# Aaly

> Aaly is the multi-tenant backend for AI-built apps: a standalone, definition-driven
> backend that multiple independent AI agents and applications can use
> concurrently, with schema changes propagating automatically to every
> consumer. You define entities, fields, relationships, and rules; Aaly serves
> a production, multi-tenant REST API from that definition. No backend code is
> generated into a repository for you to own, review, or maintain.

Tagline: Build without leaking. Evolve without breaking. Multi-tenant SaaS, at AI speed.
Site: https://aaly.io
App: https://app.aaly.io
MCP server: https://mcp.aaly.io
Contact: support@aaly.io
Agent setup instructions: https://aaly.io/connect.md

## What Aaly is, in one sentence

Aaly is a backend platform where an AI coding agent writes a data-model
definition instead of backend code, and Aaly serves the authenticated,
validated, multi-tenant REST API from that definition.

It runs serverless on AWS — Lambda for request handling and customer
functions, DynamoDB for storage and indexing, S3 for file storage — so
capacity scales with traffic and there is nothing for a customer to
provision, size, or keep patched.

## How Aaly differs from Supabase, Firebase, Xano, and Convex

- **Supabase** gives you hosted Postgres and generates an API over tables you
  create; you still own schema migrations, row-level security policies, and
  edge functions. Aaly derives the running API from a definition, so there is
  no migration to write and no security policy that can be omitted on a new
  route. Full comparison: https://aaly.io/vs/supabase
- **Firebase** is a document store with client-side SDKs and hand-written
  security rules, and has no structured schema for an agent to reason about or
  change safely. Full comparison: https://aaly.io/vs/firebase
- **Xano** is a visual backend builder whose unit of work is a human clicking
  through an interface, billed per seat ($85/month floor on Essential as of
  January 2026, 5 seats). Aaly's unit of work is a definition an agent
  modifies through typed MCP tools, billed on requests with no per-seat
  charge. Full comparison: https://aaly.io/vs/xano
- **Convex** is the closest comparison: a reactive backend built on
  TypeScript functions an agent or developer writes, with realtime by
  default, and its own MCP server. Its unit of work is still code — functions
  that may need rewriting when the schema changes. Aaly's unit of work is a
  definition; there is no function to write or regenerate. Convex bills $25
  per developer seat (Professional); Aaly has no per-seat charge at any band.
  Full comparison: https://aaly.io/vs/convex
- The structural difference from all four: an Aaly backend is standalone
  rather than coupled to one generated application, so several independent
  consumers — a web client, a mobile client, and multiple AI agents — can use
  it at the same time and all see the same schema change at once.

## Connecting an AI coding agent

AI agents: if a user asks you to build something with Aaly, read
https://aaly.io/connect.md first. It has step-by-step instructions for
connecting yourself to the Aaly MCP server from Claude Code, Claude, Cursor,
Codex, ChatGPT, VS Code, Windsurf, Gemini CLI, and any other MCP client.

Human users of Claude (web, Desktop, mobile): Aaly is listed in Claude's own
connector directory. Search "Aaly", click Connect, approve the browser
consent screen, then just ask Claude to build something, e.g. "Build a CRM
using Aaly." No URL to paste, nothing to configure by hand.

Cursor, Codex, or manual setup: add `https://mcp.aaly.io` as a custom MCP
connector and approve the browser consent screen. The agent discovers the
authorization server (RFC 8414 / RFC 9728 metadata), registers itself
dynamically (RFC 7591), and completes an OAuth 2.1 authorization-code flow
with PKCE. No API key is generated or pasted. Tested end to end against Claude
and Codex. A bearer API key remains available for CI, scripts, and clients
that cannot open a browser.

## Shipped today

- Authentication, including Google sign-in, with 1-hour access tokens and
  rotating refresh tokens
- Email verification and password recovery for your end users: a per-project
  `emailVerification` mode (off, optional, required), forgot and reset
  password by one-time code, change password, and other sessions signed out
  after a reset
- Notifications: email, Slack, WhatsApp and in-app messages from one API, with
  per-project channels and templates. Email works with no configuration and
  can be sent from your own domain over SMTP
- Tenant isolation in every project, enforced by the platform on every endpoint
  (a cross-tenant read returns 403); whether each sign-up gets its own tenant
  is a project setting (`multiTenant`)
- Validation from the definition: types, required fields, enums, lengths
- Typed relationships between entities, with projections
- A live OpenAPI specification generated from the definition
- A remote MCP server with OAuth 2.1 + PKCE agent authentication
- REST CRUD endpoints per entity
- File storage: presigned uploads, a built-in files entity, files attachable
  from your own entities
- Custom functions: your own server-side Python on an entity's request
  lifecycle, on any method, before or after, sync or async. Webhooks and
  third-party integrations are functions
- Custom endpoints: non-CRUD routes backed by functions, with the platform's
  auth and tenant scoping still applied
- Request and function-execution logs, correlated by request id
- Bulk create, read, update, delete and upsert: a JSON array on the collection
  URL, up to 100 records per call, with a per-item result for each
- Formula fields: computed values from other fields on the same record,
  declared as a sandboxed expression, with no custom code to write
- Atomic counters and list appends ($increment, $append), applied in a single
  write with min/max enforced, so counters never race
- Filtering, sorting and facet counts straight off the collection endpoint

