Features

Everything between “it works” and “it’s live”.

Hosting, a database, your domain, sign-in and its email, analytics and payments — wired by one Tofu account, each one a tool your coding agent calls. What every part does, where its limits are, and what is not built yet.

Read the docsAgent setup
What one account wires

Wired in for you. Each one a tool your agent calls.

Every part has a page of its own: how it works, what your agent says to reach it, and where it stops.

  • Hosting & deploys

    Live, and reversible.

    Every deploy is checked before it builds, published only once it answers, and recorded, so an earlier healthy version is one Restore away.

    • deploy
    • rollback
    • getRuntimeLogs

  • Database

    A real database, already wired.

    Managed Postgres, created with the deploy and wired into the build with write-only secrets, and moved to your own Supabase organization on request.

    • databaseCreate
    • databaseStatus

  • Your domain

    Your domain, HTTPS included.

    On Cloudflare, approve once and Tofu writes the records; anywhere else, it shows you the exact records and checks them.

    • domainConnect
    • domainAuthorize
    • domainVerify

  • Sign-in & email

    Google sign-in, minus Google Cloud.

    “Continue with Google” and email sign-in for your app, with its sign-up mail sent from your own domain once it verifies. No Google Cloud project, no OAuth client, no keys.

    • appAuthConfigure
    • appAuthEmailConnect

  • Analytics

    Traffic, without a tracker.

    Views, top pages and top sources for each app, counted on Tofu’s own endpoint. No cookies, no stored IP addresses, no analytics account to open.

    • siteAnalytics
    • setSiteAutoInject

  • Agent & CLI

    Go live without leaving your agent.

    One local client for any coding agent that speaks MCP: the same apps and history as the dashboard, after one approval in your browser.

    • login
    • ingest
    • status

  • Payments

    Payments, straight to you.

    Buyers pay on Stripe’s own checkout page, into your own Stripe account. Tofu creates your payment links, one-time or repeating, and tells your app who paid. No keys to copy, and Tofu takes no fee.

    • appPaymentsConnect
    • appPaymentsSetup
    • appPaymentsLinkCreate

The Free plan puts one app online with the code behind its pages and one managed database, kept while the app is online, and pricing shows which plans include your own domain. Domain purchases are separate. See pricing

Connecting your Stripe account to an app that runs on a server comes with a paid plan, and real payments open once your plan’s first payment goes through. How payments work

Three ways in

Bring the app you have. However it reaches Tofu.

Every path lands in the same kind of app, goes through the same check before it builds, and goes live the same way. An update replaces the same app’s source while its settings, address and history stay.

  1. Your coding agent

    Recommended. Paste the setup message into any coding agent. The agent checks and installs Tofu’s client, you approve one code in your browser, and it uploads, checks and deploys from the conversation — when you ask it to. Agent & CLI

    ❯ setup message pasted · code approved

  2. A GitHub branch

    Import one branch with a read-only grant, pinned to a commit. Turn on automatic updates, on any plan, and a push deploys the branch’s latest commit through the same check.

    main · push → deploy

  3. The command line

    The standalone client runs the same operations from a terminal or a cloud sandbox: Node.js 22 or newer, one approval in your browser, no key pasted anywhere.

    $ node tofu-agent.mjs login

What Tofu hosts

Request-driven web apps. In the stack you already chose.

A prebuilt site, a web framework, a Python, Go or JavaScript server, or your own container. Every one answers a request and scales to zero between requests; detection proposes the preset and you confirm it.

Sites and web frameworks
  • Next.js
  • Vite
  • Astro
  • SvelteKit
  • Nuxt
  • React Router
  • Gatsby
  • Static HTML

Built by the provider from the framework’s own build — or, for a prebuilt static site, published as it is.

Python
  • FastAPI
  • Flask
  • Django
  • Python

Built from the app’s own manifest and started as an HTTP process that answers the address.

Go
  • Go

Built from the app’s own go.mod and started as an HTTP process that reads PORT.

JavaScript servers
  • Express
  • Hono
  • NestJS
  • Node.js server

One entrypoint file the provider finds by name, started as an HTTP process — the server answers /.

Containers
  • Dockerfile (container)

The image your own container file describes, built by the provider and run as a service.

Nothing resident: a background worker, a queue consumer or an always-on scheduler has no path through Tofu, on any plan. Hosting and deploys

The safety check

Read before it builds. And plain about what it read.

Before anything builds, Tofu runs a fixed set of deterministic rules over the exact files about to be uploaded: committed live keys, tables with Row Level Security off, open write policies and known malware shapes. A finding that could harm other people (a known malware shape, phishing, a leaked key) stops the build, and the version already live keeps serving. Choices that only affect your own app, like an open table, are flagged as warnings and never stop it.

Every result names the files it read and what no rule looks for — it states what it checked, and never more.

How the safety check works

Coming soon.

  • Buying a domain for you. Tofu connects a domain you already own.

  • An itemized deep-scan report.

By design.

  • Preview deployments. Each app’s GitHub updates follow one branch and one app root — no pull-request previews, no tags.

  • Database password rotation, analytics export and teams.

  • A SQL console. That is policy: uploaded source is untrusted input, and one operator credential would cover every managed project.

  • Anything that has to stay running. A background worker, a queue consumer, an always-on scheduler or a non-HTTP service; an app’s own vercel.json crons do not register either.

Paste one message. Online in 10 minutes.

Your app, its database, your domain and your sign-in — from the agent you already use.

Start free