{
  "schema_version": 1,
  "product": "Plurabase",
  "last_reviewed": "2026-10-26",
  "summary": "Plurabase is a multitenant platform in a private pilot. Each project gets a static frontend host (Sites) and its own backend built from Supabase's open-source services, and coding agents reach a project through a project-scoped MCP endpoint. It is not open to the public, has no prices, no SLA and no running backups, and is not approved for production or commercial use.",
  "stage": "private_pilot",
  "public_signup": false,
  "production_use": "not_approved",
  "published_pricing": null,
  "sla": null,
  "affiliation": "Independent product; not affiliated with Supabase, Inc. or Vercel Inc.",
  "technical_identifiers_note": "Some technical identifiers still use the earlier name Simplybase, for example ./__simplybase/config.json and sbm_ tokens.",
  "status_legend": {
    "available_in_pilot": "Implemented and part of the private pilot runtime. Only accounts the operator admits can use it, over the pilot's private Tailscale network. No SLA and no backups yet.",
    "in_development": "Code exists in the repository but does not serve pilot users yet. It still has to pass its native gate on a Linux VM and an end-to-end acceptance.",
    "planned": "On the delivery plan and not implemented."
  },
  "milestones": {
    "M1": "A new account gets email verification, MFA, recovery, an organization and a project without operator help.",
    "M2": "A customer connects Git and publishes a frontend connected to its backend.",
    "M3": "First paid public offer for the verified scope, including export and migration.",
    "M4": "Wider Supabase Cloud capabilities such as branching and read replicas."
  },
  "capabilities": [
    {"id": "access.pilot", "area": "Access", "name": "Private pilot access for accounts the operator admits", "status": "available_in_pilot", "note": "The pilot runs on a KVM virtual machine on a dedicated server, reachable only over Tailscale. The pilot is not open to the public."},
    {"id": "access.signup", "area": "Access", "name": "Public sign-up with email verification, TOTP MFA, password reset and recovery codes", "status": "available_in_pilot", "milestone": "M1", "note": "Uses GoTrue's native endpoints (ADR-0018). Installed on the pilot; sign-up email goes out through the operator's provider. The pilot is not open to the public."},
    {"id": "access.self-service-project", "area": "Access", "name": "Personal organization and first project without operator help", "status": "available_in_pilot", "milestone": "M1", "note": "ADR-0019. Installed on the pilot. The pilot is not open to the public."},
    {"id": "access.public-domain", "area": "Access", "name": "Console, project APIs and Sites on public domains with TLS", "status": "planned", "milestone": "M1", "note": "Needs a separate decision to expose the pilot to the internet."},
    {"id": "access.teams", "area": "Access", "name": "Organizations, projects and team roles (owner, admin, developer, read_only)", "status": "available_in_pilot", "note": "The developer role currently has the same read-only data access as read_only."},
    {"id": "projects.lifecycle", "area": "Projects", "name": "Create, pause and resume a project from the private console", "status": "available_in_pilot", "note": "One project fits on the pilot host."},
    {"id": "projects.shared", "area": "Projects", "name": "Shared plan projects: database, Auth, REST, Realtime and Storage on a host shared with other projects, administered from Studio", "status": "in_development", "note": "ADR-0033 and ADR-0034: Studio's pages, Edge Functions in one microVM per project, function logs, image transformations and database webhooks exist as code. Not run on a host and not enabled on the pilot host. Postgres, API and Auth logs, the S3 protocol and resumable uploads are not offered on shared projects: their requests get a 409 that states why (no log pipeline collects those logs for shared projects; shared Storage issues no S3 access keys and accepts only bucket and object requests)."},
    {"id": "projects.key-rotation", "area": "Projects", "name": "Rotate a project's secret key, service JWTs and Studio credential, automatically when an owner or admin loses access", "status": "in_development", "note": "ADR-0030: an owner or admin rotates from the console, and removing or demoting one rotates the projects they lost; a rotation finishes only once the retired keys are refused by the gateway, PostgREST, GoTrue and Storage. It retires the legacy anon JWT, so published Sites releases and builds that embed it stop answering until they are published again; clients using the publishable key keep working. Database passwords are not rotated. Code only: not deployed on the pilot host."},
