept in drivers and no custody, token issuance or chain RPC in MainSDK.
- [Expose an action to agents](https://mainsdk.dev/docs/guides/expose-an-action-to-agents.md): Write an action once and expose it as an endpoint and an MCP tool with the same checks.
- [Limits, metering and entitlements](https://mainsdk.dev/docs/guides/limits-and-metering.md): Rate-limit an endpoint, cap usage with a quota, meter what each tenant uses and gate features and limits by plan.
- [Roll out a feature with a flag](https://mainsdk.dev/docs/guides/roll-out-with-flags.md): Turn a feature on for some users and change it while the app runs.
- [Run CPU work on workers](https://mainsdk.dev/docs/guides/run-cpu-work-on-workers.md): Move CPU-heavy work off the request thread with workers.run, a declared module, a time limit and the tenant carried in.
- [Change your database safely](https://mainsdk.dev/docs/guides/change-your-database-safely.md): Add delete with undo, versioned updates and migrations that never lock a busy table, and watch for slow and repeated queries.
- [Make, read and convert documents](https://mainsdk.dev/docs/guides/documents.md): Render a PDF from a template, read PDFs and Word, Excel and PowerPoint files into text and tables, and convert a Word file to PDF, all offline.
- [Run one instance per core](https://mainsdk.dev/docs/guides/run-one-instance-per-core.md): Run one instance of your server per core with cluster.run, restart without dropping a request and stop cleanly on SIGTERM.
- [Keep short-lived values](https://mainsdk.dev/docs/guides/keep-short-lived-values.md): Store drafts and counters under a key with an expiry, scoped to the tenant, on a file in development and Redis in production.
- [Cache safely](https://mainsdk.dev/docs/guides/cache-safely.md): Memoise slow calls per tenant, share a public read action with a CDN, and see why a signed-in response is never shared.
- [Change config without a deploy](https://mainsdk.dev/docs/guides/change-config-without-a-deploy.md): Store runtime settings and flags, read them with config.get, watch changes, and roll a feature out in steps with no deploy.
- [Debug your app](https://mainsdk.dev/docs/guides/debugging.md): Go from an error to a fix with local logs, error codes and mainsdk logs, then debug production with live tail, debug sessions, replay and triage. Explain, driver tracing and OpenTelemetry export are planned.
- [Publish your actions as a typed API](https://mainsdk.dev/docs/guides/typed-api.md): Turn existing actions into an OpenAPI document and a typed client, with an idempotent write and a breaking-change check in CI.
- [Call your API from React](https://mainsdk.dev/docs/guides/use-react-hooks.md): Generate React hooks next to the typed client, then run an action with field errors, read and list with a cache, show the session and refresh on live events.
- [Import a customer's spreadsheet](https://mainsdk.dev/docs/guides/import-data.md): Preview a CSV or Excel file, confirm the column mapping, run a dry run, then write the rows, with a report of every row that failed.
- [Build a feed with an end](https://mainsdk.dev/docs/guides/build-a-feed-with-an-end.md): Let people follow, block and mute, read a chronological home timeline that fans out in the background and ends with a caught-up marker, and show trending tags per region.
- [Let an agent act in a customer's Gmail or GitHub](https://mainsdk.dev/docs/guides/connect-accounts.md): Connect a person's Google, GitHub or Slack account once, give an app agent only the scopes it needs, and make risky writes wait for a yes.
- [Seed demo data and make preview databases](https://mainsdk.dev/docs/guides/seed-and-preview.md): Seed the same synthetic demo rows every time, and give each git branch a preview database that expires after its time to live.
- [Restrict which hosts and IPs your app can reach](https://mainsdk.dev/docs/guides/restrict-network.md): Allow only named hosts, IPs and CIDR ranges, roll the rule out from observe to enforce, and export it as Kubernetes or AWS security group rules.
- [Track product events without identifying people](https://mainsdk.dev/docs/guides/track-events.md): Declare each product event and its props, send events with consent, and query active users, funnels and retention from the built-in store.
- [Declare what your app uses](https://mainsdk.dev/docs/guides/declare-what-your-app-uses.md): List the hosts, folders, server facts and programs your app uses, declare them in main.yaml like a phone's app privacy page, and keep the list in the build.
- [Protect a route with permissions](https://mainsdk.dev/docs/guides/protect-a-route-with-permissions.md): Decide who may do what to which record with access, and refuse the rest with a 403.
- [See every call, decision and change your app makes](https://mainsdk.dev/docs/guides/see-what-your-app-does.md): Get a full picture of a MainSDK app - destinations, drivers, access decisions and a tamper-evident audit log - in your own OpenTelemetry stack or SIEM.
- [Send engagement reminders without dark patterns](https://mainsdk.dev/docs/guides/engagement-messages.md): Send a short ladder of reminders to people who went quiet, within a weekly cap and quiet hours, that stops when they return or stop reading.
- [Give an agent a budget and approvals](https://mainsdk.dev/docs/guides/govern-an-app-agent.md): Name an agent, give it a budget and an approval rule, and switch it off without a deploy.
- [Keep policies in git](https://mainsdk.dev/docs/guides/keep-policies-in-git.md): Write decisions as policy files, decide in process and explain every decision.
- [Propose playbooks with the advisor](https://mainsdk.dev/docs/guides/propose-playbooks-with-the-advisor.md): Let a model read signals and propose one of your declared playbooks, with a person approving every proposal.
- [Run work in the background](https://mainsdk.dev/docs/guides/run-background-jobs.md): Queue a job that retries with backoff, applies its side effect once, lands in a dead-letter queue when it keeps failing, and runs on a schedule.
- [Protect a file so only the right people open it](https://mainsdk.dev/docs/guides/protect-an-app.md): Protect a file with protect, release it at a set time, share it through getqr.id, see who opened it and revoke it in seconds, all on the local driver first.
- [Send and receive webhooks](https://mainsdk.dev/docs/guides/send-and-receive-webhooks.md): Verify GitHub or Stripe webhooks before your code runs, run each delivery once, and send your own signed webhooks with retries and a delivery log.
- [Show untrusted text safely and protect web responses](https://mainsdk.dev/docs/guides/sanitize-and-protect-inbound.md): Sanitize user HTML and model Markdown, find raw HTML sinks, and send secure headers, CSRF checks, CORS rules and safe cookies from the inbound section.
- [License your app](https://mainsdk.dev/docs/guides/license-your-app.md): Gate paid features with signed licence files checked offline, test every state with the testing kit, and check a customer's file from the command line.
- [Build a durable workflow](https://mainsdk.dev/docs/guides/build-a-durable-workflow.md): Write a flow that sleeps, waits for an event and asks a person to approve as one async function, and watch it resume after a crash without repeating a step.
- [Issue licences from MainSDK Cloud](https://mainsdk.dev/docs/guides/issue-licences-from-the-cloud.md): Create a root and an issuing CA in your account's region, issue and renew a licence, revoke it with a second approver, and serve the refresh endpoint your app calls.
- [Send email and notifications](https://mainsdk.dev/docs/guides/send-email-and-notifications.md): Send a receipt, a newsletter with one-click unsubscribe and an order update on WhatsApp, SMS or email, with consent and quiet hours, offline.
- [Use MainSDK Cloud, usage and billing](https://mainsdk.dev/docs/guides/cloud-login-usage-and-billing.md): Sign in from the device flow, send events with an ingest key, read your usage, add a card with a cap, and understand grace and the 402 answer.
- [Make your app enterprise ready](https://mainsdk.dev/docs/guides/enterprise-ready.md): Give your own customers SAML or OIDC SSO, SCIM, phishing-resistant admin sign-in, an audit log, retention rules and legal hold, free in your app.
- [Watch your app's health and resource pressure](https://mainsdk.dev/docs/guides/alerts-and-health.md): Add health probes, a dependency check, SLO targets and resource limits, then read the state from the terminal and from code.
- [Know when your app breaks before your users tell you](https://mainsdk.dev/docs/guides/know-when-your-app-breaks.md): Capture every unhandled error, group it under a stable fingerprint, get alerted when a group is new or spiking, and send events to OpenTelemetry or Sentry.
- [Watch what your app decides](https://mainsdk.dev/docs/guides/watch-what-your-app-decides.md): Subscribe to network, access and action events, assert on them in a test, and print them while you debug a refused call.
- [Check your dependencies](https://mainsdk.dev/docs/guides/check-your-dependencies.md): Run the deps gate, read what it found, set a licence and advisory policy in main.yaml, and keep CI honest when the network is down.
- [Tell the right person once with alerts](https://mainsdk.dev/docs/guides/raise-and-route-alerts.md): Declare who gets paged and how, raise an alert from your code, fold repeats into one message, acknowledge and resolve it, and send a test.
- [Translate your app](https://mainsdk.dev/docs/guides/i18n.md): Translate Pinecart with t(), format money and dates per locale with i18n, fall back along a locale chain, and let mainsdk check catch missing strings.
- [Upgrade MainSDK](https://mainsdk.dev/docs/guides/upgrade-mainsdk.md): Plan an upgrade, let one command move every MainSDK package and apply the release's codemods, read the pull request it opens, and find out when a security release is out.
- [Switch things off in an incident without a deploy](https://mainsdk.dev/docs/guides/switch-things-off-in-an-incident.md): Kill an action, route, driver or agent, make the app read-only or sign people out with one command, see what is in force and let it expire.
- [Honour consent, export and erasure requests](https://mainsdk.dev/docs/guides/honour-consent-export-and-erasure.md): Declare retention per data label, record consent, read a consent platform's string, export a person's data and erase it with a signed record.
- [Use MainSDK from Rust](https://mainsdk.dev/docs/guides/use-mainsdk-from-rust.md): Add the native mainsdk crate to a Rust service, store data and files as one owner, and return problem details from axum.
- [Use MainSDK from Python](https://mainsdk.dev/docs/guides/use-mainsdk-from-python.md): Add the native mainsdk library to a Python service, store data and files as one owner, and return problem details from an ASGI app.
- [Use MainSDK from Go](https://mainsdk.dev/docs/guides/use-mainsdk-from-go.md): Add the native MainSDK Go module to a service, store data and files as one owner, and return problem details from net/http.
- [Confirm a phone, an email or an identity](https://mainsdk.dev/docs/guides/use-verify.md): Confirm a phone number with a six-digit code, an email address with a link, and a person's identity at the level a market requires, with no answer that tells who has an account.
