Skip to main content
Resources Search Contact us

  1. Agentycs
  2. Developers
  3. Application Framework

Declare an application. The platform builds it.

Describe what an application does and Agentycs generates the frontend, packages it, signs it, attests where it came from, and runs it under exactly as much isolation as its trust level demands.

Four ways to author, one definition #

Choose the surface that suits the person, or the agent, doing the work. Every route converges on the same declaration, so an application built visually can be extended in code later without a rewrite.

Typed Python SDK
The pro-code path: declare the manifest, blocks, workflows, capabilities and data access, with schemas exported so tooling stays in step.
Visual block builder
Describe a whole application as a block specification and have it transpiled into the same bundle the SDK produces. No programming required.
In-platform IDE
A browser workspace provisioned per session, pre-wired to validate, test, simulate and deploy, with live preview, workflow graphs, agent traces and inline diagnostics.
Authored by an agent
An application built end to end from a plain-language brief. Because the trust model already sandboxes the least-trusted code, agent-authored applications run safely.
Declare an application in the Python SDK · Python 
from agentycs.app import App, blocks

app = App(id="inspections", title="Site inspections")


@app.query
def open_findings(site_id: str) -> list[dict]:
    return app.data.sql(
        "SELECT * FROM findings WHERE site_id = $1 AND status = 'open'",
        site_id,
    )


app.page(
    "/",
    blocks.DataTable(title="Open findings", query=open_findings),
    blocks.Agent(title="Inspector", tools=[open_findings]),
)

That declaration is the whole application. The platform generates the frontend, the REST, realtime and MCP surfaces and the typed client from it.

Identical input yields a byte-identical bundle. That is what makes a signature worth checking.

What that declaration turns into #

The query declared above is not only a query. The same definition produces a REST endpoint, a realtime target, a Model Context Protocol tool and a typed client, all enforcing the same per-operation permission check, so an agent and a browser reach the identical operation rather than two implementations that will eventually disagree.

Call an application operation over REST · Shell 
curl https://agentycs.example.com/api/apps/inspections/open_findings \
  -H "Authorization: Bearer $AGENTYCS_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"site_id": "FAW-014"}'

Authenticated application traffic lives under /api/apps/{app}/. Public routes an app chooses to expose live under /api/public/apps/{app}/. The operation name is the one the application declared.

Call an application's tool over MCP · JSON 
// POST /api/apps/inspections/mcp
{
  "jsonrpc": "2.0",
  "id": 2,
  "method": "tools/call",
  "params": {
    "name": "query.open_findings",
    "arguments": { "site_id": "FAW-014" }
  }
}

Each application has its own MCP entry point at /api/apps/{app}/mcp, and its live queries and mutations become query.* and mutation.* tools. A tool call passes the same per-operation permission check as the REST and WebSocket equivalents above.

Assembled from production blocks #

You compose an interface from blocks rather than building it from scratch, and each block arrives with its own data wiring, loading, empty, error and optimistic states, and accessibility already handled.

  • Forms, dashboards, document libraries, review queues, boards, timelines, metrics grids and data explorers
  • A conversational agent as a drop-in block, wired to tools, search and capabilities
  • Stacks, grids, tabs, splits and sidebars for arranging them into a navigable application
  • Construction-time validation, so a malformed block fails loudly instead of shipping

What an application can reach #

An application gets the same primitives that power the first-party products, scoped to its workspace and checked on every privileged call.

  • Durable, replayable workflows and scheduled timers that survive restarts
  • Hybrid search and retrieval over your own data, plus files, key-value state and secrets
  • Typed access to models and agents, under the same policy as everything else
  • Platform and external tools over MCP, each behind a capability check
  • Declared side effects that commit exactly once, with metrics and tracing built in

From declaration to running application #

The build path is deterministic and evidential: identical input yields a byte-identical bundle and digest, and nothing runs that the platform cannot trace back to its source and its signer.

  • Declarations compile to a stable intermediate representation, then to a bundle and typed client
  • One deterministic, content-addressed package is the unit of deployment
  • Each build emits a signed provenance attestation and an SBOM of everything inside
  • Signatures bind the artefact, its attestation and the cluster identity that built it, checked before load

Trust decides where it runs #

Every application carries a trust level, and that level determines which runtime profiles it is admitted to. A request to run an application on a profile its trust forbids is refused with a stable reason and recorded, rather than quietly allowed.

Shared host
A pooled in-process host for trusted first-party applications. The low-overhead default.
Dedicated host
One hardened pod per workspace and application: full kernel and cgroup boundary, workload identity, deny-by-default egress, non-root read-only filesystem.
Sandboxed host
A WebAssembly, or where required microVM, sandbox with no ambient access. The home for untrusted and agent-authored code.
Every host
Import allowlists, bounded execution deadlines, resource quotas and per-run cleanup.

Shipped like any other resource #

An application is declared as a single resource capturing its artefact, routing, trust profile and rollout, and the platform reconciles it into something running. A push to its repository rebuilds, repackages, signs and attests a new artefact with no manual steps.

  • Canary rollout: a weighted share of traffic, watched before full promotion
  • Sub-second revert to the last known-good version the moment a regression appears
  • Automatic quarantine of an application that crash-loops or fails verification

Keep going #

MCP and tools

Expose your application's operations as agent tools, still gated by the same per-operation checks.

Open →

APIs and protocols

The generated REST, realtime and query surfaces your declaration produces, and the rules they all share.

Open →

Trust and security

Trust levels, isolation profiles, signed provenance and the audit trail behind every privileged action.

Open →