Your backend is already written
Sign-up and login, permissions, payments, real-time data, called from React, Angular or Vue, or straight from your iOS and Android app. There is no server of yours to write, deploy or pay for.
$ npm install @ulabase/kit-react Included in your plan
Everything here comes with your service, on the Free plan too.
You switch it on
Enable a feature from the console of your service and it runs at once.
Run by us
We run the servers, the updates and MongoDB. You write your app.
Checked on the server
Every request goes through your permissions on the server, whatever the client sends.
What you get
9 of these are always on. You switch on the other 7 when you need them. All of them are in the price of your service, with no add-on fee.
Free included, with no add-on fee. You pay for capacity when your app grows.
Sign up freeBuild With Any Client
One backend API, endless possibilities
Connect with the kits for React, Angular and Vue, with MCP from your agents, or with plain HTTP from anything else.
You need no SDK: fetch, axios or any HTTP client works.
Your data
REST API
Fetch, filter, sort and page your collections over HTTP
GraphQL apps
A GraphQL app is a schema and a mapping you configure, with no resolvers to write
Change streams
Your UI updates when the data does, over WebSocket or SSE
Aggregations
Pipelines defined server-side and called by name, so the client sends no query
Indexes
Keep the queries fast as the collection grows
Schemas
Turn away a document that does not match your JSON Schema
Users and access
Authentication
useAuth(): sign in, sign out, and a reload that keeps the session
Permissions
Roles and rules on the server, which the client cannot talk its way past
Sign-up and login
The whole account story, already working. Registration with email verification, Google sign-in, password reset, team invitations with roles, multi-tenancy. The screens are in the starter app and the state is in a hook, so what you write is your product.
What you get:
- useAuth() for sign-in, sign-up, reset and team switching
- Google sign-in with no OAuth code of yours
- Team invitations with role-based access, and multi-tenancy
- Email templates you can rewrite
Included in every plan, Free too
Guards
Rules of your own on top of permissions: a user who has not accepted the current terms, a lapsed subscription, a feature that is not in their plan. Each request is checked in order, and the first rule that matches blocks it or redirects it. The check lives in one place, and your screens do not repeat it.
What you get:
- Conditions over the signed-in user, their team and the request
- Block with a status code, or redirect to a page of yours
- Evaluated in order, first match wins
- Never applied to the service administrator, so you cannot lock yourself out
Included in every plan, Free too
Origin allowlist
List the origins your app is served from and a browser request from anywhere else is turned away with a 403. It is the answer to somebody else's page calling your API with your user's session. Server-to-server calls send no Origin header and are unaffected.
What you get:
- Allow only the origins your app is served from
- Everyone else’s fetch gets a 403
- Server-to-server integrations unaffected
- Edit the list at any time, with nothing to redeploy
Included in every plan, Free too
Integrations
Webhooks
Say what should happen when a request matches a condition: call an HTTP endpoint, or send a templated email. A welcome message on sign-up, a Slack message on a new order, another system kept in step: all of it runs without a backend of yours.
What you get:
- Fires on the requests you choose, matched by predicate
- Calls an endpoint, or sends an email
- Body shaped with Mustache templates
- Retries on failure, with a log of every attempt
Included in every plan, Free too
Stripe
Charge the people using your app, on your own Stripe account. Subscription plans with trials, seats and per-plan limits, or a catalogue of products with orders. The checkout session, the payment events and the refunds are handled for you.
What you get:
- usePayments() for plans, checkout and order history
- Subscriptions with trials, seats and limits, or one-off products
- Payment, refund and dispute events handled for you
- Test mode and live mode, decided by the keys you set
Included in your plan. Free runs Stripe in test mode; live payments need Starter or above
AI
Semantic search
Search your data by meaning, with the vectors in your MongoDB: the retrieval half of a RAG application. Embeddings are computed on every write with the model you choose, uploaded files are split into chunks and embedded, and the vectors stay next to the data they describe. A query searches by meaning, and reranking orders the results before they reach a model.
What you get:
- Embeddings computed on every write, with your own Voyage AI, OpenAI or Cohere key
- Uploaded files split into chunks and embedded automatically
- $vectorScan: search by meaning with no index to create
- Reranking to order results before they reach a model
Included in every plan, Free too
MCP server
Publish your service to AI agents over the Model Context Protocol. Collections, aggregations, change streams and GraphQL apps appear as MCP resources, and an agent using them goes through the same permissions as your own app, so you keep one access model. The same server lets a coding assistant set the service up, within the role you give it.
What you get:
- Collections, aggregations, change streams and GraphQL apps published as MCP resources
- Agents read and write under the same permissions as your app
- Nothing is exposed until you publish it
- Works with Claude, Cursor, VS Code and any MCP client
Included in every plan, Free too
Give your AI assistant the documentation
Add one MCP server and Claude Code, Cursor, VS Code or IntelliJ can read the whole Ulabase documentation: the API shapes, the permissions, the kit, the pricing. The code it writes for you follows the real API.
$ claude mcp add --transport http ulabase-docs https://d0c5a1.ulabase.app/mcp This server reads only our documentation. To let an agent reach your own collections, switch on the MCP server of your service.
Already wired up in the starters
Clone a starter and sign-up, teams and checkout already work: you write only your app. The Ulabase Kit is the client for everything above, for React, Angular and Vue, and each of the three has its starter.
For iOS and Android, everything above is plain HTTPS with a JWT, so Swift, Kotlin, Flutter and React Native call it the same way. The Kit itself is for the web.
When not to use Ulabase
Four cases where another tool fits better
You are not on MongoDB
RESTHeart is built for MongoDB. If your data lives in PostgreSQL or MySQL, look at Supabase or Hasura instead.
You need a protocol we do not speak
A service exposes REST, GraphQL and WebSocket. If you need another protocol, you need more control than a managed service gives.
You are optimising in microseconds
If the tuning you need is specific to your workload and measured in microseconds, a build of your own will beat a managed one.
You want the infrastructure itself
Kubernetes manifests, your own load balancers, the whole stack in your hands: then self-host the open source server.
And the rest is a plugin
Everything on this page is a RESTHeart plugin. If your product needs something that is not here, we can build it the same way, and it runs in your service. Tell us what you are missing.