- [Know what normal looks like for your app](https://mainsdk.dev/docs/guides/use-norms.md): Turn on norms, read what the app has learned, and get an anomaly signal when traffic, errors or loop delay leave their usual range.
- [Use app updates and version blocking in your app](https://mainsdk.dev/docs/guides/use-updates.md): Tell users an update is ready, block old versions on the server as well as in the app, and roll releases out by percentage and market.
- [Use backups and restore drills in your app](https://mainsdk.dev/docs/guides/use-backup.md): Declare how much data you can lose and how fast you must restore, and prove it with timed restore drills.
- [Use bot defence in your app](https://mainsdk.dev/docs/guides/use-bots.md): Score the sign-in, sign-up, reset and invite doors in process, challenge or refuse bots with a proof-of-work, and stop SMS and WhatsApp pumping before a message is paid for.
- [Use calendars in your app](https://mainsdk.dev/docs/guides/use-calendar.md): Store events with recurrence and time zones, import and export iCalendar, and show free/busy without showing details.
- [Use end-to-end encryption in your app](https://mainsdk.dev/docs/guides/encrypt-end-to-end.md): Encrypt messages and records on people's devices with keys only they hold, using MLS for groups, so the server can't read them.
- [Use exfiltration guard and canaries in your app](https://mainsdk.dev/docs/guides/use-canary.md): Stop a stolen secret or a bulk copy of personal data leaving your app, and plant records and keys that raise an alarm when an intruder touches them.
- [Use location in your app](https://mainsdk.dev/docs/guides/use-geo.md): Get a coarse location hint from the declared platform's headers and geocode addresses through network, never for access decisions.
- [Use offline-first replication in your app](https://mainsdk.dev/docs/guides/use-sync.md): Keep a local copy of a person's rows on their device, work offline, and merge changes back to the server without losing edits.
- [Use realtime updates in your app](https://mainsdk.dev/docs/guides/use-realtime.md): Push live updates from your server to browsers over server-sent events, checked per channel and tenant, and add a WebSocket when the client must talk back.
- [Use tcp, udp and unix sockets in your app](https://mainsdk.dev/docs/guides/use-net.md): Declare TCP, UDP and unix socket destinations and listeners in main.yaml, open sockets with TLS through net, test them on the in-process loopback, and check that nothing goes outside the rules.
- [Receive and thread email](https://mainsdk.dev/docs/guides/use-mail.md): Receive email through your mail provider's webhook, keep it in mailboxes with threads and attachments, and pull people's existing mailboxes over IMAP or JMAP.
- [Connect your security and ticket tools](https://mainsdk.dev/docs/guides/use-connectors.md): Push assure evidence to your GRC tool, run privacy requests from Transcend or OneTrust, send SBOM and VEX to your vulnerability tool, and open one ticket per failure.
- [Keep your keys in an HSM or in your customer's own key service](https://mainsdk.dev/docs/guides/use-hsm-keys.md): Point keys at a PKCS#11 or KMIP hardware module, state a FIPS claim only a certificate supports, and let a customer hold the key that wraps their data.
- [Respond to an attack or CPU pressure](https://mainsdk.dev/docs/guides/respond-to-attacks-and-pressure.md): Turn on signals and the attack, pressure and key-rotation playbooks, see what they would do, approve a run and watch it roll back.
- [Keep personal data in the person's own country](https://mainsdk.dev/docs/guides/store-personal-data-in-country.md): Mark fields as vaulted so a vault in the person's country holds the values and your database keeps only tokens, with reads allowed only for a stated purpose.
- [Confirm sensitive actions with a signed approval](https://mainsdk.dev/docs/guides/confirm-actions-with-signed-approvals.md): Make an action need a passkey signature over its exact amount and payee, and require a second approver for the most critical ones.
- [Add an industry pack to your app](https://mainsdk.dev/docs/guides/use-industry-packs.md): Turn on the payments, healthcare, insurance, finance or education pack, see what it adds, and check the controls it makes checkable.
- [Publish a driver to the marketplace](https://mainsdk.dev/docs/guides/publish-a-driver.md): Run conformance for every contract version your driver claims, submit it, and see how builders find it by interface, region and capability.
- [Link two apps on one machine](https://mainsdk.dev/docs/guides/link-two-apps.md): List the apps on a machine, let two sealed apps prove who they are, call an action one exposes, and ask a neighbour for status or relief.
- [Operate your app with a coding agent](https://mainsdk.dev/docs/guides/operate-your-app-with-an-agent.md): Let Claude Code or another MCP client ask your running app how it is and what a playbook would do, with every change waiting for you.
- [Give your customers API keys](https://mainsdk.dev/docs/guides/give-your-customers-api-keys.md): Issue a customer an API key with scopes, verify it on every call, rotate it without downtime and revoke it in seconds.
- [Gate features and limits by plan](https://mainsdk.dev/docs/guides/gate-features-by-plan.md): Declare plans in main.yaml, refuse paid features and over-limit actions with an upgrade hint, and change a tenant's plan from a verified payment event.
- [Meter usage per tenant](https://mainsdk.dev/docs/guides/meter-usage-per-tenant.md): Record what each tenant uses, read it back for a usage page, count a retry once and send hourly totals to your billing provider.
- [Seal data and erase a person with keys](https://mainsdk.dev/docs/guides/erase-a-user-with-keys.md): Seal a value with a per-user key held in your cloud KMS, open it with an audited purpose, rotate keys, and destroy one person's key to erase them everywhere.
- [Link to a screen in your app](https://mainsdk.dev/docs/guides/link-to-a-screen.md): Declare your screens once, then send links that open the right screen in the app or on the web, invite people, and revoke a link.
- [Run untrusted code in a sandbox](https://mainsdk.dev/docs/guides/run-untrusted-code-in-a-sandbox.md): Run a user's or an agent's code in an isolated sandbox with no network, a time and cost limit, files in and out, and an audit event per run.
- [Read your Fleet records](https://mainsdk.dev/docs/guides/read-your-fleet-records.md): Check a policy push with its inclusion proof, find the people a key touched, read the forensic timeline and export evidence for an audit.
- [Emit and react to signals](https://mainsdk.dev/docs/guides/react-to-signals.md): Emit an app signal when something needs attention, listen for built-in and your own signals, and read what was recorded with mainsdk signals.
- [Coordinate apps on one machine](https://mainsdk.dev/docs/guides/coordinate-apps-on-one-machine.md): Let MainSDK apps on the same host share attack and pressure signals over a local bus, and ask a declared peer for its status.
- [Share context between your apps](https://mainsdk.dev/docs/guides/share-context-between-your-apps.md): Let apps of one owner on one machine share a person's language or progress, only with their yes, and see what flows with mainsdk context.
- [Seal your build and prove what runs](https://mainsdk.dev/docs/guides/seal-your-build.md): Sign one record of what your build is, serve it at /.well-known/mainsdk.json, check the files at boot, and review new sensitive capabilities before a release.
- [Adopt an existing app](https://mainsdk.dev/docs/guides/adopt-an-existing-app.md): Bring a Next.js or Node app onto MainSDK one module and one pull request at a time, with its sign-in and checkout locked first.
- [Process uploaded images and video](https://mainsdk.dev/docs/guides/process-uploaded-media.md): Turn an upload into image sizes, HLS video and audio in a background job, then serve a signed link to the result.
- [Run a GPU job and keep the result](https://mainsdk.dev/docs/guides/run-gpu-jobs.md): Declare a pinned target with a price and timeout, start a job, watch its progress, cancel it, and read the result from files.
- [Add search to your app](https://mainsdk.dev/docs/guides/add-search.md): Index a model, query it as the person searching, and get facets and highlights that never show a record they may not read.
- [Moderate user content](https://mainsdk.dev/docs/guides/moderate-user-content.md): Take reports, hold uploads until a pre-screen clears them, decide with a statement of reasons, take appeals and export the transparency report.
- [Watch for security events](https://mainsdk.dev/docs/guides/watch-for-security-events.md): Write the app's own security events, listen for the ones the SDK writes, detect brute force and probing, and send them to your own SIEM.
- [Work with a coding agent](https://mainsdk.dev/docs/guides/work-with-a-coding-agent.md): Give Claude Code or another agent the docs, the types, the next action and the fixes for your project, with every write waiting for you.
- [Build a mobile app with Expo](https://mainsdk.dev/docs/guides/build-a-mobile-app-with-expo.md): Generate app.json, the iOS privacy manifest and the Play Data safety form from main.yaml, keep secrets in Keychain, attest the device and send push through notify.
- [Rotate a secret](https://mainsdk.dev/docs/guides/rotate-a-secret.md): See which secrets the app declares, rotate one without a restart, and keep verifying with the old value during the overlap.
- [Sign in on a phone](https://mainsdk.dev/docs/guides/sign-in-on-a-phone.md): Add QR sign-in from desktop to phone, push approval with number matching, trusted devices, recovery and native passkeys.
- [Ask for an age or an ID](https://mainsdk.dev/docs/guides/ask-for-age-or-id.md): Ask a wallet or DigiLocker for only the claim you need, verify the presentation, and let an agent act only after a person approves.
- [Prepare for post-quantum and FIPS](https://mainsdk.dev/docs/guides/prepare-for-post-quantum-and-fips.md): List every algorithm the app uses in a CBOM, sign with ML-DSA, exchange keys with a hybrid, and turn on FIPS mode with a named module.
- [Check your app against a standard](https://mainsdk.dev/docs/guides/assure-your-app.md): Run mainsdk assure against PCI DSS or another standard, see who owns each failure, gate merges in CI, open a pull request of mechanical fixes and keep signed evidence.
- [Run on Workers, Deno and Bun](https://mainsdk.dev/docs/guides/run-on-edge-runtimes.md): Run the same MainSDK routes on Cloudflare Workers, Deno and Bun, know which interfaces each runtime lacks, and start from the edge reference.
- [Enrol and watch your devices](https://mainsdk.dev/docs/guides/enrol-and-watch-your-devices.md): Declare device, make an enrolment token, enrol a device with its own key, read its health, receive its telemetry once and in order, and revoke it.
- [Command and configure your devices](https://mainsdk.dev/docs/guides/command-your-devices.md): Define a command type, send it to a device or a group, approve it, undo it, roll out a signed policy in stages and let a playbook tighten it for a while.
- [See every app you run](https://mainsdk.dev/docs/guides/see-your-whole-estate.md): Enrol apps through device management, cloud identity, DNS or a vendor share, then list them, find shadow apps, export firewall rules, search SBOMs and read what is broken.

