fromcode frameworkSponsorGitHubGet started

The application framework you

One TypeScript kernel for sites, shops and business apps, or just the backend behind your own.

Get startedView on GitHub
Licence
MIT, open source
Runtime
Node.js 22+
Stack
TypeScript, React 19
Databases
PostgreSQL, MySQL, SQLite
Release
AtlantisAtlantis
Kernel

Multi-site

Many sites, one deployment

Isolated twice: in the app and in PostgreSQL.

The admin dashboard of one site
Deploys

Rolling updates, no gap

One service at a time. Visitors see no gap.

  • api ready
  • admin ready
  • storefront ready
  • gateway ready
Security

Roles, permissions, two-factor

In the kernel, not in a plugin.

Security
Plugins

Each plugin in its own process

Signed and sandboxed. A crash stays inside it.

shoprunning
formsrunning
invoicesrunning
coursesrunning
Plugins
AI

Every install is an MCP server

Agents work through scoped tokens you mint in the admin.

AI agentscoped tokenyour install
How it works

ssh your-server

Two Compose files and an .env. Secrets are generated on the first boot.

Set up

Where is your database?

PostgreSQLmany sites
MySQLone site
SQLiteone file
Restarting on PostgreSQL

The wizard runs in the browser: database, language, administrator, platform name.

Add a site

Point DNS hereA 203.0.113.10
northwind.examplePrivateIssuing certificatePreview

A new site is private until you open it. Preview it first, then make it public.

FormsInstall

Contact and booking forms, with submissions in the admin.

  • Signature verified
  • Asks for api database:read jobs
  • Started in its own process

Plugins install from the admin. Each declares what it may do, and a version that asks for more waits for your approval.

System updates

Install updates automatically

The updater is running and checks for new versions every minute.

  • api ready
  • admin ready
  • storefront ready
  • gateway ready
Failed requests0

New versions install themselves, one service at a time. A breaking one waits for your Install button; a failed one rolls back.

Backend

REST, GraphQL and realtime, on any path you choose.

  • API onlyNothing else runs.
  • API + AdminPlus the admin for your editors.
  • Full stackPlus a themed storefront.
Explore the API
your app
# sign in, then read any collection
$ curl -X POST https://example.com/api/auth/login \
    -d '{"email":"you@example.com","password":"…"}'

$ curl https://example.com/api/collections/posts \
    -G -d limit=10 -d sort=-createdAt \
    -H "Authorization: Bearer <token>"

# or GraphQL, and live updates over a socket
POST https://example.com/api/graphql
WS   wss://example.com/api/ws
API_URL=https://example.com/apiChange one setting and every route moves with it.

A self-hosted alternative to Supabase and Firebase.

  • PostgreSQL
  • Auth
  • Instant APIs
  • Storage
  • Realtime
  • Server code
  • Admin
  • Your server
Security and privacy

Six checks on every request. Nothing about you leaves the server.

  1. EdgeAn under-attack check, pattern blocking, per-visitor rate limits, and blocking by country or IP range.
  2. Sign-inTwo-factor with recovery codes, single sign-on and API keys.
  3. PermissionsRoles grant create, read, update and delete per collection, checked on every request.
  4. DataRow-level security in PostgreSQL keeps every site apart. Secrets are stored encrypted.
  5. PluginsEach runs signed, in its own sandbox with limits. A plugin asking for more needs your approval again.
  6. RecordAn audit log and a security monitor. An erasure request reaches every plugin.

Nothing leaves your server unless you send it.

How each layer works
Also in the kernel

Every edit is versioned

Each save keeps the previous version. Restore any of them with one click.

Languages

Mark a field as localized and edit it per language. The locale switches at runtime.

Certificates

Automatic from Let's Encrypt or another ACME authority, or upload your own. Keys are encrypted, and you are warned before expiry.

Backups you can preview

See what a restore will change before you run it. A safety snapshot is taken first.

Jobs and redirects

Scheduled jobs with their run history, and redirects managed in Settings.

Real time

WebSockets at /api/ws, queues, a managed cache and signed webhooks.

Benchmarks

Requests per second on the same 2 vCPU server, with the same data and no response cache.

Method, data and the full comparison
2.0×times the throughput of Strapi on a list of 20 records
Fromcode203.4
Payload137.5
Directus109.6
Strapi99.5
Moving over

Records, media, old links and passwords arrive intact.

  • WordPress
  • WooCommerce
  • PrestaShop
  • Magento
  • Drupal
  • Joomla
  • OpenCart
  • Ghost
  • Shopify
  • Wix
  • Payload
  • Strapi
old/product.php?id=42
301/products/blue-mug
How importing works
Get started

Node.js 22 and Git. The wizard does the rest.

  • PostgreSQLRecommended. Row-level security, and the only driver for more than one site.
  • SQLiteOne file, no server. The quickest way to try it.
  • MySQLRoles and backups, one site.
Every way to install
terminal
Open core
          
MIT licensed. Add only the plugins you need.
  • Pages and blocks
  • Online shop
  • Invoicing
  • Shipping
  • Subscriptions
  • Courses
  • Pages and blocks
  • Online shop
  • Invoicing
  • Shipping
  • Subscriptions
  • Courses
  • Forms
  • Newsletters
  • Analytics
  • Appointments
  • SEO
  • Privacy
  • Forms
  • Newsletters
  • Analytics
  • Appointments
  • SEO
  • Privacy
  • Reminders
  • Broadcasts
  • Referrals
  • Gift cards
  • Wallets
  • Logistics
  • Reminders
  • Broadcasts
  • Referrals
  • Gift cards
  • Wallets
  • Logistics
Explore plugins 
         
Sponsor the work, or buy the team a coffee.
Sponsor 
     
Get startedView on GitHub