Declare the application. Ship the application.

The Application Framework builds complete applications on the platform declaratively, with no hand-written plumbing and no separate deployment pipeline to maintain.

Talk to our team What it does

One framework, from intent to running application #

Most internal software is ninety per cent plumbing: forms, tables, permissions, background jobs, deployment, rollback, audit. The part that is actually specific to your organisation is the last ten per cent, and it is the part that never gets enough attention. The framework inverts that.

Every authoring mode compiles to the same application definition, and every definition produces the same deterministic bundle, so an application written in the SDK, drawn in the visual builder or generated by an agent is the same kind of thing to the platform. That is also what makes AI-authored software safe to run: the least-trusted tier is already sandboxed with no ambient access, so an agent-written application is not a special exception, just an application at the trust level that gets the strongest containment.

You write the ten per cent that is yours. The framework writes the ninety per cent that is everybody's.

What the framework does #

Four ideas carry it. Everything else is detail.

Declare it, do not wire it #

You declare the pages, blocks, queries, workflows and capabilities. The framework emits the frontend, the typed helpers and the route metadata.

Typed Python SDK
No-code block specification
Plain-language brief, written by an agent

Compose from blocks that are already finished #

Forms, dashboards, document libraries, review queues, boards and timelines arrive with their data wiring, their states and their accessibility already built in.

Interface blocks with every state handled
A grounded agent as a drop-in block
Malformed blocks fail at construction

Nothing runs that cannot be traced #

An application compiles into one content-addressed package, with a signed provenance attestation and a component inventory checked before anything loads.

Deterministic, content-addressed packaging
Standards-based bill of materials
Verified before load, every time

Trust decides where code may run #

Every application carries a trust level, and admission rules map each level to the runtimes it is allowed on. Every other combination is refused at execution.

Shared, dedicated and sandboxed hosts
No ambient access in the sandbox
Fail-closed admission, with a stable reason

What you actually write #

A complete departmental application: a page, two blocks, a query the platform publishes on every protocol, and one operation agents are allowed to call.

app.py

from agentycs_sdk import App
from agentycs_sdk.blocks import ReviewQueue

app = App(
    "supplier-invoices",
    name="Supplier Invoices",
    version="1.4.0",
    capabilities=["app.supplier-invoices.access", "atom.query", "workflow.run"],
)

app.route("/queue", title="Approval queue")          # a page
overdue = app.api_query("overdue_invoices")          # a query, on every protocol
app.expose_mcp("approve_invoice")                    # an operation agents may call

app.add_block(                                       # a block, states included
    ReviewQueue(
        id="approval-queue",
        title="Unapproved invoices",
        queue=overdue,
        actions=["approve_invoice", "request_changes"],
    )
)

The whole application. There is no companion frontend project, no API layer and no deployment script beside this file.

generated

frontend   routes, blocks, states, typed API helpers and DTOs
real time  supplier-invoices.overdue_invoices, snapshot then diffs
REST       GET  /api/apps/supplier-invoices/rest/queries/overdue_invoices
           POST /api/apps/supplier-invoices/rest/mutations/approve_invoice
tools      POST /api/apps/supplier-invoices/mcp, capability-checked
package    content-addressed, plus provenance, inventory and signature

Emitted from the declaration above. Identical input yields a byte-identical bundle and digest.

In more detail #

The full capability surface, grouped by the job it does.

Authoring experiences

Pro-code, no-code and fully autonomous, all compiling to the same application definition.

Python SDK: A typed SDK to declare an application's manifest, blocks, workflows, capabilities and platform access, exporting its schema so tooling stays in step with what you write.
Visual block builder: Describe a whole application as a declarative block specification and have it transpiled into the same bundle the SDK produces, with no programming.
In-platform IDE: A browser IDE provisioned per session and pre-wired for the framework: validate, test, simulate and deploy, with live preview, workflow graphs, agent traces, a capability explorer and inline diagnostics on save.
AI authoring: Applications written end to end by agents from a plain-language brief, running safely because the framework's least-trusted tier is already sandboxed.

Block catalogue

Compose ready-made, production-grade building blocks instead of building interfaces from scratch.