## Build with agents

- [Build with agents](https://mainsdk.dev/docs/agents/index.md): How a coding agent reads, builds and repairs an app on MainSDK, and the rules it never breaks. The whole loop on one page, for the agent and the developer.
- [Prompts that work](https://mainsdk.dev/docs/agents/prompts.md): Ten copy-paste prompts for a coding agent on MainSDK, sign-in, data, AI, uploads, MCP, payments, jobs, repairs and adoption. Each ends with a check.
- [The repair loop](https://mainsdk.dev/docs/agents/repair-loop.md): What mainsdk check --json --agent prints, how a coding agent reads each field, when it must ask a person, and how to use the same output in CI.
- [MCP server and client](https://mainsdk.dev/docs/agents/mcp.md): Expose your actions to agents as MCP tools behind OAuth 2.1 and confirmation, and let your app call other MCP servers from an allowlist with pinned tools.
- [Agents with an identity, a budget and approvals](https://mainsdk.dev/docs/agents/governance.md): Give an app agent an audit identity, a spend budget, human approval for risky steps and a kill switch, and see a support bot refund an order end to end.

## Concepts

- [The words we use](https://mainsdk.dev/docs/concepts/vocabulary.md): The fixed vocabulary of MainSDK docs, specs and code, with the words to avoid, so a developer or an agent can search one word for one thing.
- [Interfaces and drivers](https://mainsdk.dev/docs/concepts/interfaces-and-drivers.md): Your app calls one interface per capability; a driver talks to the provider you pick in main.yaml. Swap the provider, keep the code.
- [Categories](https://mainsdk.dev/docs/concepts/categories.md): The twelve categories every MainSDK interface and spec belongs to, so people and coding agents find a capability in the same place.
- [The main.yaml file](https://mainsdk.dev/docs/concepts/main-yaml.md): One file declares what your app is, needs and may do. Overlays hold what differs by market, segment or environment; org files set defaults.
- [The check](https://mainsdk.dev/docs/concepts/the-check.md): What mainsdk check verifies, the four layers of code safety, exceptions, exit codes, and how to run it in CI with JSON and SARIF output.
- [Never in the request path](https://mainsdk.dev/docs/concepts/fail-static.md): Your app keeps serving when MainSDK Cloud is down. Policy runs in process, telemetry never blocks, and the last good policy stays in force.
- [Main 27 and the Main mark](https://mainsdk.dev/docs/concepts/main27.md): Main 27 is the named, versioned minimum every MainSDK app meets. The Main mark proves a release holds it. Interfaces ship as stable, beta or experimental.
- [Actions and MCP](https://mainsdk.dev/docs/concepts/actions-and-mcp.md): Write an action once and get an API endpoint, a server action, a CLI command and, if you choose, an MCP tool, all behind one policy.
- [Agent memory](https://mainsdk.dev/docs/concepts/agent-memory.md): How app agents remember people with MainSDK - scoped to one tenant and app, recalled as untrusted data, versioned instead of overwritten, and forgotten with a signed receipt.
- [Policy as code](https://mainsdk.dev/docs/concepts/policy.md): One policy engine decides who can do what and which data may go where, in the app, in CI and later from Fleet. Cedar by default, OPA as a driver.
- [Free in the app, paid in the Cloud](https://mainsdk.dev/docs/concepts/free-and-cloud.md): Everything that runs inside your app is open source and free forever. You pay only for what MainSDK Cloud runs for you, by plan.
- [Licensing](https://mainsdk.dev/docs/concepts/licensing.md): Sell your app with signed licence files checked offline, and tell app licences apart from TAPS licences, API keys and entitlements.
- [Security model](https://mainsdk.dev/docs/concepts/security-model.md): How MainSDK keeps keys out of code, limits who your app talks to, redacts what it writes and signs what it ships and delivers.
- [Connected intelligence](https://mainsdk.dev/docs/concepts/connected-intelligence.md): How a MainSDK app notices trouble, reacts within limits you declare, learns what normal looks like, looks out for its neighbours and lets an agent operate it, with a person in charge.
- [Connected devices](https://mainsdk.dev/docs/concepts/connected-devices.md): The optional plumbing for any fleet of devices or agents your app manages, from enrolment and identity to telemetry, policy, commands and health, and what MainSDK leaves to you.
- [Data and regions](https://mainsdk.dev/docs/concepts/data-and-regions.md): Label personal data in the schema, keep each record in its owner's region (US, EU or India), and erase a person everywhere with a signed record.

## Reference

- [CLI](https://mainsdk.dev/docs/reference/cli.md): Every mainsdk command and flag the specs define, with exit codes, an example, and the milestone each one ships in.
- [main.yaml keys](https://mainsdk.dev/docs/reference/main-yaml.md): Every main.yaml key the specs define, with its type, default where one is set, what it does and an example, grouped by interface.
- [Check codes](https://mainsdk.dev/docs/reference/check-codes.md): Every MAIN- code the specs define so far, grouped by area, with where you meet it, what it means and how to fix it.
- [Errors and problem details](https://mainsdk.dev/docs/reference/errors.md): The MainSDK error shape - RFC 9457 problem details, the MainError class, stable MAIN- codes, redaction, mainsdk explain and MAINSDK_DEBUG.
- [Environment variables](https://mainsdk.dev/docs/reference/environment.md): The environment variables MainSDK reads (MAINSDK_DEBUG, MAINSDK_TELEMETRY, MAINSDK_KEY, MAINSDK_TENANT), ingest key prefixes and OIDC in CI.
- [Developer levels](https://mainsdk.dev/docs/reference/developer-levels.md): The four developer levels (Developer, Verified, Trusted publisher, Certified partner), the exact criteria for each, and the rules that drop a level.
- [Glossary](https://mainsdk.dev/docs/reference/glossary.md): One-line definitions of the terms MainSDK uses, from action and adapter to TUF and workspace, each linked to the page that explains it.
- [Diagnostics channels](https://mainsdk.dev/docs/reference/channels.md): Every channel MainSDK publishes on node:diagnostics_channel, with its kind, version and publisher, and how a channel changes between versions.

