Castra
A self-hosted backend on Cloudflare: one Worker and one D1 database in your account serve REST endpoints for
your tables. Every endpoint is protected by policies written in TypeScript and compiled to SQL. An MCP server lets AI
agents inspect exactly what production enforces.
- Closed by default. A table without a policy has no routes.
- Policies are SQL. Rules become
WHERE clauses, so pagination and counts stay correct.
- Checked writes. Every create and update is verified on the stored row, atomically.
- Auth included. Better Auth (email, GitHub), roles and API keys.
- Agent-safe MCP. Read and write tools on the same engine and write path as REST, with scoped tokens and an audit log.
Status: v0.4.1 (changelog). Early, but deployed
and working. Upgrading from 0.4.0? See the upgrade guide.
Read Status and limits before using it for anything important.
Quick start
Requires Node 20+ and pnpm.
npm create @castra-kit@latest my-app
cd my-app
cp .dev.vars.example .dev.vars # set BETTER_AUTH_SECRET: openssl rand -base64 32
pnpm db:migrate:local
pnpm dev # http://localhost:8787/health
Deploy to your Cloudflare account (token permissions: docs/cloudflare-token.md):
CLOUDFLARE_API_TOKEN=... pnpm run deploy
The full walkthrough, including your first request and your first policy, is in
Getting started.
What a policy looks like
import { authenticated, defineConfig, isPublic, owner, role } from "@castra-kit/core";
export default defineConfig({
database: "d1",
roles: ["admin", "editor"],
tables: {
posts: {
read: isPublic().where((q) => q.eb("status", "=", "published")).or(owner("author_id")),
create: authenticated(),
update: owner("author_id").or(role("editor", "admin")),
delete: role("admin"),
fields: { author_id: { setBy: "server" } },
},
},
});
// Any table not listed here is never exposed.
Documentation
| |
|---|
| Getting started | Scaffold, run, first request, first policy, deploy |
| Concepts and configuration | Rules, write checks, field rules, config reference |
| REST API | Routes, filters, sorting, pagination, includes, errors |
| Auth | Better Auth, sessions, roles, API keys |
| MCP | Tools, local stdio server, remote /mcp, tokens and scopes |
| CLI | castra generate, provision, migrate, deploy, doctor, mcp |
| Rate limiting | Per-IP write limits, WAF rule for reads |
| Status and limits | What is verified, D1 limits, what is out of scope |
| Security | Threat model, guarantees, known issues |
| Problem types | Every error code the API returns |
| Architecture · |
Questions and ideas: Discussions.
Troubleshooting and FAQ: Wiki.
Packages
Contributing
See CONTRIBUTING.md. Report vulnerabilities privately, as described in SECURITY.md.
License
MIT © Mehmet Özer Özdaş