    {"id": "database.postgres", "area": "Database", "name": "Dedicated PostgreSQL 17.6 per project (supabase/postgres image)", "status": "available_in_pilot", "note": "No direct database connections from outside the host."},
    {"id": "database.rest", "area": "Database", "name": "REST and RPC API (PostgREST v14.17) with Row Level Security", "status": "available_in_pilot", "note": "Exercised with @supabase/supabase-js v2."},
    {"id": "database.studio", "area": "Database", "name": "Supabase Studio for each project, opened from the Plurabase console", "status": "available_in_pilot", "note": "Built from Supabase's source with Plurabase changes, not the upstream image. Owners and admins only; Studio has administrative authority over the project and bypasses RLS."},
    {"id": "database.branching", "area": "Database", "name": "Database branching and read replicas", "status": "planned", "milestone": "M4", "note": "Not implemented."},
    {"id": "database.pitr", "area": "Database", "name": "Point-in-time recovery", "status": "in_development", "note": "ADR-0031: continuous WAL archiving off the host, weekly base backups and a restore drill to a chosen moment exist as code. Not enabled on the pilot host, which runs no backups."},
    {"id": "auth.email-password", "area": "Auth", "name": "Email and password sign-up and sign-in for your application's users (GoTrue v2.196.0)", "status": "available_in_pilot", "note": "Emails to your application's users are not delivered outside the pilot host."},
    {"id": "auth.providers", "area": "Auth", "name": "OAuth providers, custom SMTP, phone OTP and SAML SSO for your application's users", "status": "planned", "note": "Not configured or tested."},
    {"id": "storage.buckets", "area": "Storage", "name": "Storage buckets with RLS policies and signed URLs", "status": "available_in_pilot", "note": "S3 protocol access and image transformations have not been verified."},
    {"id": "realtime.changes", "area": "Realtime", "name": "Realtime Postgres Changes over WebSocket", "status": "available_in_pilot", "note": "Broadcast and Presence have not been verified."},
    {"id": "functions.edge", "area": "Functions", "name": "Edge Functions on supabase/edge-runtime with encrypted secrets", "status": "available_in_pilot", "note": "Imports are limited to local files and pinned versions of @supabase/supabase-js v2 and @supabase/server; remote npm and jsr imports are not downloaded. Runs on the pilot host, not on a global edge network."},
    {"id": "sites.zip", "area": "Sites", "name": "Static frontend hosting from a prebuilt ZIP, bound to the project, with rollback", "status": "available_in_pilot", "note": "Enabled per project by the operator. 4 MiB ZIP, 16 MiB expanded, two uploads per Site in its lifetime. Each release is served under its own path with a Content Security Policy that blocks inline scripts and styles, so builds need relative asset URLs; Next.js static export and Astro output are not supported. The page runs in a sandbox without form submission, dialogs, popups or downloads, and its browser requests reach only the release and the project API."},
    {"id": "sites.git", "area": "Sites", "name": "Deploy a frontend from a GitHub repository on every push", "status": "in_development", "milestone": "M2", "note": "GitHub App connection and isolated builds exist as code. Not activated."},
    {"id": "sites.every-project", "area": "Sites", "name": "A Site for every project, each on its own origin, with per-plan upload limits instead of a lifetime upload count", "status": "in_development", "milestone": "M2", "note": "ADR-0037. Source-checked only; no host is enrolled. On the private network each Site gets its own port, keeps today's sandboxed policy and is for the operator's own organizations only. On a public sites domain each Site gets its own origin (s-<id>.<domain>) with storage, cookies, forms and an allowlist the owner sets through the get_site_policy and set_site_policy commands (no console screen yet). Still blocked there: inline event handlers, javascript: URLs, eval, new Function, WebAssembly compilation and service workers; a page over 1 MiB, with more than 64 script elements or with comment syntax around or inside a script runs none of its inline scripts. Until the sites domain is on the Public Suffix List any Site can read cookies another sets with Domain=, so only the operator's organizations get public Sites until then. The public edge is off until DNS and exposure are approved, and public Sites cannot reach their project API yet because project APIs are private."},