## Interfaces

- [Every interface](https://mainsdk.dev/docs/interfaces/index.md): all 86 interfaces by category
- [Sign-in and sessions](https://mainsdk.dev/docs/interfaces/auth.md): Sign people in with passkeys, WhatsApp codes, sign-in links, social login or company SSO, and keep sessions short-lived, device-bound and audited.
- [Connections to other services](https://mainsdk.dev/docs/interfaces/connections.md): Let a person connect Gmail, GitHub or Slack once, so an app agent can act for them within the scopes they agreed to, with one place to take it back.
- [Phone, email and identity checks](https://mainsdk.dev/docs/interfaces/verify.md): Confirm a phone number, an email address or a person's identity at the level a market requires, with Twilio Verify, Bird, DigiLocker, Onfido or Persona and no answer that tells who has an account.
- [Tenants](https://mainsdk.dev/docs/interfaces/tenant.md): Give every request a tenant and keep each customer's records, files, keys and logs apart, in the region they chose.
- [API keys for your customers](https://mainsdk.dev/docs/interfaces/apikeys.md): Issue each customer API keys with scopes, rotation without downtime, instant revoke and a rate limit, and verify them on every call.
- [Permissions](https://mainsdk.dev/docs/interfaces/access.md): Decide who can do what to which record with roles, owners, rules and relations declared in main.yaml, with every decision audited and explainable.
- [Policy decisions](https://mainsdk.dev/docs/interfaces/policy.md): Decide every sensitive call in process, explain which rule decided, and later load policies from git and roll changes out in shadow first.
- [Context and shared context](https://mainsdk.dev/docs/interfaces/context.md): One request context every interface reads, and consent-gated, first-party shared context (settings and progress) between peer apps of one owner on one machine.
- [Data and records](https://mainsdk.dev/docs/interfaces/db.md): Read and write records that are private to their owner, stored in the owner's region, with labelled and encrypted fields.
- [Calendars](https://mainsdk.dev/docs/interfaces/calendar.md): Store events with recurrence and time zones, import and export iCalendar, and show free/busy without showing details.
- [Import files and pull data](https://mainsdk.dev/docs/interfaces/imports.md): Read CSV, XLSX, JSON and NDJSON files, map their columns with a confirmed mapping, write rows safely, and pull from outside sources on a schedule.
- [Key-value store](https://mainsdk.dev/docs/interfaces/kv.md): Keep small values and counters under a key with an optional expiry, scoped to the tenant, on a local file or Redis.
- [Cache](https://mainsdk.dev/docs/interfaces/cache.md): Memoise any call with keys that carry the tenant and region, keep personal responses out of shared caches, and keep serving when the cache store is down.
- [Search and vector search](https://mainsdk.dev/docs/interfaces/search.md): Index records and search them with facets, highlights and typo tolerance, with every result filtered by tenant and by what the searcher may read.
- [Feeds and timelines](https://mainsdk.dev/docs/interfaces/feeds.md): Follows, blocks and mutes, home timelines that fan out on write and on read, and trending per region, with a feed that has an end.
- [Offline-first replication](https://mainsdk.dev/docs/interfaces/sync.md): Keep a local copy of a person's rows on their device, work offline, and merge changes back to the server without losing edits.
- [AI calls](https://mainsdk.dev/docs/interfaces/ai.md): Call any model through one interface, with personal data redacted first, no training or retention, spend limits per user and every call audited.
- [Actions and agent tools](https://mainsdk.dev/docs/interfaces/action.md): Write an action once and get an API endpoint, a server action, a CLI command and an opt-in MCP tool, all behind the same checks.
- [App agents](https://mainsdk.dev/docs/interfaces/agents.md): Give each agent your app runs an identity in the audit log, a budget, a person's approval for risky steps and a kill switch.
- [Agent memory](https://mainsdk.dev/docs/interfaces/memory.md): Let app agents remember the people they serve, inside the tenant and the app, with untrusted recall, versions and forgetting you can prove.
- [Playbook advisor](https://mainsdk.dev/docs/interfaces/advisor.md): Optionally let a model read signals and norms and propose one of the app's declared playbooks with a reason a person approves; off by default.
- [Remote GPU and long jobs](https://mainsdk.dev/docs/interfaces/compute.md): Run GPU and long jobs on your own Modal, Replicate or RunPod account, or a local program, as workflows with progress, cancel, cost limits and results in files.
- [Ops server](https://mainsdk.dev/docs/interfaces/ops.md): Let a coding agent ask a running app how it is, what it has seen and what a playbook would do, through nine MCP tools on a user-only socket, with every change waiting for a person.
- [Notifications](https://mainsdk.dev/docs/interfaces/notify.md): Reach a person on push, WhatsApp, SMS or email with one call that follows their channel choice, opt-outs, consent and quiet hours.
- [Engagement journeys](https://mainsdk.dev/docs/interfaces/engagement.md): Bring people back with reminder ladders that obey a weekly limit, quiet hours and a stop after ignored messages, with strict rules for children and no dark patterns.
- [Email](https://mainsdk.dev/docs/interfaces/email.md): Send transactional and marketing email with one-click unsubscribe, a suppression list, no tracking pixels and no double sends.
- [Inbound mail and mailboxes](https://mainsdk.dev/docs/interfaces/mail.md): Receive email through your mail provider's webhook, keep it in mailboxes with threads and attachments, and pull people's existing mailboxes over IMAP or JMAP.
- [Realtime updates](https://mainsdk.dev/docs/interfaces/realtime.md): Push live updates to browsers over server-sent events, with every subscribe checked per channel and tenant.
- [Feedback and support](https://mainsdk.dev/docs/interfaces/feedback.md): Let users report a problem or open a ticket, with the trace, version and steps attached and screenshots redacted.
- [Webhooks](https://mainsdk.dev/docs/interfaces/webhooks.md): Send webhooks signed per Standard Webhooks with retries and a delivery log, and verify incoming ones from Stripe, GitHub and more before your handler runs.
- [Durable workflows](https://mainsdk.dev/docs/interfaces/workflows.md): Write a flow that takes minutes or weeks as one async function, with each step journaled and never run twice after a crash, restart or deploy.
- [Events and background jobs](https://mainsdk.dev/docs/interfaces/jobs.md): Publish CloudEvents, run background jobs that retry with backoff and land in a dead-letter queue, and apply every side effect once per idempotency key.
- [File uploads](https://mainsdk.dev/docs/interfaces/files.md): Upload files through one interface over getqr.id, S3 or local disk. Every file is scanned, private to its owner and read through signed, short-lived URLs.
- [Share links and QR codes](https://mainsdk.dev/docs/interfaces/share.md): Share a link or file as a private, expiring, read-only getqr.id link and QR code, with open counts only under consent.
- [App links](https://mainsdk.dev/docs/interfaces/links.md): Create getqr.id deep, invite and sign-in links that open the right screen on the web, Android and iOS, with association files generated from main.yaml.
- [Images and video](https://mainsdk.dev/docs/interfaces/media.md): Turn uploads into image sizes, HLS video and audio in a background job, written back through files with location data stripped by default.
- [PDF documents](https://mainsdk.dev/docs/interfaces/pdf.md): Render PDFs from layouts and templates in the reader's language with the built-in renderer, Gotenberg or DocRaptor; the rendering half of documents.
- [Document reading](https://mainsdk.dev/docs/interfaces/documents.md): Read PDFs, Office files and scans into text, tables and layout, and render PDFs, with OCR from the driver you pick and active content never run.
- [Payments](https://mainsdk.dev/docs/interfaces/pay.md): Take payments and subscriptions on the provider's hosted checkout, with verified webhooks, idempotent calls and no card data in your app.
- [Usage metering](https://mainsdk.dev/docs/interfaces/meter.md): Record what each tenant uses, read it back by hour, day or month, and send closed hours to your billing provider through pay.
- [Plans and entitlements](https://mainsdk.dev/docs/interfaces/entitlements.md): Say what each plan includes, check it in one line, and set a tenant's plan from its subscription.
- [App licensing](https://mainsdk.dev/docs/interfaces/licence.md): Sell your app with signed licence files that switch features on, verify offline against a pinned key, and keep serving through a grace period.
- [Moderation](https://mainsdk.dev/docs/interfaces/moderate.md): Take reports, review them in a queue, decide and take appeals with a statement of reasons, and hold uploads until a pre-screen clears them.
- [Secrets](https://mainsdk.dev/docs/interfaces/secrets.md): Refer to provider keys from main.yaml as secret:NAME, keep them out of code, env files and logs, and have mainsdk check fail a leaked key.
- [Encryption keys](https://mainsdk.dev/docs/interfaces/keys.md): Encrypt each record with its own data key, wrapped by a regional KMS key, with per-user keys so one call erases a person everywhere.
- [Cryptography](https://mainsdk.dev/docs/interfaces/crypto.md): Seal data, sign and verify, hash, HMAC and make random tokens with modern algorithms only, on WebCrypto with no dependency.
- [End-to-end encryption](https://mainsdk.dev/docs/interfaces/e2e.md): Encrypt messages and records on people's devices with keys only they hold, using MLS for groups, so the server can't read them.
- [Code sandboxes](https://mainsdk.dev/docs/interfaces/sandbox.md): Run untrusted or AI-written code in a sandbox with time, memory and cost limits, no secrets, and only the hosts you allow.
- [Rate limits and quotas](https://mainsdk.dev/docs/interfaces/limits.md): Rate-limit requests, enforce quotas, run a job on one worker and cap concurrency, answering refusals as 429 problems with Retry-After.
- [Protected files](https://mainsdk.dev/docs/interfaces/protect.md): Protect a file so it opens only under its policy on a TAPS Node, can be released at a set time, revoked in seconds and records every open.
- [Privacy and data rights](https://mainsdk.dev/docs/interfaces/privacy.md): Declare retention per data label, export or erase a person across every driver with one call, and record consent per purpose.
- [Security events](https://mainsdk.dev/docs/interfaces/security.md): Write security events in OCSF with ATT&CK tags, detect brute force, stuffing and probing in the app, and stream them to your own SIEM.
- [Incident controls](https://mainsdk.dev/docs/interfaces/incident.md): Switch off one action, route, interface, driver or agent, put the app in read-only mode, or sign everyone out, in seconds and without a deploy.
- [Exfiltration guard and canaries](https://mainsdk.dev/docs/interfaces/canary.md): Stop a stolen secret or a bulk copy of personal data leaving your app, and plant records and keys that raise an alarm when an intruder touches them.
- [Dependency checks](https://mainsdk.dev/docs/interfaces/deps.md): Catch made-up, brand-new and look-alike packages, known advisories, denied licences and unreviewed install scripts in your dependencies when you run mainsdk check, with a 24-hour cache and a clear notice offline.
- [Bot defence](https://mainsdk.dev/docs/interfaces/bots.md): Score the sign-in, sign-up, reset and invite doors in process, challenge or refuse bots with a proof-of-work, and stop SMS and WhatsApp pumping before a message is paid for.
- [Connectors to GRC, privacy, vulnerability and ticket tools](https://mainsdk.dev/docs/interfaces/connectors.md): Push assure evidence to your GRC tool, run privacy requests from Transcend or OneTrust, send SBOM and VEX to your vulnerability tool, and open one ticket per failure.
- [Network permissions](https://mainsdk.dev/docs/interfaces/network.md): Declare the hosts your app may call; every other outbound call is blocked and reported, in CI and in production.
- [Local files](https://mainsdk.dev/docs/interfaces/disk.md): Read and write the folders your server app declares, and nothing else. Every use is checked, recorded with its file and line, and shown in mainsdk info.
- [Server facts and programs](https://mainsdk.dev/docs/interfaces/system.md): Read facts about the server and run only the programs you declare. Every URL a program is given is checked against the network list, and each use is recorded.
- [TCP, UDP and unix sockets](https://mainsdk.dev/docs/interfaces/net.md): Open TCP connections, run TCP servers, send UDP datagrams and use unix domain sockets, each checked against the protocols, ports and directions main.yaml declares.
- [Worker threads and cluster](https://mainsdk.dev/docs/interfaces/workers.md): Run CPU-heavy work on a pool of worker threads or processes, and run one server instance per core, declared in main.yaml and carrying the tenant.
- [Languages and formats](https://mainsdk.dev/docs/interfaces/i18n.md): Translate messages and format money, dates and numbers per locale, with right-to-left and Indian scripts and missing strings caught by the check.
- [Location](https://mainsdk.dev/docs/interfaces/geo.md): Get a coarse location hint from the declared platform's headers for sensible defaults, and geocode addresses through network, never for access decisions.
- [App updates and version blocking](https://mainsdk.dev/docs/interfaces/updates.md): Tell users an update is ready, refuse old versions on the server as well as in the app, tell open tabs about a new build, and roll releases out by percentage and market.
- [Neighbour apps](https://mainsdk.dev/docs/interfaces/neighbours.md): Let MainSDK apps on one machine hear each other's host-scope signals over user-only sockets, signed with a per-host key, so one app's attack warning raises the others' defences.
- [App registry and link](https://mainsdk.dev/docs/interfaces/apps.md): See every MainSDK app on a machine from one local folder, and let two apps that declare each other prove who they are and call each other's exposed actions.
- [Connected devices](https://mainsdk.dev/docs/interfaces/device.md): Optional plumbing for any fleet of devices or agents your app manages - enrolment, device identity and attestation, signed telemetry, policy sync, approved commands and health - with nothing loaded until you declare it.
- [Backups and restore drills](https://mainsdk.dev/docs/interfaces/backup.md): Declare how much data you can lose and how fast you must restore, check your provider can meet it, and prove it with timed restore drills.
- [Deploy config and serverless schedules](https://mainsdk.dev/docs/interfaces/deploy.md): Write the platform's own deploy files from main.yaml for Vercel, Cloudflare Workers, Fly.io and Docker, wake schedules through one tick route, check the build before it ships and diff two environments.
- [Health and status page](https://mainsdk.dev/docs/interfaces/status-page.md): Serve health probes, drain cleanly on shutdown, watch SLO burn and resource pressure, and register a check for each dependency.
- [Alerts](https://mainsdk.dev/docs/interfaces/alerts.md): Route SLO burn, downed dependencies, security detections and your own alerts to email, Slack, PagerDuty, Opsgenie or a webhook, once.
- [Signals](https://mainsdk.dev/docs/interfaces/signals.md): Say what the app noticed as one typed, signed, short-lived signal that the app, its other instances and its playbooks hear, with dedupe, a ring of recent signals and no personal data.
- [Playbooks](https://mainsdk.dev/docs/interfaces/playbooks.md): Declare what the app does when a signal arrives, with dry-run, approval, an audit trail and automatic rollback; every step only tightens and expires.
- [Logs, audit and telemetry](https://mainsdk.dev/docs/interfaces/log.md): Structured logs with redaction built in, a tamper-evident audit log, and errors with a stable code and a fix. Export to OpenTelemetry is planned.
- [Observe the SDK](https://mainsdk.dev/docs/interfaces/observe.md): Subscribe to every decision and side effect the SDK makes, on node:diagnostics_channel, with redacted frozen payloads, a bounded queue per observer and no cost when nobody listens.
- [Product analytics](https://mainsdk.dev/docs/interfaces/analytics.md): Track product events and page views with pseudonymised user IDs, and nothing sent before consent where it is required.
- [Behaviour norms](https://mainsdk.dev/docs/interfaces/norms.md): Learn what normal looks like for the app (traffic, errors, latency, CPU, loop delay, memory) by hour of week, deterministically and with no model, and emit an anomaly signal when it leaves the range.
- [Runtime settings](https://mainsdk.dev/docs/interfaces/config.md): Read typed runtime settings from memory, from JSON files or from Redis, and change them without a deploy. A push can only tighten what main.yaml allows.
- [Schema and parsers](https://mainsdk.dev/docs/interfaces/schema.md): Describe app data once with s, get a strict check, a TypeScript type and a JSON Schema, and turn raw text into checked values with parsers that need no model.
- [Feature flags](https://mainsdk.dev/docs/interfaces/flags.md): Turn a feature on for some users, a market or a share of users, and change it while the app runs. Every instance gives the same answer for the same user.
- [Typed API and OpenAPI](https://mainsdk.dev/docs/interfaces/api.md): Turn the app's actions into REST routes, an OpenAPI 3.1 document and a typed client, with idempotent writes and a breaking-change check.
- [Testing kit](https://mainsdk.dev/docs/interfaces/testing.md): Test against in-memory fakes of every interface, assert what your code sent, control time and inject provider outages, with no provider account.
- [Framework adapters](https://mainsdk.dev/docs/interfaces/adapters.md): Wire MainSDK into Next.js, Hono or Express with one import, so every request gets a trace, a context, ordered hooks, problem-detail errors and the sign-in routes.
- [Upgrades](https://mainsdk.dev/docs/interfaces/upgrade.md): Move every MainSDK package to a new release together with one command that applies the release's codemods and main.yaml moves, runs sync, check and your tests, and opens a pull request; and find out when a security release is not installed.
- [Adopt an existing app](https://mainsdk.dev/docs/interfaces/adopt.md): Bring a Next.js or Node app, including one from Lovable, Bolt or v0, onto MainSDK one module and one pull request at a time, with its behaviour locked first.

