Plurabase facts
Reviewed on 2026-10-26. This page is the reference for what Plurabase does today. The same data is published as /facts.json.
In one paragraph
Plurabase is a multitenant platform that gives each project a static frontend host (Sites) and its own backend built from Supabase's open-source services: PostgreSQL 17.6, Auth (GoTrue), a REST API (PostgREST), Realtime, Storage and Edge Functions. Coding agents connect to a project through a project-scoped MCP endpoint. Plurabase is in a private pilot: it is not open to the public, has no prices, no SLA and no running backups, and it is not approved for production data. It is independent and not affiliated with Supabase, Inc. or Vercel Inc.
Status words
| Status | Meaning |
|---|---|
| Available in pilot | Implemented and part of the private pilot runtime. Only accounts the operator admits can use it, over the pilot's private Tailscale network. No SLA and no backups yet. |
| In development | Code exists in the repository but does not serve pilot users yet. It still has to pass its native gate on a Linux VM and an end-to-end acceptance. |
| Planned | On the delivery plan and not implemented. |
Capabilities
| ID | Capability | Status | Notes |
|---|---|---|---|
access.pilot | Private pilot access for accounts the operator admits | Available in pilot | A KVM virtual machine on a dedicated server, reachable only over Tailscale. The pilot is not open to the public. |
access.signup | Public sign-up with email verification, TOTP MFA, password reset and recovery codes | Available in pilot | Milestone M1. Installed on the pilot; sign-up email goes out through the operator's provider. The pilot is not open to the public. |
access.self-service-project | Personal organization and first project without operator help | Available in pilot | Milestone M1. Installed on the pilot. The pilot is not open to the public. |
access.public-domain | Console, project APIs and Sites on public domains with TLS | Planned | Needs a separate decision to expose the pilot. |
access.teams | Organizations, projects and team roles (owner, admin, developer, read_only) | Available in pilot | The developer role currently has read-only data access. |
projects.lifecycle | Create, pause and resume a project from the private console | Available in pilot | One project fits on the pilot host. |
projects.shared | Shared plan projects, administered from Studio | In development | Code only, not run on a host. Postgres, API and Auth logs, the S3 protocol and resumable uploads are refused with a 409 that states why. |
projects.key-rotation | Rotate a project's secret key, service JWTs and Studio credential, automatically when an owner or admin loses access | In development | Finishes only once the old keys are refused. Retires the legacy anon JWT: republish Sites releases that embed it. Code only: not deployed on the pilot host. |
database.postgres | Dedicated PostgreSQL 17.6 per project | Available in pilot | No direct connections from outside the host. |
database.rest | REST and RPC API (PostgREST v14.17) with Row Level Security | Available in pilot | Exercised with @supabase/supabase-js v2. |
database.studio | Supabase Studio for each project | Available in pilot | Owners and admins only. Administrative: bypasses RLS. |
database.branching | Database branching and read replicas | Planned | Milestone M4. |
database.pitr | Point-in-time recovery | In development | WAL archiving, weekly base backups and a restore drill exist as code (ADR-0031). Not enabled on the pilot host. |
auth.email-password | Email and password Auth for your application's users | Available in pilot | Emails to your users are not delivered outside the pilot host. |
auth.providers | OAuth providers, custom SMTP, phone OTP and SAML SSO for your users | Planned | Not configured or tested. |
storage.buckets | Storage buckets with RLS policies and signed URLs | Available in pilot | S3 protocol and image transformations not verified. |
realtime.changes | Realtime Postgres Changes | Available in pilot | Broadcast and Presence not verified. |
functions.edge | Edge Functions with encrypted secrets | Available in pilot | Local imports and pinned supabase-js v2 and @supabase/server only. One host, no global edge. |
sites.zip | Static frontend hosting from a prebuilt ZIP, with rollback | Available in pilot | Enabled per project by the operator. Builds need relative asset URLs and no inline scripts or styles. |
sites.git | Deploy a frontend from GitHub on every push | In development | Milestone M2. Not activated. |
sites.every-project | A Site for every project, each on its own origin, with per-plan upload limits | In development | Milestone M2. ADR-0037; no host enrolled. Until the Public Suffix List lists the sites domain, public Sites are for the operator's organizations only. Public Sites cannot reach their project API yet. |
sites.domains | Custom domains with automatic TLS | In development | Milestone M2. Serving code exists; the public edge is off. Certificates only for published Sites, within weekly limits. |
sites.previews | Preview deployments | Planned | Milestone M2. |
agents.mcp | Project-scoped MCP server over Streamable HTTP | Available in pilot | 13 tools. Token valid 24 hours or 7 days. |
agents.tokens | Agent tokens a signed-in customer creates for chosen projects and tools, with a per-project MCP endpoint | In development | Milestone M1. Expiring, scoped to the creator's role at each call, revoked when the creator loses access; with an OpenAPI 3.1 document of the customer routes. Code only: not enabled on the pilot host. |
agents.mcp-oauth | Remote MCP with OAuth sign-in for hosted agents | Planned | Not implemented. |
platform.api | Management API with personal access tokens | Available in pilot | Private network only. |
ops.backups | Daily encrypted off-host backups, restore drill and alerts | In development | The pilot has no backups today. An operations health observer with its own alert check is code too. |
ops.export | Self-service export of a project | In development | Milestone M3. Code only: no console button, not enabled on the pilot host. Ask the operator meanwhile. |
ops.migration | Migration from Supabase: database, Auth users, Storage and Edge Functions | In development | Milestone M3. Migration jobs exist as code, not deployed; the operator moves projects today. |
billing.plans | Plans, pricing and billing | In development | Milestone M3. Billing on Stripe's test mode (ADR-0028) and usage metering with per-organization plan limits (ADR-0027) exist as code; no prices or limits are set, no host runs them and nothing is charged. |
Milestones come from the delivery plan: M1 is a new account with MFA, recovery, organization and project without operator help; M2 is Git-connected frontends; M3 is the first paid offer, including export and migration; M4 widens Supabase Cloud capabilities. No milestone has a published date.
