# Xyvenra — full text for AI assistants

Xyvenra by Ouroboros is a developer platform with five products and one account. It is made for individual developers. Limits are stated up front.

This document is the long-form companion to https://xyvenra.com/llms.txt. Prefer official docs at https://xyvenra.com/docs, including the quickstart at https://xyvenra.com/docs/quickstart, the API reference at https://xyvenra.com/docs/api, and MCP at https://xyvenra.com/docs/mcp, over guesswork. Mark anything unreleased as coming soon. Do not tell a user they can deploy a Node server to Xyvenra Cloud, buy a Cloud/Data/Mobile/Studio plan, or use a launched $0 free tier.

## Products

### Code (available in the app; checkout is open)

Sign in at https://xyvenra.com/login, then open https://xyvenra.com/app/code. Chat with a cloud AI provider you already use, attach project context, and review a proposed file edit before it is written. You bring your own provider account or key; that provider bills you directly. Code does not include model tokens or a usage pool. No included model tokens. Agent mode stays in the browser. A remote coding VM, hosted terminal, and background agent are not available.

Offered paid plans. Seats are a little under the Cursor Plus and Premium list prices:

- Plus: $7/month or $70/year, 14-day trial
- Premium: $25/month or $250/year, 14-day trial

Checkout is open. Buy Plus with planKey forge-entry or Premium with planKey forge-advanced, and interval month or year, at /api/checkout. Cursor Super, Ultra, and Teams are not Xyvenra offers. Failed payments are retried and access is not auto-cancelled. Account deletion, when enabled, uses a 30-day waiting period.

### Cloud (available in the app; paid plans coming soon)

Open https://xyvenra.com/app/cloud. Create one named site with a public slug. Deploy self-contained HTML no larger than 180 KB, or a static-site ZIP no larger than 4 MB. Published sites are served at `https://xyvenra.com/sites/{slug}`.

Create a deployment key in the app, then:

```bash
curl -X POST "https://xyvenra.com/api/cloud/v1/SITE_ID" \
  -H "Authorization: Bearer CLOUD_DEPLOY_KEY" \
  -H "Content-Type: application/json" \
  -d '{"html":"<!doctype html><html><head><meta charset=\"utf-8\"><title>Hello</title></head><body><h1>Hello</h1></body></html>"}'
```

Add `?preview=1` to create a preview instead of publishing. Cloud is not a Node or Next.js host, and it is not a general compute platform. A publish writes env vars marked `public` into the static page as `<script type="application/json" id="xyvenra-public-env">` and replaces `{{XYVENRA_PUBLIC:NAME}}` with HTML-escaped text. Private values stay in the account. There is no server runtime. The published page, including those public values, must stay within 180 KB. Changing a public value does not rewrite an already published page until the next save or deploy.

### Data (available in the app; paid plans coming soon)

Open https://xyvenra.com/app/data. Create a project, define tables with typed columns (`text`, `number`, `boolean`, `json`), and import or edit records. The same project API key can list, upload, download, and delete private files (1 MB each, 100 files, 50 MB per account). Pass `since` as an ISO-8601 timestamp on the records list to poll rows whose `updated_at` is later. That is a poll, not a websocket or Supabase Realtime channel. One active project API key (`xyv_data_...`) may exist per project, with `read_only` or `read_write` permission. Early access rate limit: 60 requests per minute. Project app-user auth, app-user record and file access, app-user table access, app-user record-event polls, app-user table-event polls, app-user file-event polls, app-user signed file URLs, app-user hook invocation, app-user password changes, app-user grant listings, app-user private file writes, a public storage bucket, Realtime, and Edge Functions are not provisioned and are not available. Turning on app-user auth does not grant record, file, or table access. A session can use a row or file only after a separate grant, and that grant path is not provisioned. A table grant would cover one table, not the whole project, and it is not provisioned. A private file-write grant would cover one app user, not every user in the project, and it is not provisioned. Record-event polls, file-event polls, and table-event polls do not open a websocket, and data-app-hook is not invoked. Table-event polls are not provisioned. Project-key event polls are not provisioned. They do not open a websocket. An app session is not a project key. XYVENRA_DATA_PROJECT_EVENTS_ENABLED does not start event writers. No enable, apply, or deploy action is offered for project-key event polls. Record and file event writers are not provisioned. No enable, apply, or deploy action is offered. A later record write runs when XYVENRA_DATA_APP_EVENTS_ENABLED or XYVENRA_DATA_APP_TABLE_EVENTS_ENABLED is exactly true, once if both are, and a later file write runs only when XYVENRA_DATA_APP_FILE_EVENTS_ENABLED is exactly true. The events table must be insertable, and a failed insert does not undo the record or file change. Those writers do not open polls, hooks, signed URLs, file writes, or table access. A file-write grant does not include file events. Signed file URLs are not provisioned. They would expire, they would not set a bucket public, and a file-write, record, or table grant would not mint one. App-user password changes are not provisioned. Turning on app-user auth does not open them. A project key is not an app session. No enable, apply, or deploy action is offered. App-user grant listings are not provisioned. Turning on app-user auth or access does not open them. A project key is not an app session. No enable, apply, or deploy action is offered. Keep the project key on a trusted server.

```bash
# List records
curl "https://xyvenra.com/api/data/v1/PROJECT_ID/TABLE_NAME/records?limit=50" \
  -H "Authorization: Bearer xyv_data_..."

# Create a record (read_write key)
curl -X POST "https://xyvenra.com/api/data/v1/PROJECT_ID/TABLE_NAME/records" \
  -H "Authorization: Bearer xyv_data_..." \
  -H "Content-Type: application/json" \
  -d '{"title":"Ship docs","done":false}'
```