## Integrations

- [Every integration](https://mainsdk.dev/docs/integrations/index.md): every provider and its drivers
- [Every driver](https://mainsdk.dev/docs/drivers/index.md): every driver and the interfaces it serves
- [Built-in and local drivers](https://mainsdk.dev/docs/integrations/built-in.md): The drivers that ship inside MainSDK - local drivers for offline development, built-in production drivers, action surfaces and testing fakes.
- [Airtable](https://mainsdk.dev/docs/integrations/airtable.md): Airtable as a MainSDK driver for connections, imports. Pick it in main.yaml; your calls stay the same.
- [Any OAuth provider](https://mainsdk.dev/docs/integrations/partner.md): Any OAuth provider as a MainSDK driver for connections. Pick it in main.yaml; your calls stay the same.
- [Atlassian](https://mainsdk.dev/docs/integrations/atlassian.md): Atlassian as a MainSDK driver for connections. Pick it in main.yaml; your calls stay the same.
- [Auth0](https://mainsdk.dev/docs/integrations/auth0.md): Use Auth0 for MainSDK auth - tenant and application setup, callback URLs, main.yaml, client secrets, local testing and swapping.
- [AWS Verified Permissions](https://mainsdk.dev/docs/integrations/aws-verified-permissions.md): Use AWS Verified Permissions for MainSDK access - Cedar policy stores, IAM setup, main.yaml, local testing with built-in Cedar, and swapping.
- [Better Auth](https://mainsdk.dev/docs/integrations/better-auth.md): Use Better Auth, an open-source library in your app, for MainSDK auth - database, secret, main.yaml, local testing and swapping.
- [Bird](https://mainsdk.dev/docs/integrations/bird.md): Use Bird for MainSDK WhatsApp notifications, WhatsApp sign-in codes and phone checks, with no SMS or email driver yet - main.yaml, secrets and swapping.
- [Cerbos](https://mainsdk.dev/docs/integrations/cerbos.md): Use Cerbos policies for MainSDK access with role and attribute rules - setup, main.yaml, testing, limits and swapping.
- [Clerk](https://mainsdk.dev/docs/integrations/clerk.md): Use Clerk for MainSDK auth - application setup, development and production instances, main.yaml, secret keys, local testing and swapping.
- [DigiLocker](https://mainsdk.dev/docs/integrations/digilocker.md): Use DigiLocker for MainSDK identity checks in India - partner access, main.yaml for the India market, claims-only results, testing and swapping.
- [GitHub](https://mainsdk.dev/docs/integrations/github.md): Use GitHub sign-in for MainSDK auth - OAuth app setup, callback URLs, main.yaml, client secrets, local testing and swapping to another provider.
- [Google (Gmail](https://mainsdk.dev/docs/integrations/google.md): Google (Gmail as a MainSDK driver for connections. Pick it in main.yaml; your calls stay the same.
- [Microsoft 365](https://mainsdk.dev/docs/integrations/microsoft.md): Microsoft 365 as a MainSDK driver for connections. Pick it in main.yaml; your calls stay the same.
- [Notion](https://mainsdk.dev/docs/integrations/notion.md): Notion as a MainSDK driver for connections. Pick it in main.yaml; your calls stay the same.
- [Onfido](https://mainsdk.dev/docs/integrations/onfido.md): Use Onfido for MainSDK document and biometric identity checks - API token, main.yaml per market, testing and swapping.
- [Open Policy Agent](https://mainsdk.dev/docs/integrations/open-policy-agent.md): Use Open Policy Agent for MainSDK access and policy, with Rego bundles evaluated in process - main.yaml, testing, limits and swapping.
- [OpenFGA](https://mainsdk.dev/docs/integrations/openfga.md): Use OpenFGA for relationship-based MainSDK access on your existing store and model - main.yaml, adopt, testing and swapping.
- [Oso](https://mainsdk.dev/docs/integrations/oso.md): Use Oso and its Polar policies for MainSDK access - setup, main.yaml, testing, limits and swapping.
- [Permit.io](https://mainsdk.dev/docs/integrations/permit-io.md): Use Permit.io for managed MainSDK access with roles, attributes and relations - setup, main.yaml, testing and swapping.
- [Persona](https://mainsdk.dev/docs/integrations/persona.md): Use Persona for MainSDK identity checks with configurable flows - API key, main.yaml per market, sandbox testing and swapping.
- [Slack](https://mainsdk.dev/docs/integrations/slack.md): Slack as a MainSDK driver for connections, notify. Pick it in main.yaml; your calls stay the same.
- [SpiceDB](https://mainsdk.dev/docs/integrations/spicedb.md): Use SpiceDB for relationship-based MainSDK access with ZedTokens on your existing schema - main.yaml, testing and swapping.
- [Supabase](https://mainsdk.dev/docs/integrations/supabase.md): Use Supabase for MainSDK auth, data, real-time updates and backups - project setup, main.yaml per interface, secrets, local testing and swapping.
- [Twilio](https://mainsdk.dev/docs/integrations/twilio.md): Use Twilio for MainSDK SMS notifications and phone checks with Twilio Verify - account setup, main.yaml, secrets, testing and swapping.
- [WorkOS](https://mainsdk.dev/docs/integrations/workos.md): Use WorkOS for enterprise-ready MainSDK auth - environment setup, redirect URIs, main.yaml, API keys, local testing and swapping.
- [Your database](https://mainsdk.dev/docs/integrations/db.md): Your database as a MainSDK driver for apikeys, calendar, feeds, memory, meter, entitlements and more. Pick it in main.yaml; your calls stay the same.
- [Algolia](https://mainsdk.dev/docs/integrations/algolia.md): Use Algolia for MainSDK search - application and API keys, main.yaml, indexing, results scoped to the searcher, testing and swapping.
- [CalDAV](https://mainsdk.dev/docs/integrations/caldav.md): CalDAV as a MainSDK driver for calendar. Pick it in main.yaml; your calls stay the same.
- [Cloudflare KV](https://mainsdk.dev/docs/integrations/cloudflare-kv.md): Use Cloudflare KV for the MainSDK cache and runtime settings - namespaces, main.yaml, credentials, eventual consistency, testing and swapping.
- [ElectricSQL](https://mainsdk.dev/docs/integrations/electric.md): ElectricSQL as a MainSDK driver for sync. Pick it in main.yaml; your calls stay the same.
- [Google Sheets](https://mainsdk.dev/docs/integrations/googlesheets.md): Google Sheets as a MainSDK driver for imports. Pick it in main.yaml; your calls stay the same.
- [Meilisearch](https://mainsdk.dev/docs/integrations/meilisearch.md): Use Meilisearch for MainSDK search - self-hosted or cloud, API keys, main.yaml, indexing, results scoped to the searcher, testing and swapping.
- [Neon](https://mainsdk.dev/docs/integrations/neon.md): Use Neon for MainSDK data and backups - serverless Postgres per region, main.yaml, point-in-time restore, restore drills on branches and swapping.
- [Postgres](https://mainsdk.dev/docs/integrations/postgres.md): Use Postgres for MainSDK data and vector search - a connection string per region, main.yaml, field labels, pgvector, local testing and swapping.
- [PostgreSQL](https://mainsdk.dev/docs/integrations/postgresql.md): PostgreSQL as a MainSDK driver for search, config. Pick it in main.yaml; your calls stay the same.
- [PowerSync](https://mainsdk.dev/docs/integrations/powersync.md): PowerSync as a MainSDK driver for sync. Pick it in main.yaml; your calls stay the same.
- [Redis](https://mainsdk.dev/docs/integrations/redis.md): Use Redis for the MainSDK key-value store and cache - setup, main.yaml, connection secret, TTLs, tag invalidation, local testing and swapping.
- [REST API with a cursor](https://mainsdk.dev/docs/integrations/rest.md): REST API with a cursor as a MainSDK driver for imports. Pick it in main.yaml; your calls stay the same.
- [SQLite](https://mainsdk.dev/docs/integrations/sqlite.md): Use SQLite as the MainSDK local data driver - offline development with no database server, main.yaml overlays, testing, and why production refuses it.
- [The kv store with an in-process tier](https://mainsdk.dev/docs/integrations/kv.md): The kv store with an in-process tier as a MainSDK driver for cache. Pick it in main.yaml; your calls stay the same.
- [Typesense](https://mainsdk.dev/docs/integrations/typesense.md): Use Typesense for MainSDK search - self-hosted or cloud, API key, main.yaml, results scoped to the searcher, testing and swapping.
- [Upstash](https://mainsdk.dev/docs/integrations/upstash.md): Use Upstash Redis for the MainSDK key-value store, cache and rate limits - setup, main.yaml, secrets, local testing and swapping.
- [Vercel](https://mainsdk.dev/docs/integrations/vercel.md): Use Vercel for MainSDK cache, background jobs, runtime settings and feature flags - Runtime Cache, Queues, Global Config, Flags, main.yaml and swapping.
- [AI gateway](https://mainsdk.dev/docs/integrations/ai-gateway.md): Use an AI gateway for MainSDK AI calls - one endpoint routing to many model providers, main.yaml, keys, testing and swapping.
- [Amazon Bedrock](https://mainsdk.dev/docs/integrations/amazon-bedrock.md): Use Amazon Bedrock for MainSDK AI calls - model access, an IAM role, OIDC from Vercel or CI instead of access keys, main.yaml, testing and swapping.
- [Anthropic](https://mainsdk.dev/docs/integrations/anthropic.md): Use the Anthropic API for MainSDK AI calls - API keys, main.yaml, the model allowlist, data-use rules, local testing and swapping.
- [Letta](https://mainsdk.dev/docs/integrations/letta.md): Letta as a MainSDK driver for memory. Pick it in main.yaml; your calls stay the same.
- [llama.cpp server](https://mainsdk.dev/docs/integrations/llama-cpp.md): llama.cpp server as a MainSDK driver for ai. Pick it in main.yaml; your calls stay the same.
- [MCP memory server](https://mainsdk.dev/docs/integrations/mcp.md): MCP memory server as a MainSDK driver for memory. Pick it in main.yaml; your calls stay the same.
- [Mem0](https://mainsdk.dev/docs/integrations/mem0.md): Mem0 as a MainSDK driver for memory. Pick it in main.yaml; your calls stay the same.
- [Modal](https://mainsdk.dev/docs/integrations/modal.md): Modal as a MainSDK driver for compute. Pick it in main.yaml; your calls stay the same.
- [Ollama](https://mainsdk.dev/docs/integrations/ollama.md): Ollama as a MainSDK driver for ai. Pick it in main.yaml; your calls stay the same.