    {"id": "sites.domains", "area": "Sites", "name": "Custom domains with automatic TLS", "status": "in_development", "milestone": "M2", "note": "DNS TXT proof (ADR-0024) and serving through the public Sites edge (ADR-0037) exist as code. The edge is not enabled anywhere. Only a published Site gets a certificate. Each organization gets at most its plan's weekly number of new Site hostnames, and while the sites domain is not yet on the Public Suffix List the host approves at most 40 new Site hostnames a week in total. Custom domains do not count against either."},
    {"id": "sites.previews", "area": "Sites", "name": "Preview deployments", "status": "planned", "milestone": "M2", "note": "Not implemented."},
    {"id": "agents.mcp", "area": "Agents", "name": "Project-scoped MCP server over Streamable HTTP (13 tools, operation_id on writes)", "status": "available_in_pilot", "note": "Bearer token created in the console, valid 24 hours or 7 days. Reachable only over Tailscale."},
    {"id": "agents.tokens", "area": "Agents", "name": "Agent tokens a signed-in customer creates for chosen projects and tools, with a per-project MCP endpoint", "status": "in_development", "milestone": "M1", "note": "ADR-0029: tokens bound to one organization and the chosen projects, with an expiry of up to 90 days; each call gets the token's scopes intersected with the creator's current role, and leaving the organization or losing a project revokes the token. An OpenAPI 3.1 document of the customer routes is served with them. Code only: not enabled on the pilot host."},
    {"id": "agents.mcp-oauth", "area": "Agents", "name": "Remote MCP with OAuth sign-in for hosted agents", "status": "planned", "note": "Not implemented."},
    {"id": "platform.api", "area": "Agents", "name": "Management API with personal access tokens (OpenAPI 3.0.3)", "status": "available_in_pilot", "note": "Private network only."},
    {"id": "ops.backups", "area": "Operations", "name": "Daily encrypted off-host backups, restore drill and dead-man alerts", "status": "in_development", "note": "ADR-0020; an operations health observer with its own external dead-man check is code too (ADR-0031). The pilot has no backups today."},
    {"id": "ops.export", "area": "Operations", "name": "Self-service export of a project's database, Storage objects and functions", "status": "in_development", "milestone": "M3", "note": "ADR-0025. An owner or admin's export, encrypted with age so that only the requester can decrypt it, downloaded once through a short-lived link, with an import tool for self-hosted Supabase, exists as code. No console button yet and not enabled on the pilot host. Ask the operator meanwhile."},
    {"id": "ops.migration", "area": "Operations", "name": "Migration from Supabase: database, Auth users, Storage and Edge Functions", "status": "in_development", "milestone": "M3", "note": "Migration jobs exist as code (ADR-0026): a preflight report, the copy, a verification of row checksums, objects and functions, and a reset of the target; also a plan that says whether a Vercel frontend can move to Sites. They are not deployed and have not run against a real Supabase project, so during the pilot a move is done with the operator and cutover is manual."},
    {"id": "billing.plans", "area": "Billing", "name": "Plans, pricing and billing", "status": "in_development", "milestone": "M3", "note": "ADR-0028: checkout, a customer portal, invoices and dunning on Stripe's test mode exist as code, and so do monthly usage metering and per-organization plan limits for Sites, builds, database and Storage (ADR-0027). No prices or plan limits are set, no Stripe account or key exists, no host runs either and nothing is charged."}
  ],
  "not_offered": [
    "General availability or public sign-up",
    "An SLA, uptime commitment or support commitment",
    "Published prices or paid plans",
    "Approval for production or customer data",
    "Full Supabase Cloud parity, the Supabase Management API or the Supabase CLI",
    "Server-side rendering, Node.js servers, Next.js Server Actions or ISR in Sites (deferred, not scheduled)",
    "A global CDN or multi-region hosting",
    "SOC 2, HIPAA or any other compliance certification",
    "A Plurabase CLI"
  ]
}