FAQ

FAQ

What is Castra for? Small and medium apps that want a backend in their own Cloudflare account: REST over their tables, auth, and access rules they can test, without running servers. It is a starter kit you own, not a hosted service.

How is it different from Supabase or PocketBase? It runs entirely on Workers + D1 in your account; there is no server to operate. Policies are written in TypeScript, compiled to SQL and tested in CI. An MCP server lets AI agents ask why a user can or cannot see a row, using the same engine that production enforces. In v0.1 there is no admin UI, no realtime and no file storage routes.

Why "default closed"? A table that is missing from the config has no routes at all, and neither does an operation without a rule. Forgetting a policy therefore hides data instead of leaking it.

Can AI agents change my data through MCP? Not in v0.1; the tools are read-only. Remote /mcp needs a scoped token, and every call is written to an audit log (trim it with castra mcp audit prune --older-than <days>). Write tools are planned for v0.2 and will use the same write checks as REST.

Is it production-ready? v0.1.1 is early. It is deployed and tested, but read Status and limits first. Pay particular attention to D1's single-writer model, the lack of rate limiting (put a Cloudflare rule in front) and the open issues in the security model.

Does it support Postgres, multi-tenancy or realtime? Not before v1.0. See Roadmap.

Why are the npm packages @castra-kit/* and not castra? npm refused castra as too similar to astro, so every package lives under the castra-kit org (ADR 0069). The command is still castra.