- [OpenAI](https://mainsdk.dev/docs/integrations/openai.md): Use the OpenAI API for MainSDK AI calls and embeddings - API keys, main.yaml, the model allowlist, data-use rules, local testing and swapping.
- [OpenAI-compatible server](https://mainsdk.dev/docs/integrations/openai-compatible.md): OpenAI-compatible server as a MainSDK driver for ai. Pick it in main.yaml; your calls stay the same.
- [Pinecone](https://mainsdk.dev/docs/integrations/pinecone.md): Pinecone as a MainSDK driver for memory. Pick it in main.yaml; your calls stay the same.
- [Replicate](https://mainsdk.dev/docs/integrations/replicate.md): Replicate as a MainSDK driver for compute. Pick it in main.yaml; your calls stay the same.
- [RunPod](https://mainsdk.dev/docs/integrations/runpod.md): RunPod as a MainSDK driver for compute. Pick it in main.yaml; your calls stay the same.
- [Zep](https://mainsdk.dev/docs/integrations/zep.md): Zep as a MainSDK driver for memory. Pick it in main.yaml; your calls stay the same.
- [Ably](https://mainsdk.dev/docs/integrations/ably.md): Use Ably for MainSDK real-time updates - API key, main.yaml, channel access, local testing and swapping.
- [Amazon SES](https://mainsdk.dev/docs/integrations/amazon-ses.md): Use Amazon SES for MainSDK email and the notify email channel - verified identities, sandbox and production access, region, main.yaml and swapping.
- [Amazon SES inbound](https://mainsdk.dev/docs/integrations/amazonsimpleemailservice.md): Amazon SES inbound as a MainSDK driver for mail. Pick it in main.yaml; your calls stay the same.
- [Apple Push Notification service](https://mainsdk.dev/docs/integrations/apns.md): Use Apple Push Notification service (APNs) for MainSDK push on iOS - signing key, bundle ID, environments, main.yaml, testing and swapping.
- [Cloudflare](https://mainsdk.dev/docs/integrations/cloudflare.md): Cloudflare as a MainSDK driver for mail, deploy, adapters. Pick it in main.yaml; your calls stay the same.
- [Expo](https://mainsdk.dev/docs/integrations/expo.md): Use Expo for MainSDK push notifications and over-the-air app updates - EAS project, push credentials, main.yaml, testing and swapping.
- [Firebase Cloud Messaging](https://mainsdk.dev/docs/integrations/firebase-cloud-messaging.md): Use Firebase Cloud Messaging for MainSDK push notifications on Android and iOS - Firebase project, credentials, main.yaml, testing and swapping.
- [IMAP](https://mainsdk.dev/docs/integrations/imap.md): IMAP as a MainSDK driver for mail. Pick it in main.yaml; your calls stay the same.
- [Instance broadcast](https://mainsdk.dev/docs/integrations/broadcast.md): Instance broadcast as a MainSDK driver for realtime. Pick it in main.yaml; your calls stay the same.
- [Intercom](https://mainsdk.dev/docs/integrations/intercom.md): Use Intercom for MainSDK feedback and support - access token, main.yaml, opening reports and tickets, local testing and swapping.
- [JMAP](https://mainsdk.dev/docs/integrations/jmap.md): JMAP as a MainSDK driver for mail. Pick it in main.yaml; your calls stay the same.
- [Mailgun routes](https://mainsdk.dev/docs/integrations/mailgun.md): Mailgun routes as a MainSDK driver for mail. Pick it in main.yaml; your calls stay the same.
- [MSG91](https://mainsdk.dev/docs/integrations/msg91.md): Use MSG91 for MainSDK SMS and WhatsApp notifications and WhatsApp sign-in codes in India - DLT templates, main.yaml, secrets and swapping.
- [OneSignal](https://mainsdk.dev/docs/integrations/onesignal.md): OneSignal as a planned MainSDK notify driver for push - what to set up, main.yaml, testing and swapping.
- [Opsgenie](https://mainsdk.dev/docs/integrations/opsgenie.md): Opsgenie as a MainSDK driver for notify. Pick it in main.yaml; your calls stay the same.
- [PagerDuty](https://mainsdk.dev/docs/integrations/pagerduty.md): PagerDuty as a MainSDK driver for notify. Pick it in main.yaml; your calls stay the same.
- [Plain](https://mainsdk.dev/docs/integrations/plain.md): Use Plain for MainSDK feedback and support - API key, main.yaml, opening reports and tickets, local testing and swapping.
- [Postmark](https://mainsdk.dev/docs/integrations/postmark.md): Postmark as a planned MainSDK email driver - sender domain, server token, main.yaml, testing and swapping.
- [Pusher](https://mainsdk.dev/docs/integrations/pusher.md): Use Pusher Channels for MainSDK real-time updates - app keys and cluster, main.yaml, private channels, local testing and swapping.
- [Resend](https://mainsdk.dev/docs/integrations/resend.md): Use Resend for MainSDK email and the notify email channel - domain verification, API keys, main.yaml, local testing and swapping.
- [Signed webhook](https://mainsdk.dev/docs/integrations/webhook.md): Signed webhook as a MainSDK driver for notify. Pick it in main.yaml; your calls stay the same.
- [SMTP](https://mainsdk.dev/docs/integrations/smtp.md): Generic SMTP as a planned MainSDK email driver for any mail server - credentials, TLS, main.yaml, testing and swapping.
- [WhatsApp](https://mainsdk.dev/docs/integrations/whatsapp.md): Use the WhatsApp Cloud API for MainSDK notifications and WhatsApp sign-in - Meta business setup, templates, tokens, webhooks, main.yaml and swapping.
- [Zendesk](https://mainsdk.dev/docs/integrations/zendesk.md): Use Zendesk for MainSDK feedback and support tickets - API credentials, main.yaml, opening reports and tickets, local testing and swapping.
- [Amazon SQS](https://mainsdk.dev/docs/integrations/amazon-sqs.md): Use Amazon SQS for MainSDK background jobs - queues and dead-letter queues, IAM, main.yaml, the Node worker, testing and swapping.
- [Inngest](https://mainsdk.dev/docs/integrations/inngest.md): Use Inngest for MainSDK events and background jobs - the default driver, main.yaml, retries, schedules, local dev server, testing and swapping.
- [Svix](https://mainsdk.dev/docs/integrations/svix.md): Use Svix for MainSDK outbound webhooks - Standard Webhooks delivery, main.yaml, retries, local testing and swapping from the built-in driver.
- [Temporal](https://mainsdk.dev/docs/integrations/temporal.md): Temporal as a MainSDK driver for workflows. Pick it in main.yaml; your calls stay the same.
- [Trigger.dev](https://mainsdk.dev/docs/integrations/trigger-dev.md): Use Trigger.dev for MainSDK background jobs - a planned driver with setup, main.yaml, retries, local testing and swapping.
- [A model through ai](https://mainsdk.dev/docs/integrations/ai.md): A model through ai as a MainSDK driver for documents. Pick it in main.yaml; your calls stay the same.
- [Amazon S3](https://mainsdk.dev/docs/integrations/amazon-s3.md): Amazon S3 and S3-compatible stores (R2, MinIO, B2) as the planned MainSDK files driver, with bucket setup, direct browser uploads and an example.
- [Amazon Web Services](https://mainsdk.dev/docs/integrations/amazonwebservices.md): Amazon Web Services as a MainSDK driver for documents. Pick it in main.yaml; your calls stay the same.
- [Azure AI Document Intelligence](https://mainsdk.dev/docs/integrations/azure-document.md): Azure AI Document Intelligence as a MainSDK driver for documents. Pick it in main.yaml; your calls stay the same.
- [Cloudinary](https://mainsdk.dev/docs/integrations/cloudinary.md): Cloudinary as a planned MainSDK media driver - image and video transforms, setup, main.yaml, works on files from any files driver, and swapping.
- [DocRaptor](https://mainsdk.dev/docs/integrations/docraptor.md): Use DocRaptor for MainSDK PDF rendering - hosted HTML to PDF, setup, main.yaml, test documents and swapping from the built-in renderer.
- [Documenso](https://mainsdk.dev/docs/integrations/documenso.md): Use Documenso for MainSDK document signing - open-source e-signatures, self-hosted or cloud, main.yaml, testing and swapping.
- [ffmpeg (development](https://mainsdk.dev/docs/integrations/ffmpeg.md): ffmpeg (development as a MainSDK driver for media. Pick it in main.yaml; your calls stay the same.
- [getqr.id](https://mainsdk.dev/docs/integrations/getqr-id.md): Use getqr.id as the default MainSDK files driver and for share links, QR codes, app links and media, with the API key, main.yaml, @getqr/react and tests.
- [Google Cloud](https://mainsdk.dev/docs/integrations/googlecloud.md): Google Cloud as a MainSDK driver for documents. Pick it in main.yaml; your calls stay the same.
- [Gotenberg](https://mainsdk.dev/docs/integrations/gotenberg.md): Gotenberg as a MainSDK driver for pdf. Pick it in main.yaml; your calls stay the same.
- [Mux](https://mainsdk.dev/docs/integrations/mux.md): Mux as a planned MainSDK media driver for video transcoding and streaming - setup, main.yaml, works on files from any files driver, and swapping.
- [Unstructured](https://mainsdk.dev/docs/integrations/unstructured.md): Unstructured as a MainSDK driver for documents. Pick it in main.yaml; your calls stay the same.
- [Uploadthing](https://mainsdk.dev/docs/integrations/uploadthing.md): Uploadthing as a MainSDK files driver, with setup, main.yaml, a direct browser upload example and the guarantees MainSDK keeps on top.
- [Vercel Blob](https://mainsdk.dev/docs/integrations/vercel-blob.md): Vercel Blob as the planned MainSDK files driver for apps on Vercel, with setup, main.yaml, a direct upload example and how privacy is kept.
- [Lago](https://mainsdk.dev/docs/integrations/lago.md): Use Lago for MainSDK usage metering - open-source usage billing, self-hosted or cloud, main.yaml, testing and swapping.
- [Offline](https://mainsdk.dev/docs/integrations/offline.md): Offline as a MainSDK driver for licence. Pick it in main.yaml; your calls stay the same.
- [Paddle](https://mainsdk.dev/docs/integrations/paddle.md): Use Paddle as a planned MainSDK payments driver - merchant of record checkout, sandbox and live keys, webhook secrets and swapping.
- [Razorpay](https://mainsdk.dev/docs/integrations/razorpay.md): Use Razorpay for MainSDK payments in India - UPI and cards, test and live keys, webhook secrets, market routing, local testing and swapping.
- [Stripe](https://mainsdk.dev/docs/integrations/stripe.md): Use Stripe for MainSDK payments and usage metering - test and live keys, main.yaml, webhook signing secrets, local testing and swapping.