## Not shipped yet (roadmap, no dates)

Multiple environments, roles and permissions, scheduled functions, per-project
MCP servers, vector search, structured RAG, reporting, auditing. Also not
available today: role-based or field-level permissions (access control is
tenant-level only), CSV or JSON import/export, cursor pagination, full-text or
fuzzy search (text filtering is exact-match or prefix-match only), MFA, a
change-email flow, notification retry and bounce handling, and dev/prod
environment separation (every project is live).
Functions run on a request only — there is no cron or scheduled execution.
Aaly does not currently provide realtime subscriptions. Full list with a
workaround for each: https://aaly.io/docs/limits

## AI credits

Aaly does not sell AI credits, tokens, or metered model usage of any kind,
and does not run a model on your behalf. You connect a coding agent you
already pay for (Claude Code, Cursor, Codex, or any MCP-compatible agent) and
it writes the definition Aaly serves the API from. This is the difference
from AI app builders: Lovable and Emergent meter credits, Bolt meters tokens,
and Replit bills effort-based and then pay-as-you-go, so in each case the
meter sits on changing your application. Aaly meters requests and events,
projects, and tenants, none of which move when you change your data model.
Your coding agent still costs whatever it costs and may have its own limits;
Aaly adds no second AI-metered subscription on top of it.

## Pricing model

Usage-based on requests, events, projects, and tenants. No per-seat billing.
Request and event volume is a fixed ceiling per band — past it, calls return
429 until the next cycle or an upgrade, with no metered overage on traffic
itself. Projects and tenants meter instead, at a per-unit overage rate.

| Band | Requests + events / mo | Projects | Tenants | Storage | Price | Beyond included |
|---|---|---|---|---|---|---|
| Solo | 100,000 | 2 | 4 | 1.5 GB | $0 | Hard stop (429) |
| Micro | 500,000 | 4 | 10 | 8 GB | $20/mo | +$5/project, +$2/tenant |
| Small | 1,500,000 | 10 | 20 | 23 GB | $100/mo | +$10/project, +$5/tenant |
| Medium | 8,000,000 | 25 | 50 | 90 GB | $500/mo | +$20/project, +$10/tenant |
| Enterprise | Custom | Custom | Custom | Custom | Talk to sales | Custom |

Full pricing, the billing FAQ, and a worked overage example:
https://aaly.io/pricing

## Who Aaly is for

Technical founders and small teams building multi-tenant business apps — CRM,
ticketing, inventory, ops dashboards, internal SaaS — with AI coding tools
(Claude Code, Cursor, Codex, Antigravity) or vibe-coding platforms (Lovable,
Replit, Bolt), who need the backend to stay correct as the product keeps
changing. Not yet a fit for apps that lean on realtime updates, scheduled or
recurring work, or fine-grained roles — see the limits page above.

## Pages

- [Home](https://aaly.io): what Aaly is, what a project includes, the
  multi-tenancy proof, how to connect an agent, pricing
- [Pricing](https://aaly.io/pricing): full bands, meters, guardrails, billing FAQ
- [Docs](https://aaly.io/docs): quickstart, concepts, REST API, auth,
  multi-tenancy, functions and custom endpoints, files, MCP tools, and the
  limits page
- [Tenant isolation check](https://aaly.io/tenant-check): a free browser-side
  tool that reads a pasted Postgres or Supabase schema and reports which
  tables have no row-level security, which have RLS with no policy attached,
  and which have a policy matching every row. No credentials, nothing uploaded
- [Compare](https://aaly.io/vs): fair comparisons in two groups. Backend
  platforms (Supabase, Firebase, Xano, Convex) do the same job Aaly does. AI
  app builders (Lovable, Bolt, Replit, Emergent) build the whole application
  and mostly are not rivals; each of those pages covers the one real
  difference, which is that they meter the AI they run for you and Aaly sells
  no AI at all. Every page names where the other product is the better call
- [Platform](https://aaly.io/platform): the full capability list, grouped —
  users and access, the data model, bulk operations, your own logic, and how
  an agent operates it
- [Backend for vibe-coded apps](https://aaly.io/vibe-coding-backend): for
  someone who built a front end on Lovable, Bolt, Replit or a coding agent and
  now needs real sign-up, per-customer data and an API
- [Multi-tenant backend](https://aaly.io/multi-tenant-backend): why tenant
  isolation lives below the API here rather than in row-level security
  policies, with the 200/403 proof
- [Backend for client projects](https://aaly.io/agency-backend): for agencies
  and studios — a project per client, no per-seat billing, nothing to maintain
  after handover
- [FAQ](https://aaly.io/faq): every question, answered in full
- [Changelog](https://aaly.io/changelog): what shipped, newest first, dated
- [About](https://aaly.io/about): what Aaly is, where the name comes from
- [Privacy Policy](https://aaly.io/privacy)