Interface blocks: Forms, dashboards, document libraries, review queues, kanban boards, timelines, metrics grids, data explorers, settings and embeds, each with loading, empty, error and optimistic states built in.
Agent block: A conversational agent as a drop-in block, wired to tools, search and capabilities, so any application can embed a grounded assistant.
Layout primitives: Stacks, grids, tabs, splits and sidebars for arranging blocks into complete, navigable applications.
Validation at construction: Fail-loud validation means a malformed block cannot ship. It is the contract the generator and the runtime both agree on.

What applications can call

The same primitives behind first-party products, exposed safely and tenant-scoped to every application.

Durable workflows: Long-running, replayable workflows and scheduled timers behind your application logic, on the platform's durable engine.
One authorisation decision: Every privileged operation resolves through a single audited decision that consolidates role, capability and attribute rules.
Models, agents and tools: Typed access to agents and models under tenant policy, plus platform and external tools over the Model Context Protocol, each gated by a per-tool capability check.
Search, data, secrets and effects: Hybrid search and retrieval, tenant data, files, key-value state and secrets, all tenant-scoped and access-checked, alongside declared idempotent side effects with metrics and tracing built in.

Generation and packaging

Declarations become a real, running frontend, and the same input always produces the same output.

One neutral representation: Routes, layouts, blocks and agent declarations compile to a stable intermediate form: the contract between authoring and generation.
Generated frontend: The bundle, typed API helpers, data transfer objects and route metadata are emitted for you. This is the plumbing authors never write.
Reproducible builds: Identical input yields a byte-identical bundle and digest, with golden snapshots failing any unintended drift.
Deterministic packaging: An application compiles into one content-addressed package of manifest, sorted files and hashes. That package is the unit of deployment, held in a registry alongside its attestations, inventories and signatures.

Trust, isolation and hosts

First-party, tenant and AI-authored code share one platform safely, because trust decides where code may run.

Four trust levels: Every application carries a trust level, from first-party signed through tenant-trusted and tenant-untrusted to AI-authored, and that level governs how strongly it must be isolated.
Fail-closed admission: Admission rules map each trust level to the runtime profiles it is allowed on and refuse every other combination at the moment of execution, with a stable reason, recorded.
Shared, dedicated and sandboxed hosts: A pooled in-process host for trusted applications, one hardened pod per tenant and application with deny-by-default egress and a non-root read-only filesystem, and a WebAssembly sandbox with no ambient access for untrusted and AI-authored code.
Common execution boundary: Import allowlists, bounded deadlines, resource quotas and per-run cleanup on every host, so nothing can exceed its envelope, with every privileged action correlated to the identity behind it.

Lifecycle and operations

Applications are deployed and operated like any other platform resource.

Declared as a resource: One resource captures an application's artefact, routing, trust profile and rollout, and the platform reconciles it into a running application.
Continuous delivery: A push to an application's repository builds, generates, packages, signs and attests a new artefact, ready to roll out with no manual steps.
Canary and rollback: New versions take a controlled, weighted share of traffic and are watched before full promotion, with sub-second revert to the last known-good version the moment a regression appears.
Automatic quarantine: An application that crash-loops or fails verification is isolated automatically, protecting the rest of the runtime pool.

What teams build with it #

The framework also carries the platform's own first-party applications, on exactly the path your teams use.

Operational applications

Review queues, case management, approvals, document libraries and dashboards over your own data, composed from blocks rather than built from scratch.

Grounded assistants

Drop a conversational agent into an application, wired to search, tools and capabilities, so it answers from your data and can act under permission.

Applications written by agents

Hand a brief to the Agent² Software Factory and get a sandboxed, signed, attested application you can inspect, canary and roll back.

Surfaces and interfaces #

Every application is exposed identically over the platform's protocols, and every path enforces the same access checks.

Typed Python SDK
Block specification
Real time and REST
MCP tools

What each interface gives you

Typed Python SDK: The pro-code authoring surface, schema-exporting so tools and generated code stay in lockstep.
Block specification: A declarative description of a whole application, for the visual builder and for agents writing applications.
Real time and REST: Live queries with snapshot and diff updates, plus a generated REST facade over every query and mutation, kept in authorisation parity.
MCP tools: Each application's operations are available to agents as tools, gated by the same per-operation checks as any other caller.

Bring us an application backlog

Tell us what your teams are waiting for and who would build it. We will show you how much of it the framework already does.

Talk to our team