Features
Everything between your code and a live app.
What each part does, where its limits are, and what is not built. Everything here runs today unless a line says otherwise.
Import and check
Bring the app you have. Tofu reads it before it builds anything.
Folder or ZIP upload
Drop a folder or a ZIP. An update replaces the same project's source, so the framework, environment, address and history stay attached.
GitHub import and push sync
Import one branch, naming the app's root folder yourself; the token is read-only and the import is pinned to a commit. Enable automatic updates and Tofu deploys the branch's latest commit after a push, through the same check and publication flow.
A check before the build
The files about to be uploaded are scanned first. Findings rated critical or high stop the build: a committed live credential, a table with Row Level Security off, a policy that lets anyone write. A missing SPF, DKIM or DMARC record is a reminder, not a block.
Automatic updates can be enabled today, but a real push-triggered deploy has not been proven end to end yet.
Hosting and publishing
Tofu runs each app in its own hosting project, at a trytofu.app address it moves only after the new version answers.
History, logs and rollback
Every attempt with its status, and the build and runtime logs the platform produced. Rollback points the address at an earlier deployment that is ready and answering; your data does not move back.
A health check before live
A build that succeeded is not yet live: Tofu requests the build's own address and moves your app's address only if it answers. A gate in front reads as protected, not broken.
Built-in repair
A paid app can ask Tofu to diagnose a failed deployment and propose a bounded change: at most eight files, checked in a two-minute sandbox with no ports and an empty environment. You review the files, apply and deploy separately, and Undo restores the replaced source.
Apps are public by default: the provider's own sign-in wall is off. The fence that would restrict an unpaid app after its billing grace, and lift it after payment, is built but switched off in production.
Configuration
The values that go into a build, the address it answers on, its database, its traffic.
Environment variables
Names and scopes are managed in the dashboard. Values live with the hosting provider, and a secret is stored there write-only, never read back by Tofu. A .env import treats every value as one.
Domains you already own
A paid app can connect a hostname you already own: add the _tofu TXT record Tofu gives you at your own DNS provider — Tofu writes no DNS. Ownership is proven, a certificate is prepared and your live deployment is assigned; it counts as connected only after that reads back. A read-only panel lists the records.
Managed databases
A paid app can create one managed Postgres database in a region you choose. It starts empty: Tofu runs no migrations, schema or policies. Connecting it writes the connection variables into the app's hosting project; migrate during the build.
First-party analytics
Each project has one site key and one line to paste, or a switch that adds it to a prebuilt static deployment. Counting runs on Tofu's own endpoint: no cookie, no third-party script, no stored IP, and Do Not Track or Global Privacy Control stops a view.
The Database panel reports only what it could read — an empty or populated schema, or a read that was unavailable. The one action that returns a credential, Show the connection string, is an owner-only audited rebuild that does not rotate the password.
For your coding agent
A local bridge to the same backend the dashboard uses: the same projects and deployment history.
The setup page hands your agent one prompt for Codex, Claude Code, Cursor or another local stdio MCP client, pinning the bundle's SHA-256 and size; the agent installs it, adds the /tofu skill and registers the MCP server. Sign-in is a device flow you approve in the browser; the credential is hashed at rest, valid for seven days and revocable from Agent connections.
What it can do. Twenty-two tools do the same work as the dashboard: upload, framework confirmation, the safety check, deploy, status, logs, history, rollback, environment names, a repair brief, the app's managed database and a domain you own. Deploys, rollbacks and database creation need your authorization.
The installed /tofu skill is the playbook: the order of steps and how to read the result — a queued build is not a live app, and an access gate is not a failed build.
What is not here yet
- Auth, email and payments for your app. Tofu creates no sign-in, sends no mail from your domain and takes no payments inside your app.
- Buying a domain for you. Search, quotes and the registrar handoff exist, but the purchase path is deliberately switched off.
- Tofu running your migrations, and any SQL console. That is policy: uploaded source is untrusted input, and one operator credential would cover every managed project.
- An itemized deep-scan report, managed-database password rotation, an in-browser preview, a one-click move of a running app and its database, teams and notifications.