- [Archer](https://mainsdk.dev/docs/integrations/archer.md): Archer as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [Arcjet](https://mainsdk.dev/docs/integrations/arcjet.md): Use Arcjet for MainSDK rate limits and bot protection - setup, main.yaml, limits.rate, local testing and swapping.
- [AWS KMS](https://mainsdk.dev/docs/integrations/aws-kms.md): Use AWS KMS for MainSDK encryption keys - one wrapping key per region, IAM permissions, rotation, main.yaml, local testing and swapping.
- [AWS Secrets Manager](https://mainsdk.dev/docs/integrations/aws-secrets-manager.md): Use AWS Secrets Manager for MainSDK secrets - IAM role setup, main.yaml, secret references, rotation, local testing and swapping.
- [Azure Key Vault](https://mainsdk.dev/docs/integrations/azure-key-vault.md): Use Azure Key Vault for MainSDK secrets and encryption keys - managed identity, main.yaml for both driver ids, testing and swapping.
- [Cloudflare Turnstile](https://mainsdk.dev/docs/integrations/turnstile.md): Cloudflare Turnstile as a MainSDK driver for bots. Pick it in main.yaml; your calls stay the same.
- [DefectDojo](https://mainsdk.dev/docs/integrations/defectdojo.md): DefectDojo as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [Dependency-Track](https://mainsdk.dev/docs/integrations/dependency-track.md): Dependency-Track as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [Doppler](https://mainsdk.dev/docs/integrations/doppler.md): Use Doppler for MainSDK secrets - project and config setup, main.yaml, secret references, local testing and swapping.
- [E2B](https://mainsdk.dev/docs/integrations/e2b.md): E2B as a MainSDK driver for sandbox. Pick it in main.yaml; your calls stay the same.
- [Google Cloud KMS](https://mainsdk.dev/docs/integrations/google-cloud-kms.md): Use Google Cloud KMS for MainSDK encryption keys - key rings per region, IAM roles, rotation, main.yaml, local testing and swapping.
- [Google Secret Manager](https://mainsdk.dev/docs/integrations/google-secret-manager.md): Use Google Secret Manager for MainSDK secrets - service account setup, main.yaml, secret references, rotation, local testing and swapping.
- [HashiCorp Vault](https://mainsdk.dev/docs/integrations/hashicorp-vault.md): Use HashiCorp Vault for MainSDK secrets, encryption keys and crypto - KV and Transit setup, auth methods, policies, main.yaml, testing and swapping.
- [hCaptcha](https://mainsdk.dev/docs/integrations/hcaptcha.md): hCaptcha as a MainSDK driver for bots. Pick it in main.yaml; your calls stay the same.
- [Infisical](https://mainsdk.dev/docs/integrations/infisical.md): Use Infisical for MainSDK secrets - machine identity setup, main.yaml, secret references, local testing and swapping.
- [Jira](https://mainsdk.dev/docs/integrations/jira.md): Jira as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [libsodium](https://mainsdk.dev/docs/integrations/libsodium.md): Use libsodium for MainSDK crypto - an in-process library planned as a driver for signing, sealing and tokens, with no account.
- [MLS](https://mainsdk.dev/docs/integrations/mls.md): MLS as a MainSDK driver for e2e. Pick it in main.yaml; your calls stay the same.
- [npm registry and private registries from .npmrc](https://mainsdk.dev/docs/integrations/npm.md): npm registry and private registries from .npmrc as a MainSDK driver for deps, upgrade. Pick it in main.yaml; your calls stay the same.
- [OneTrust GRC](https://mainsdk.dev/docs/integrations/onetrust-grc.md): OneTrust GRC as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [OneTrust privacy requests](https://mainsdk.dev/docs/integrations/onetrust-privacy.md): OneTrust privacy requests as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [OSV.dev advisories](https://mainsdk.dev/docs/integrations/osv.md): OSV.dev advisories as a MainSDK driver for deps. Pick it in main.yaml; your calls stay the same.
- [PDQ hash matching](https://mainsdk.dev/docs/integrations/pdq.md): PDQ hash matching as a MainSDK driver for moderate. Pick it in main.yaml; your calls stay the same.
- [PhotoDNA](https://mainsdk.dev/docs/integrations/photodna.md): PhotoDNA as a MainSDK driver for moderate. Pick it in main.yaml; your calls stay the same.
- [Pre-screen through ai.classify](https://mainsdk.dev/docs/integrations/ai-classify.md): Pre-screen through ai.classify as a MainSDK driver for moderate. Pick it in main.yaml; your calls stay the same.
- [Proof-of-work](https://mainsdk.dev/docs/integrations/pow.md): Proof-of-work as a MainSDK driver for bots. Pick it in main.yaml; your calls stay the same.
- [ServiceNow IRM](https://mainsdk.dev/docs/integrations/servicenow.md): ServiceNow IRM as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [Snyk](https://mainsdk.dev/docs/integrations/snyk.md): Snyk as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [TAPS Node and SoveDocs](https://mainsdk.dev/docs/integrations/taps.md): Use a self-hosted or hosted TAPS Node, or SoveDocs, for protected files with main.yaml, a local install, revoke, activity and sharing.
- [Transcend](https://mainsdk.dev/docs/integrations/transcend.md): Transcend as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [Wiz](https://mainsdk.dev/docs/integrations/wiz.md): Wiz as a MainSDK driver for connectors. Pick it in main.yaml; your calls stay the same.
- [App Store](https://mainsdk.dev/docs/integrations/app-store.md): Use the App Store for MainSDK app updates on iOS - update prompts, minimum versions enforced on the server, main.yaml, testing and swapping.
- [Crowdin](https://mainsdk.dev/docs/integrations/crowdin.md): Use Crowdin for MainSDK translations - project setup, main.yaml, locales, missing strings caught by the check, local testing and swapping.
- [Google Analytics](https://mainsdk.dev/docs/integrations/google-analytics.md): Use Google Analytics for MainSDK product analytics - GA4 property, measurement ID, main.yaml, consent before sending, local testing and swapping.
- [Google Maps Platform](https://mainsdk.dev/docs/integrations/google-maps.md): Use Google Maps Platform for MainSDK geocoding - API key, main.yaml, geo.geocode(), location as a hint never for access, testing and swapping.
- [Google Play](https://mainsdk.dev/docs/integrations/google-play.md): Use Google Play for MainSDK app updates on Android - Play In-App Updates, minimum versions enforced on the server, main.yaml, testing and swapping.
- [Lokalise](https://mainsdk.dev/docs/integrations/lokalise.md): Use Lokalise for MainSDK translations - project and API token, main.yaml, locales, missing strings caught by the check, testing and swapping.
- [Mapbox](https://mainsdk.dev/docs/integrations/mapbox.md): Use Mapbox for MainSDK geocoding - access token, main.yaml, geo.geocode(), location as a hint never for access, testing and swapping.
- [Segment](https://mainsdk.dev/docs/integrations/segment.md): Use Segment for MainSDK product analytics - write key, main.yaml, consent before sending, local testing and swapping.
- [Tauri](https://mainsdk.dev/docs/integrations/tauri.md): Use the Tauri updater for MainSDK desktop app updates - signed updates, update manifests, minimum versions on the server, main.yaml and testing.
- [Tolgee](https://mainsdk.dev/docs/integrations/tolgee.md): Use Tolgee for MainSDK translations - project and API key, main.yaml, locales, missing strings caught by the check, testing and swapping.
- [AWS Backup](https://mainsdk.dev/docs/integrations/aws-backup.md): Use AWS Backup for MainSDK backups and restore drills - backup plans and vaults, main.yaml RPO and RTO, checks, drills into scratch and swapping.
- [Docker](https://mainsdk.dev/docs/integrations/docker.md): Docker as a MainSDK driver for deploy. Pick it in main.yaml; your calls stay the same.
- [Fly.io](https://mainsdk.dev/docs/integrations/fly.md): Fly.io as a MainSDK driver for deploy. Pick it in main.yaml; your calls stay the same.
- [pgBackRest](https://mainsdk.dev/docs/integrations/pgbackrest.md): Use pgBackRest for MainSDK backups of self-hosted Postgres - WAL archiving, point-in-time restore, RPO and RTO checks and restore drills. Planned.
- [OpenTelemetry](https://mainsdk.dev/docs/integrations/opentelemetry.md): Use any OpenTelemetry backend for MainSDK logs and traces - OTLP endpoint, auth header as a secret, sampling, local testing and swapping.
- [Plausible](https://mainsdk.dev/docs/integrations/plausible.md): Use Plausible for MainSDK product analytics - site setup, main.yaml, page views and custom events, consent, local testing and swapping.
- [PostHog](https://mainsdk.dev/docs/integrations/posthog.md): Use PostHog for MainSDK product analytics and feature flags - US or EU cloud, project API key, main.yaml, consent, local testing and swapping.
- [Sentry](https://mainsdk.dev/docs/integrations/sentry.md): Sentry as a MainSDK driver for log. Pick it in main.yaml; your calls stay the same.
- [AWS AppConfig](https://mainsdk.dev/docs/integrations/aws-appconfig.md): Use AWS AppConfig for MainSDK runtime settings - IAM access, main.yaml, typed config.get and watch, last good values, testing and swapping.
- [Config store](https://mainsdk.dev/docs/integrations/config.md): Config store as a MainSDK driver for flags. Pick it in main.yaml; your calls stay the same.
- [Express](https://mainsdk.dev/docs/integrations/express.md): Express as a MainSDK driver for adapters. Pick it in main.yaml; your calls stay the same.
- [Git and the gh CLI](https://mainsdk.dev/docs/integrations/git.md): Git and the gh CLI as a MainSDK driver for upgrade. Pick it in main.yaml; your calls stay the same.
- [Hono](https://mainsdk.dev/docs/integrations/hono.md): Hono as a MainSDK driver for adapters. Pick it in main.yaml; your calls stay the same.
- [Next.js App Router](https://mainsdk.dev/docs/integrations/nextdotjs.md): Next.js App Router as a MainSDK driver for adapters. Pick it in main.yaml; your calls stay the same.
- [OpenFeature](https://mainsdk.dev/docs/integrations/openfeature.md): Use any OpenFeature provider for MainSDK feature flags - main.yaml, flags.enabled and flags.value, testing and swapping flag tools.

