AI agents, config-as-code and Feature Flags

Tools that let coding assistants and DevOps teams work with HostBase without clicking through the dashboard.

Agents: init, skills, MCP

hostbase init --with-config          # AGENTS.md + CLAUDE.md (+ .cursor/rules) + hostbase.config.ts
hostbase skills install              # SKILL.md for Claude Code, a Cursor rule, a managed block in AGENTS.md for Codex
hostbase mcp install                 # .mcp.json, .cursor/mcp.json and ~/.codex/config.toml
hostbase plugins install --client claude-code --global

Files are merged non-destructively: existing MCP servers and anything outside the hostbase:begin/end block are left alone, and re-running changes nothing (--dry-run previews).

MCP with OAuth 2.1

The /api/mcp server accepts a hb_pat_… token or an OAuth hb_oat_… token. MCP clients discover authorization on their own: /.well-known/oauth-protected-resource (RFC 9728), /.well-known/oauth-authorization-server (RFC 8414), dynamic client registration at POST /api/oauth/register (RFC 7591), authorization code flow with mandatory PKCE S256, refresh token rotation with reuse detection, and POST /api/oauth/revoke (RFC 7009). You pick scopes (for example projects:read, db:write, functions:deploy, flags:write) on the consent screen; tools outside the granted scopes are hidden from the client.

Diagnostics

hostbase inspect db all              # 14 read-only checks
hostbase inspect db unused-indexes
hostbase diff main feature-x --sql   # schema diff between branches
hostbase snapshots                   # backups + PITR
hostbase api GET /projects --jq .[0].ref
hostbase profile add staging --token hb_pat_… --api-url https://…

Config as code

hostbase.config.ts declares function settings (verify JWT, cron schedules), worker replicas, autoscaling, network restrictions, API rate limits, domains, secrets and Feature Flags. hostbase config plan shows the diff (secret values are never printed), config apply applies it and config pull generates the file from the current state. Only the sections present in the file are managed; --prune also deletes undeclared flags and schedules.

POST /api/v1/projects/{ref}/config/plan    { "config": {…}, "prune": false }
POST /api/v1/projects/{ref}/config/apply
GET  /api/v1/projects/{ref}/config/export

Feature Flags

Dashboard → project → Feature Flags: boolean, string, number and JSON flags with variants, attribute rules (eq, in, contains, gte…), percentage rollouts (sticky bucketing by targetingKey) and separate production, staging and development environments.

POST https://host.ulewicz.space/api/public/flags/{ref}/evaluate
x-hostbase-flags-key: hbff_prod_…
{"context": {"targetingKey": "user-42", "plan": "pro"}}

import { OpenFeature } from "@openfeature/server-sdk";
import { HostbaseProvider } from "@hostbase/openfeature-provider";
await OpenFeature.setProviderAndWait(new HostbaseProvider({ projectRef, sdkKey }));

Management API: GET|POST /projects/{ref}/flags, GET|PUT|DELETE /projects/{ref}/flags/{key}. MCP tools: list_feature_flags, get_feature_flag, set_feature_flag, config_plan, config_apply.

Terraform / OpenTofu

A provider skeleton (hostbase_project, hostbase_function, hostbase_secret) lives in the repository under terraform-provider-hostbase/.