Pilot limits
- One project fits on the pilot host. A project runs in a 2 vCPU, 3 GiB memory slice with a 4 GiB data volume. Full volumes refuse writes; nothing grows automatically.
- Sites: 4 MiB ZIP, 16 MiB expanded, two uploads per Site in its lifetime (failed uploads count) and two retained releases.
- Agent tokens: one project each, valid 24 hours or 7 days, revocable at any time.
- MCP: SQL up to 32,768 characters per call; a function upload holds up to 24 files and 256 KiB.
What Plurabase does not offer
- General availability or public sign-up
- An SLA, uptime commitment or support commitment
- Published prices or paid plans
- Approval for production or customer data
- Full Supabase Cloud parity, the Supabase Management API or the Supabase CLI
- Server-side rendering, Node.js servers, Next.js Server Actions or ISR in Sites (deferred, not scheduled)
- A global CDN or multi-region hosting
- SOC 2, HIPAA or any other compliance certification
- A Plurabase CLI
Frequently asked questions
Is Plurabase generally available?
No. Plurabase is in a private pilot that runs on a KVM virtual machine on a dedicated server, reachable only over a private Tailscale network. An internal static review on 2026-10-18, in which no code was executed, rated it not ready for public or commercial use.
Can I sign up for Plurabase?
Not yet. Sign-up with email verification, MFA and account recovery is installed on the pilot, and its email goes out through the operator's provider, but the pilot is not open to the public. The operator admits every account and adds its device to the private Tailscale network.
How much does Plurabase cost?
Plurabase has no published prices and charges nothing during the pilot. Billing on Stripe's test mode exists as code, but no host runs it and no prices are set in it. A first paid offer is milestone M3, after costs are measured. See pricing and limits.
Is Plurabase a replacement for Supabase?
No. Each project runs the same open-source services as self-hosted Supabase, so @supabase/supabase-js v2 works against it, but Supabase Cloud's managed features (backups, point-in-time recovery, branching, read replicas, global Edge Functions, the Management API and CLI) are not available. See Plurabase vs Supabase and Vercel.
Is Plurabase an alternative to Vercel?
Only for static frontends. Sites serves a prebuilt static site from a ZIP, and the build needs relative asset URLs and no inline scripts, so Next.js static export is not supported. It has no server-side rendering, no Git deploys yet, no previews, no custom domains and no global CDN.
Can AI coding agents use Plurabase?
Yes, inside the pilot. Each project has an MCP endpoint over Streamable HTTP with 13 tools for schema, SQL, migrations, RLS policies and Edge Functions. Tokens are bound to one project and expire in 24 hours or 7 days. See the agent quickstart.
Is my data backed up?
No. The pilot has no backups today. Daily encrypted off-host backups with a restore drill are in development. Do not store data in the pilot that you cannot lose.
Can I deploy from Git?
Not yet. Git deploys from GitHub are in development. Today a person uploads a prebuilt ZIP in the console.
Can I use my own domain?
No. Custom domains are planned. During the pilot every surface is served on a private Tailscale hostname.
How do I move my data out of Plurabase?
There is no self-service export you can use yet. One exists as code (an archive encrypted with age that only the person who requested it can decrypt, downloaded once through a link), but it has no console button and is not enabled on the pilot host. Data is kept in standard PostgreSQL 17 and Supabase Storage formats, and during the pilot an export is a manual task for the operator. See migration in and out.