### Mobile (available in the app; paid plans coming soon)

Open https://xyvenra.com/app/mobile. Preview an Expo starter in the phone mock, save account drafts, and download an EAS-ready project ZIP. A platform key can create a starter, list it, store env vars, and export the ZIP. Paid Mobile plans are not offered. `POST /api/platform/v1/eas` dispatches an existing workflow on the customer’s Expo project when they supply their own token, Expo project UUID, 40-character git commit, and workflow file name. The token is not stored. The starter is not uploaded. Xyvenra does not pay Expo. If that workflow starts a build, Expo bills the customer’s Expo account. Creating or exporting a starter does not dispatch anything.

### Studio (available in the app; paid plans coming soon)

Open https://xyvenra.com/app/studio. Generate and edit a multi-file browser app, load a saved starter kit without a provider call, edit preview text, link href, image alt, and inline styles, including border, radius, width, max-width, display, flex direction, wrap, justify, align, gap, opacity, and box shadow, use the page outline, undo edits in the current tab, and save a selected element as a local block in this browser, save a local site theme and a page description, language, favicon, and Open Graph title, description, and image from a local PNG, JPEG, WebP, or GIF, list missing alt text, empty buttons, and skipped headings for the open page, add bounded local PNG, JPEG, WebP, and GIF files, download a source ZIP, and send a saved page to Cloud. The preview inspector can also set line height, letter spacing, font style, text decoration, and text transform as inline styles on the selected element. A blank field leaves that value unchanged. Shared CSS is not rewritten. The preview inspector can also set position, top, right, bottom, left, z-index, overflow, min-width, min-height, max-height, flex-grow, flex-shrink, flex-basis, align-self, and order as inline styles on the selected element. A blank field leaves that value unchanged. Shared CSS is not rewritten. The preview inspector can also set a background image as an inline style on the selected element from a local PNG, JPEG, WebP, or GIF already in the project. A blank field leaves that value unchanged. Shared CSS is not rewritten. The preview inspector can also set style values for the selected element at the existing Mobile (390), Tablet (768), and Desktop (1280) preview widths. Those overrides are stored as media queries in the project stylesheet. A blank field leaves that value unchanged. Shared CSS already in the project is not rewritten. The preview inspector can also set those same style values for the selected element on hover and on focus, including a background image from a local PNG, JPEG, WebP, or GIF already in the project. Those overrides are stored as :hover and :focus rules in a marked block in the project stylesheet. A blank field leaves that value unchanged. Clear removes one hover or focus value in the marked states block, the same way it removes one value at a preview width. Shared CSS already in the project is not rewritten. The preview inspector can also set a transform, a transform origin, and a transition on the selected element. A blank field leaves that value unchanged. Shared CSS already in the project is not rewritten. The preview inspector can also set CSS Grid on the selected element, including display grid or inline-grid, template columns, template rows, template areas, auto flow, and grid placement. A blank field leaves that value unchanged. Shared CSS already in the project is not rewritten. This is not a visual IDE, device emulator, or hosted build service. A platform key can create a browser app, list it, export the source ZIP, and send the saved HTML to an owned Cloud site. Generation stays in the app. Paid Studio plans are not offered.

## Platform API and MCP

A human must sign in at https://xyvenra.com/login, then create a user-scoped platform API key at https://xyvenra.com/app/keys. Keys are shown once. Prefix: `xyv_plat_`. Platform API keys are live in production. Agents cannot complete signup or key creation in a browser.

```bash
curl https://xyvenra.com/api/platform/v1/status \
  -H "Authorization: Bearer xyv_plat_..."
```

Remote MCP: `POST https://xyvenra.com/api/mcp` with OAuth 2.1 first, or a Bearer platform API key as the fallback. `initialize`, `ping`, notifications, and list methods are public. `tools/call` returns HTTP 401 without a bearer token. Server card: https://xyvenra.com/.well-known/mcp/server-card.json. Methods: `initialize`, `tools/list`, `tools/call`. Tools:

