System Architecture & Specifications
A comprehensive guide to MeroFoundry's runtime environment, bidirectional Model Context Protocol (MCP) gateways, tenant isolation, and execution security.
1. Topology & Control Plane Architecture
MeroFoundry separates the Authoring Control Plane (where AI agents create schemas, rules, and layouts) from the Application Runtime Tier (which serves end-user HTTP traffic, APIs, and consumer MCP requests).
+-------------------------------------------------------------------------------+
| DEVELOPER / AGENT INTERFACE |
| Claude Code | Cursor / Windsurf | Claude Desktop | CLI |
+-------------------------------------------------------------------------------+
|
| MCP over Streamable HTTP / JSON-RPC 2.0
v
+-------------------------------------------------------------------------------+
| MEROFOUNDRY CONTROL PLANE GATEWAY |
| - OAuth 2.1 & PKCE Verification - Scoped Application Tokens |
| - Mutation Idempotency Engine - Tool Dispatcher & Rate Limiter |
+-------------------------------------------------------------------------------+
|
+----------------------------+----------------------------+
| |
v v
+-----------------------------+ +-----------------------------+
| SCHEMA & RECORDS | | RULES & WASM FUNCTIONS |
|- Versioned Model Schemas | |- TypeScript -> WebAssembly |
|- Validated JSON Records | |- Event-Triggered Rules |
|- Generated REST + OpenAPI | |- Outbound Integrations |
+-----------------------------+ +-----------------------------+
| |
+----------------------------+----------------------------+
|
v
+-------------------------------------------------------------------------------+
| PUBLISHED APPLICATION RUNTIME TIER |
| |
| [ Public Web UI ] [ REST API v1 ] [ App's Own MCP Server]|
| - Custom Domain & SSL - Scoped API Keys - End-User AI Tools |
| - Server-Rendered Blocks - OpenAPI Generated - RBAC Enforced |
+-------------------------------------------------------------------------------+2. Model Context Protocol (MCP) Implementation
MeroFoundry natively implements the Anthropic Model Context Protocol (MCP) for bidirectional agent communication.
Authoring MCP Gateway
Exposes tools that let coding agents read, construct, and mutate the target application state in real time.
- Transport: Streamable HTTP (JSON-RPC 2.0 over HTTPS), per the current MCP specification.
- Authentication: Bearer tokens resolved via OAuth 2.1 authorization grants.
- Idempotency: Every mutation tool requires an
idempotency_key, so an agent retry can never apply the same change twice.
Consumer Application MCP Server
Every published application can expose its own MCP server for end-user assistants (Claude, Raycast, IDEs).
- Catalog Generation: Tools are dynamically mapped from configured queries and business rules.
- Entitlement Checking: Each incoming tool call is evaluated against the calling user's workspace roles.
- Zero Public Exposure: Private records and models remain invisible to unauthorized tool calls.
Core Authoring Tools Manifest
| Tool Namespace | Supported Operations | Security Scope |
|---|---|---|
models:* | create_model, add_field, update_field, delete_field, publish_model | models:write |
records:* | create_record, query_records, update_record, delete_record | records:write |
rules:* | create_rule, update_rule, test_rule, run_rule_event | rules:write |
pages:* | create_page, update_page, render_page, delete_page | pages:write |
3. Business Rules & Sandboxed TypeScript Functions
Business logic is written in TypeScript, compiled to WebAssembly once at publish time, and run in a sandbox. Each invocation is capability-scoped and fuel-metered, so a function can only reach the services it was given and cannot run past its plan's budget. Cold start is about 20 ms.
// Illustrative: shows the shape of a rule, not the runtime's exact API. // Sample MeroFoundry TypeScript Rule: Automatically score and tag inquiries export async function onBeforeSave(context: RuleContext<InquiryRecord>) { const { record, services } = context; // Validate required field formatting if (!record.email.includes('@')) { throw new ValidationError('Invalid email format provided.'); } // Optional vector embedding generation const embedding = await services.ai.generateEmbedding(record.message); record.embedding = embedding; // Asynchronous webhook dispatch to external CRM if (record.workshop_interest === 'Clay Planters') { await services.webhooks.dispatch('inquiry_high_value', { email: record.email, interest: record.workshop_interest }); } return record; }
Rule Triggers
Rules fire on eleven platform events, grouped by source:
- Record events:
record_create,record_update,record_save,record_delete - Interfaces:
frontend_event(a page action),webhook_received,tool_called(a consumer MCP tool) - Direct:
manual, from the admin UI or the API - Auth:
login_succeeded,login_failed - Failure:
function_failed, so a rule can react to another rule's error
A rule marked abort-on-failure rolls the triggering write back.
Sandbox Guardrails
Enforced resource boundaries protect noisy neighbors:
- Execution budget: fuel-metered per invocation and per plan, from about 0.5 s on Hobby to 250 s on Studio 5x. Deterministic, so a slow node never changes what a function is allowed to do.
- Memory ceiling: enforced per invocation.
- Egress controls: functions have no network access; outbound calls go only through services the application has configured.
4. Security, Isolation & Identity
MeroFoundry was engineered from day one for multi-tenant SaaS environments.
OAuth 2.1 with PKCE
Agent sessions use OAuth 2.1 with Proof Key for Code Exchange (PKCE). Tokens are cryptographically tied to the active Workspace and Application ID.
Tenant Boundary Enforcement
Every query and storage read is scoped to the tenant by the platform, on every request. Workspace roles and plan entitlements are checked the same way, before any tool or endpoint runs.
Automated TLS & Hardened Edge
Published applications are automatically provisioned with Let's Encrypt TLS certificates and served through a hardened edge: an OWASP CRS web application firewall on every request, and rate limiting at the application layer.
Encrypted Secrets Store
Third-party API keys (OpenAI, Anthropic, Stripe, SendGrid) are encrypted at rest with authenticated encryption (AES-CBC + HMAC-SHA256, via Fernet) and decrypted only at execution time, when a rule or function invokes the service.
5. Specifications Matrix
| Component | Specification | Notes |
|---|---|---|
| MCP Transport | Streamable HTTP (JSON-RPC 2.0) over HTTPS | Built on the official MCP SDK; tracks the current specification |
| Runtime Environment | Sandboxed WebAssembly, compiled from TypeScript at publish | About 20 ms cold start; fuel-metered per plan |
| API Delivery | Auto-generated REST endpoints with OpenAPI 3.1 documentation | JSON request/response with schema validation |
| Vector Embeddings | Cosine similarity search over a model's published vector field | Queryable from business rules and over MCP |
| Domain Routing | Wildcard subdomain (*.merofoundry.app) + Custom CNAME routing | Automatic Let's Encrypt TLS provisioning |
| Free Tier Allocation | Hobby: 1 workspace, 1 published app, full MCP access | Agent reads and writes aren't metered; automations are (100 a month). No credit card. |
Ready to connect your AI agent?
Start building in under two minutes on our free Hobby tier.