Skip to content

Docs

Deploy an app

From code to an address that answers: import, detection, the check and the build, then the machine-readable result your coding agent reads back.

Agent tools

  • ingest
  • detect
  • setFramework
  • deploy
  • status
  • listDeployments
  • rollback

One delivery, end to end

The builder, the dashboard and your coding agent drive the same work: check the code, build it, and publish only a build that passed a health check.

  1. Import

    Code arrives from the Tofu builder's Put it online (Put it online), from your coding agent (ingest), from a chat that writes the files, or from a GitHub import. An update replaces the same app's code and keeps its settings.

  2. Detect

    Deterministic — no model call, no network — returning a preset (the list below) or unknown, for you to confirm.

  3. Check

    Deterministic rules over the exact files about to go online. A deploy stops only for harm to other people or to Tofu: a live secret key in the code, a form that sends passwords elsewhere, seed-phrase or wallet theft, and known malware shapes such as obfuscated or install-time code. Choices that risk only your own app, such as an open table or a webhook that does not check signatures, come back as warnings and never stop a deploy.

  4. Build and publish

    The snapshot goes to the provider. A READY build must then answer an anonymous HTTP request before the address moves, and a failure leaves the previous version serving.

What detection returns

Detection reads the app’s root — no model call, no network — and answers with one of these presets, or unknown for you to choose.

Web
Next.jsnextjsViteviteAstroastroSvelteKitsveltekitNuxtnuxtjsReact Routerreact-routerGatsbygatsbyStatic HTMLstatic
Python server
FastAPIfastapiFlaskflaskDjangodjangoPythonpython
Go server
Gogo
JavaScript server
ExpressexpressHonohonoNestJSnestjsNode.js servernode
Container
Dockerfile (container)container

static skips the build only for a genuinely prebuilt site: an upload that declares a build step is refused with the preset choices rather than published unbuilt. A JavaScript server preset builds one entrypoint file the provider finds by name (app, index or server at the app root or under src/; server alone for the plain Node.js server preset, and the src/main.ts bootstrap for NestJS), and a Python or Go preset builds from the app's own manifest. A container app ships its own container file at its root, which the provider builds into an image.

The result your agent reads

deploy waits, bounded (about twenty seconds), for a settled answer; status continues from there. The answer is machine-readable:

tofu · deployexample · excerpt
{
  "status": "ready",
  "managedUrl": "https://franks-kitchen-3f9a1c07b2e4.trytofu.app/",
  "serving": true,
  "publiclyReachable": true,
  "verification": {
    "access": "public",
    "httpStatus": 200
  }
}
publiclyReachable is true only when an anonymous request was served — the answer to “can a visitor open it now?”
Result fieldWhat it tells you
publiclyReachabletrue only when an anonymous request was served.
verification.accesspublic (served), protection (refused anonymously: access protection, not a failed build) or unreachable (an address that answers 404 or not at all is asked again for up to 16 seconds first).
servingWhether this deployment answers the app's address; ready with serving: false was not published.

The address to report is managedUrl; a row with no verdict carries a note, never a failed deployment. The result's own check is what confirms a build: opening that address in a browser too early can show the provider's own page instead of the app. Detection and the check are rules; the build and network are the provider's.

Automatic updates from GitHub

A project imported from a GitHub branch can follow it. With automatic updates on — switched on in the Source card of the dashboard's Versions page — a push to that branch is deployed through the same check and build as an upload.

  • One branch and one app root per project; branch imports only, with no tags or pull-request previews.
  • Tofu deploys the latest head of the branch it observes, not every commit.
  • A manual upload, a manual GitHub import, a version put online from the Tofu builder, or a changed preset pauses updates rather than being overwritten. Turning them on again starts from the next push.
  • Tofu stores no GitHub token: each run uses a short-lived token for that one repository with read access only, and checks your access to it again before downloading and before submitting.
  • Your agent reads where a project stands with githubStatus and can turn updates off with githubSyncDisable; importing and turning them on use your own GitHub session in the dashboard.

History, logs and rollback

History and logs. The dashboard, listDeployments, getBuildLogs and getRuntimeLogs read the hosting provider's own records for the app. Lines that look like credentials are masked — a conservative filter, so an app should still never print its secrets.

Rollback. rollback, the dashboard's Restore, moves the app's address back to an earlier deployment the provider still reports healthy. It builds nothing new, and a target that is no longer healthy is refused with the reason.

Repair. When a build fails, the version's build log says why, and repairContext hands your coding agent a read-only brief to fix it in your code. For an app you made in the Tofu builder, open it in the builder, ask it to fix the problem, and put it online again (If it does not go online).

Quotas

Quotas are enforced before the work. Free has 1 app online at a time, the pages you publish and the code behind them, with 20 uploads and 20 deployments a day; a Free website can be up to 50 MB and 500 files, and an app that runs on a server can be sent as a project up to 50 MB. Starter publishes up to 5 apps with 50 uploads and 50 deployments a day. The Pro plan publishes unlimited apps with 200 uploads and 200 deployments a day. The Tofu builder's cloud coding agent is 30 minutes a day on Free, 2 hours a day on Starter, and unlimited on the Pro plan with one active session at a time (Sessions and plans). No plan has a token limit, and the fair use rules in the Terms apply. On Free, each request to your app runs for up to 60 seconds; the paid plans allow longer requests.

hostingStatus reads the allowances actually enforced for your account, before a paid call is refused rather than after.

What a deploy does not do

  • Nothing resident. A background worker, a scheduler of the app's own or a non-HTTP service has no path here, and an app's own vercel.json crons entry does not register. The whole boundary, and the way forward, is in Limits.

  • No guessing a monorepo. Tofu does not pick a workspace subdirectory for you: upload the app’s own root.

  • No preview deployments. Automatic updates follow one branch; a pull request gets no deployment of its own.

  • Container runtime logs. A container app’s runtime logs have not been readable so far; the read says it is unavailable rather than showing an empty log.