Toft

Self-hosted app platform

Hand-written or agent-built.Live behind your sign-in.

Every Git push redeploys. Or ship a working tree with the toft CLI, skills for your coding agent included. Python, R, Node, Go and notebooks, on your own infrastructure.

Try the playground Install Toft
A deploy in three steps: your code, the build, and an address behind your sign-in.
01Source

github.com/acme/orders

Redeploys on every push

or from a working tree

toft deploy

02Build

Framework detected

Dependencies checked

03ServeRunning

apps.example.com/orders/

Behind your sign-in

01

Languages and frameworks

Toft reads the project and picks the build. You don’t write a Dockerfile or a config file.

LanguageWhat it buildsClient library
  • PythonSDK
    • Flask
    • FastAPI
    • Streamlit

    Any other Python app

  • NodeSDK
    • Next.js

    Any other Node app

  • GoSDK

    Any Go service

  • RSDK
    • Shiny
    • plumber
    • R Markdown
    • Quarto

    Other R projects aren’t built

  • Notebooks—
    • marimo

    Jupyter and Quarto documents, re-run when you deploy

  • Static—

    A folder of HTML, served as it is

If your project already builds to static HTML, as Vite, Astro, SvelteKit, Hugo, Eleventy, Create React App do, tell Toft which folder the output goes to and it serves the files.

02

Built for coding agents

The build runs on the install, so an agent needs only your source and the toft binary. No language toolchain on the machine it works on.

# teach your agent once
toft skill toft-cli > ~/.claude/skills/toft-cli/SKILL.md
toft skill toft-sdk > ~/.claude/skills/toft-sdk/SKILL.md

# then the loop it runs on its own
toft create --yes --link   # claim an address, deploy, write toft.toml
toft deploy                # ship the working tree again
toft logs                  # read what the app said
  • Skills included

    toft-cli covers the deploy loop and toft-sdk covers writing the app. toft skill prints the copy written for your version, for Claude Code, Codex, Cursor or any agent that reads the Agent Skills format.

  • No browser needed

    An agent signs in with a personal API key or a deploy key that an administrator scopes. A person approves a device once in the browser.

  • Readable results

    Every command can answer in JSON with a documented exit code, and a refused deploy says what to fix.

03

Included with every app

No extra services to install or pay for.

  • Git push to deploy

    Connect a repository and a branch, and every push ships. The new version goes live with no downtime, and a failed build leaves the old one serving.

  • Scheduled and background jobs

    Run a report every night, or start long work from inside an app. Each run is logged.

  • Storage

    An administrator attaches a file share or an S3 bucket. The app sees a folder and never handles the credentials.

  • A CLI and SDKs

    Deploy from a terminal, uncommitted changes included. SDKs for Python, Node, Go and R cover jobs, storage and messages.

04

Integrations

An administrator sets up each connection once and chooses which apps can use it. Apps send through Toft and never see the credential.

  • Messages
    • Slack
    • Microsoft Teams
    • Microsoft Teams (bot)
    • Google Chat
    • Discord
    • Email
  • Files
    • SharePoint
    • OneDrive
    • Google Drive
  • Alerts and webhooks
    • PagerDuty
    • Signed webhook

05

Where it runs

Toft is one binary in one image. It runs wherever containers do, with a Postgres database and your identity provider.

  • Runs on

    Any container runtime: Docker Compose on a single server, Kubernetes through a Helm chart, Amazon ECS and EKS, and Azure AKS. On Kubernetes an app can run in its own pod, with network policy around it.

  • App storage

    EFS, Azure Files or any S3-compatible bucket.

  • Offline

    An install needs no internet, no vendor service and no third-party account. Anything that reaches out is an optional capability an administrator turns on.

  • Sign-in

    Any OpenID Connect provider, including Okta, Microsoft Entra ID, Auth0, Keycloak, Ping and OneLogin.

06

For your security review

What an administrator or auditor can check for themselves.

  • Access is set per app

    Each app is open to named people, to groups, to everyone signed in, or to the public if an administrator allows it.

  • Dependencies are checked

    Every build is checked against published advisories, and running apps are checked again. One inventory covers every app.

  • Audit-ready reports

    A NIST SP 800-171 control document as a PDF, and an audit report read live from the install and exported with a digest and a date.

  • Changes are recorded

    Sign-ins, access changes and administrator actions go to an audit log.

07

Get started

Try it on the playground first, or put it on a server of your own.

  • Playground

    A shared Toft to try things on. Deploy an app, open it, share it. Don’t put anything private there.

    trytoft.dev

  • One server

    Linux on x86_64 or arm64, 4 GB of RAM and 20 GB free. The script checks the machine first, offers to install Docker if it’s missing, and prints the administrator’s password once.

    curl -fsSL https://raw.githubusercontent.com/larchway-labs/toft-install/main/install.sh | sh

    The one-box install

  • Kubernetes

    A Helm chart, with setups for Amazon EKS and ECS and Azure AKS in the administrator’s guide.

    Install options

  • The CLI

    Linux and macOS; Windows has its own download. Then toft login with your install’s address, and toft create in your app’s folder.

    curl -fsSL https://raw.githubusercontent.com/larchway-labs/toft-cli/main/install.sh | sh

    Deploy your first app

See it running.

The playground is a real Toft. Deploy something and open it at its own address.

Try the playground Read the docs