## Architecture

- [How MainSDK works](https://mainsdk.dev/docs/architecture/how-it-works.md): The four layers under every MainSDK call, and what the SDK in your app, the CLI and MainSDK Cloud each run and where.
- [Request lifecycle](https://mainsdk.dev/docs/architecture/request-lifecycle.md): What happens inside your app on one MainSDK call, why we are never in the request path, and how the app fails static.
- [Core and language SDKs](https://mainsdk.dev/docs/architecture/core-and-bindings.md): The core is pure TypeScript with zero runtime dependencies; Rust, Python and Go get their own native SDKs that share contracts and data, never code.
- [Contracts and versioning](https://mainsdk.dev/docs/architecture/contracts-and-versioning.md): Every MainSDK boundary is a versioned contract written once in TypeSpec and checked by machine on every change.
- [Policy engine](https://mainsdk.dev/docs/architecture/policy-engine.md): One in-process decision point for every MainSDK interface, with Cedar by default, policies as code, layers that only tighten and staged rollout.
- [Drivers and conformance](https://mainsdk.dev/docs/architecture/drivers-and-conformance.md): How drivers declare what they touch, how one conformance suite proves each driver, and how you build or swap one.
- [The check pipeline](https://mainsdk.dev/docs/architecture/the-check-pipeline.md): What mainsdk check runs on every change, the five layers of code safety, and how a change earns the Main mark.
- [Telemetry and signals](https://mainsdk.dev/docs/architecture/telemetry-and-signals.md): How MainSDK logs, traces and audits on open standards, what is redacted, and what leaves your app and when.
- [Cloud and regions](https://mainsdk.dev/docs/architecture/cloud-and-regions.md): What MainSDK Cloud stores, in which of three regions, how a project joins it, and why a Cloud limit never breaks your app.
- [Supply chain](https://mainsdk.dev/docs/architecture/supply-chain.md): How we build, sign and deliver MainSDK itself, from reproducible SLSA level 3 builds to packs delivered through The Update Framework.
- [Performance budgets](https://mainsdk.dev/docs/architecture/performance-budgets.md): The four limits MainSDK must stay within, how we measure them, and why a regression fails the release.
- [Security architecture](https://mainsdk.dev/docs/architecture/security-model.md): MainSDK's trust boundaries, the STRIDE threat model per interface and driver class, how CI keeps the models current, and the limits we close.

## Community

- [Security policy](https://mainsdk.dev/docs/community/security.md): How to report a vulnerability, the fix times we commit to and how CVEs are numbered.
- [Bug bounty](https://mainsdk.dev/docs/community/bounty.md): The MainSDK bug bounty: what is in scope, what we pay, and the safe harbour for good-faith research.
- [Roadmap](https://mainsdk.dev/docs/community/roadmap.md): Milestones 0.1 to 0.5 with their exit criteria, read from GitHub milestones.
- [RFCs](https://mainsdk.dev/docs/community/rfcs.md): How to propose a change to a contract, the Main mark or the telemetry contract, and the RFCs in flight.
- [Community drivers](https://mainsdk.dev/docs/community/drivers.md): Drivers written by the community, each with the date of its latest conformance run.
- [Contribute a driver](https://mainsdk.dev/docs/community/contributing-drivers.md): Write a driver with the testing kit, run conformance and add it to the community registry.
- [Get help](https://mainsdk.dev/docs/community/channels.md): GitHub Discussions and Discord: where to ask, who moderates and how fast you get a first answer.
- [Governance](https://mainsdk.dev/docs/community/governance.md): HubXero leads MainSDK through 1.0 with public RFCs and a public roadmap; the open contracts then move to a neutral foundation.
- [Charter](https://mainsdk.dev/docs/community/charter.md): The charter of the board that oversees the MainSDK open contracts: who sits on it, how it decides and how community SDKs earn the conformance label.
- [Free for open source](https://mainsdk.dev/docs/community/open-source.md): Open-source projects use MainSDK free forever. The rule is one paragraph and needs no application.
- [Pricing](https://mainsdk.dev/docs/community/pricing.md): What is free forever, what is paid and who qualifies for free use as an open-source project.

## Optional

- [Full docs in one file](https://mainsdk.dev/llms-full.txt): every page above, concatenated
- [Source on GitHub](https://github.com/hubxero/mainsdk): the SDK, the specs and these docs
- [MainSDK facts](https://mainsdk.dev/facts.yaml): definition, features, drivers by capability, status and answers to common questions, as YAML