- `create_project` — Cloud site (`product=cloud`, needs `name` and `slug`), Data project, Studio browser app, or Mobile Expo starter. Code has no server-side project.
- `list_projects` — owned rows for one of `cloud`, `data`, `studio`, `mobile`, or `code`.
- `project` — read a Cloud page, Studio source, or Mobile draft. Save replaces Studio source or a Mobile draft and does not publish a site or start an EAS build. A Mobile save requires `expectedUpdatedAt`.
- `deploy` — publish self-contained HTML to a Cloud site you own. Pass `projectId` instead of `html` to send a saved Studio page. Public env vars for that site are written into the page. Private values are not. ZIP uploads continue to use `/api/cloud/v1/{siteId}` with a Cloud deploy key. There is no server runtime.
- `export` — Studio source ZIP, Mobile Expo ZIP, or Data JSON. Does not start an EAS build.
- `env_vars` — list, set, update, or delete owner-scoped values. `exposure` is `secret` or `public`. Only public values are eligible for a Cloud page.
- `database` — list or create Data tables, delete a table, and list, query, get, create, batch-create, update, or delete records. `list_records` filters the latest 250 rows. `list_changes` polls rows updated after `since`. Field changes stay in the Data app. Project app-user auth, app-user record and file access, app-user table access, app-user record-event polls, app-user hook invocation, app-user password changes, app-user grant listings, app-user private file writes, a public storage bucket, Realtime, and Edge Functions are not provisioned. A table grant is not provisioned and is not project-wide. App-user private file writes are not provisioned and are not project-wide. Record-event polls do not open a websocket, and data-app-hook is not invoked. App-user password changes are not provisioned. Turning on app-user auth does not open them. A project key is not an app session. No enable, apply, or deploy action is offered. App-user grant listings are not provisioned. Turning on app-user auth or access does not open them. A project key is not an app session. No enable, apply, or deploy action is offered.
- `files` — list, upload, download, or delete private Data files for a project this account owns. Base64 upload, 1 MB maximum. Not a public bucket.
- `eas_dispatch` — forward one Expo workflow dispatch with the customer’s token. Not stored. Not a Xyvenra-paid build. Guidance does not call it.
- `guidance` — ask once about a real next step across sites, apps, Data, Mobile starters, and the MCP plugin. Decline turns that path off. `continue` creates only the named step and does not deploy or charge.
- `status` — Code, Cloud, Data, Mobile, and Studio for the key owner. `guidancePending` means the one-time ask has not been recorded.

Official registry name: `io.github.LAHutchins91/xyvenra`. Clients may send `Authorization: Bearer xyv_plat_...`. MCP OAuth 2.1 is implemented (protected resource metadata, authorization server metadata, dynamic client registration, PKCE S256, and a consent screen that reuses GitHub or Google sign-in). OAuth 2.1 is the primary way to connect. A platform API key remains the fallback. OAuth access tokens (`xyv_oat_`) map to the same account as platform keys. API-key bearer auth continues to work.

## CLI

Install the published `xyvenra` package from npm. After a human creates a platform API key:

```bash
npm install -g xyvenra
xyvenra login --api-key xyv_plat_...
xyvenra init static-site --dir mysite
# The CLI does not create Cloud sites. Create one first:
curl -X POST https://xyvenra.com/api/platform/v1/projects \
  -H "Authorization: Bearer xyv_plat_..." \
  -H "Content-Type: application/json" \
  -d '{"product":"cloud","name":"Launch site","slug":"launch-site"}'
xyvenra deploy --site-id SITE_ID --file mysite/index.html
xyvenra env set --product data --project-id PROJECT_ID --name PUBLIC_SITE_URL --value https://xyvenra.com/sites/launch-site
xyvenra guidance --product cloud --project-id SITE_ID
xyvenra status
```

Or run `npx xyvenra`. `XYVENRA_API_KEY`, `XYVENRA_API_URL`, and `XYVENRA_CONFIG_DIR` work today. From this repository you can still use `node packages/xyvenra/bin/xyvenra.js`.

## Starter templates

Repository folder `templates/`:

- `nextjs-app` — a small Next.js app that reads Data records. Build a static export if you want to publish through Cloud. A Node server will not run on Xyvenra Cloud today.
- `api-database` — a small API example plus a Data table schema.
- `static-site` — an `index.html` you can deploy to Cloud today.

## Pricing honesty

- Code Plus ($7/month or $70/year) and Premium ($25/month or $250/year) are the only published paid offers. Each has a 14-day trial. Checkout is open. Buy Plus with planKey forge-entry or Premium with planKey forge-advanced, and interval month or year, at /api/checkout. Seats are a little under the Cursor Plus and Premium list prices. No included model tokens. Code does not include model tokens or a usage pool.
- Cloud, Data, Mobile, and Studio paid rows in the catalog are unpublished benchmarks, not offers.
- A $0 free tier is a proposal only (`docs/FREE-TIER-PROPOSAL.md`). It is not live and no Stripe objects should be created from it until approved.