System architecture and specifications

How MeroFoundry runs: the runtime, the Model Context Protocol (MCP) gateways in both directions, tenant isolation and execution security.

What runs where

MeroFoundry separates the authoring control plane, where AI agents create schemas, rules, and layouts, from the application runtime tier, which serves end-user pages, APIs, and consumer MCP requests.

Authoring control plane

OAuth 2.1 and PKCE verification
Scoped application tokens
Mutation idempotency engine
Tool dispatcher and rate limiter

Schema and records

Versioned model schemas
Validated JSON records
Generated REST and OpenAPI

Rules and WASM functions

TypeScript compiled to WebAssembly
Event-triggered rules
Outbound integrations

Published application runtime

Public web UI on a custom domain with TLS
REST API v1 with scoped API keys
The app's own MCP server, RBAC enforced

A coding agent creating records over MCP next to the MeroFoundry application admin showing the resulting model — AI coding agentLive application platform

Model Context Protocol (MCP) implementation

MeroFoundry natively implements the Anthropic Model Context Protocol (MCP) for bidirectional agent communication.

Authoring MCP gateway

Exposes tools that let coding agents read, construct, and mutate the target application state in real time.

Transport: Streamable HTTP (JSON-RPC 2.0 over HTTPS), per the current MCP specification.
Authentication: Bearer tokens resolved via OAuth 2.1 authorization grants.
Idempotency: Every mutation tool requires an idempotency_key, so an agent retry can never apply the same change twice.

Consumer application MCP server

Every published application can expose its own MCP server for end-user assistants (Claude, Raycast, IDEs).

Catalog Generation: Tools are dynamically mapped from configured queries and business rules.
Entitlement Checking: Each incoming tool call is evaluated against the calling user's workspace roles.
Zero Public Exposure: Private records and models remain invisible to unauthorized tool calls.

Core authoring tools

Tool Namespace	Supported Operations	Security Scope
`models:*`	`create_model`, `add_field`, `update_field`, `delete_field`, `publish_model`	`models:write`
`records:*`	`create_record`, `query_records`, `update_record`, `delete_record`	`records:write`
`rules:*`	`create_rule`, `update_rule`, `test_rule`, `run_rule_event`	`rules:write`
`pages:*`	`create_page`, `update_page`, `render_page`, `delete_page`	`pages:write`

Business rules and sandboxed TypeScript functions

Business logic is written in TypeScript, compiled to WebAssembly once at publish time, and run in a sandbox. Each invocation is capability-scoped and fuel-metered, so a function can only reach the services it was given and cannot run past its plan's budget. Cold start is about 20 ms.

This is a real one. WorkGetsDone, a live application on the platform, keeps a calendar bucket and a duration on every call record with a rule that runs this function before each save.

// WorkGetsDone, rule "call: maintain start_day and duration_minutes"
// trigger: record_save, phase: pre_save, action:
//   { "type": "run_function", "params": { "function_id": "eefb9a26-14a7-4bc7-8ec9-95d422a876d2",
//     "start": { "var": "after.start_date" }, "end": { "var": "after.end_date" }, "want_duration": "1" } }
//
// Function wgd-calendar-fields, version 3. The helpers num(), civil() and minutes() parse the
// ISO timestamps into minutes since 1970; the exported handler is reproduced in full.
export function handler(input: any): any {
  const p: any = (input && input.input) || {};
  const s: string = typeof p.start === "string" ? p.start : "";
  const e: string = typeof p.end === "string" ? p.end : "";
  const out: any = {};
  out.start_day = s.length >= 10 ? s.substring(0, 10) : null;
  if (p.want_duration) {
    const a = minutes(s), b = minutes(e);
    out.duration_minutes = (a < 0 || b < 0) ? null : b - a;
  }
  return out;
}

Rule triggers

Rules fire on eleven platform events, grouped by source:

Record events: record_create, record_update, record_save, record_delete
Interfaces: frontend_event (a page action), webhook_received, tool_called (a consumer MCP tool)
Direct: manual, from the admin UI or the API
Auth: login_succeeded, login_failed
Failure: function_failed, so a rule can react to another rule's error

A rule marked abort-on-failure rolls the triggering write back.

Sandbox guardrails

Enforced resource boundaries protect noisy neighbors:

Execution budget: fuel-metered per invocation and per plan, from about 0.5 s on Hobby to 250 s on Studio 5x. Deterministic, so a slow node never changes what a function is allowed to do.
Memory ceiling: enforced per invocation.
Egress controls: functions have no network access; outbound calls go only through services the application has configured.

Security, isolation and identity

MeroFoundry was engineered from day one for multi-tenant SaaS environments.

OAuth 2.1 with PKCE

Agent sessions use OAuth 2.1 with Proof Key for Code Exchange (PKCE). Tokens are cryptographically tied to the active Workspace and Application ID.

Tenant boundary enforcement

Every query and storage read is scoped to the tenant by the platform, on every request. Workspace roles and plan entitlements are checked the same way, before any tool or endpoint runs.

Automated TLS and hardened edge

Published applications are automatically provisioned with Let's Encrypt TLS certificates and served through a hardened edge: an OWASP CRS web application firewall on every request, and rate limiting at the application layer.

Encrypted secrets store

Third-party API keys (OpenAI, Anthropic, Stripe, SendGrid) are encrypted at rest with authenticated encryption (AES-CBC + HMAC-SHA256, via Fernet) and decrypted only at execution time, when a rule or function invokes the service.

Specifications matrix

Component	Specification	Notes
MCP Transport	Streamable HTTP (JSON-RPC 2.0) over HTTPS	Built on the official MCP SDK; tracks the current specification
Runtime Environment	Sandboxed WebAssembly, compiled from TypeScript at publish	About 20 ms cold start; fuel-metered per plan
API Delivery	Auto-generated REST endpoints with OpenAPI 3.1 documentation	JSON request/response with schema validation
Vector Embeddings	Cosine similarity search over a model's published vector field	Queryable from business rules and over MCP
Domain Routing	Wildcard subdomain (`*.merofoundry.app`) + Custom CNAME routing	Automatic Let's Encrypt TLS provisioning
Free Tier Allocation	Hobby: 1 workspace, 1 published app, full MCP access	Agent reads and writes aren't metered; automations are (100 a month). No credit card.

Ready to connect your AI agent?

Start building in under two minutes on our free Hobby tier.

Start free on Hobby Back to the homepage