Features

Everything Tessryx can do

This is the full list of what Tessryx can do, each with a link to its docs. Flip the switch in the toolbar to see the settings and limits behind each one. Things it can't do are listed at the bottom, in case you're checking.

All features

112 features

Building with your AI Data and content Editors and forms Media and files Pages and APIs Workflows AI inside your app Schedules Integrations and secrets Sign-in and access Domains and hosting Versions and safety Runs, usage and billing Team and account What it doesn't do

Building with your AI

You bring the AI. Tessryx connects to it over MCP, and you choose the workspace it can build in.

Build with Claude, ChatGPT or any MCP client
Tessryx runs an MCP server, the standard way AI assistants connect to outside tools. Add it to the assistant you use and it can build in your workspace while you talk to it, from the data model through to the pages.
protocol
MCP over Streamable HTTP at https://mcp.tessryx.io, with OAuth 2.1: authorization code with PKCE, dynamic client registration (RFC 7591) and protected-resource metadata (RFC 9728).
clients
One-click for Claude and ChatGPT; install links for Cursor, VS Code and Goose; a command for Claude Code; a config block for Windsurf, Cline and the rest; a walkthrough for Grok.
tools
93 tools, each with a title and read-only or destructive hints.
Read more Docs
How it works
- Pick a workspace when you connect
- It works with your role

Your AI runs and checks what it builds
Your AI can make and change anything in your workspace and publish it. When something it built fails, it can run it again and read the error itself.
per kind
create, create_version, update, publish, unpublish, get, list and delete for schemas, records, workflows, integrations, endpoints, schedules and apps.
precise edits
patch_workflow and patch_datafile change one step, field or list item without resending the whole definition.
check and run
validate_workflow, preview_dynamic_endpoint, run_workflow, execute_api_template, run_schedule_now, and run histories with step traces.
look around
get_resource_graph, analyze_resource, list_assets, list_secrets (names only) and whoami.
Guides written for your AI
Tessryx gives your AI short guides on how the pieces fit together, plus recipes for common builds like a blog, and it reads them before it starts building.
list_guides / get_guide
13 topics: overview, authoring, build-a-page, build-a-blog, schemas, datafiles, workflows, endpoints, api-templates, schedules, apps, custom-domains and dependencies.
definition schemas
Every kind's own JSON Schema is one call away, so what the AI writes is checked against the platform's real format.
You approve which workspace it uses
When you connect, a Tessryx consent screen asks which workspace the assistant may build in, and a code sent to your email confirms it.
pinned
The grant carries one workspace for its lifetime; to build somewhere else, connect again and pick it.
step-up
Approving a connection asks for an emailed one-time code.
lifetime
Access tokens last 5 minutes and are re-minted from the grant; a grant ends after 30 days unused or 90 days after approval.
Your AI is held to your role
Your assistant gets the permissions your role has in that workspace, checked the same way the web app checks them. It can't read secret values or change your account settings.
tiers
Any member reads; Editor works with content and runs workflows; Maintainer builds; Admin manages domains; Owner, members and billing.
per call
Each tool call is checked against the highest role in its token, tool by tool, mirroring the edge.
never
Secret values, passwords, account security, and anything outside the approved workspace.
Bring your own AI, with no markup
You build with the assistant and subscription you already have, and AI steps in your workflows run on your own model key. Tessryx doesn't bill for model usage at all.
building
Drafting, editing and saving are free; only runs use credits.
AI steps
The llm block requires your own provider key, held in a write-only secret.
Rate limits for agents
If an assistant gets stuck in a loop, its requests are slowed down. Your own use of the web app isn't affected.
buckets
600 requests a minute per person for the web app and a separate 600 for agent calls, measured from real use: a page load is about 35.
retry
A throttled agent call gets a 429 with Retry-After: 60.

Data and content

Your content lives in records that follow a shape you describe. Saves are checked against it, and a published record gets its own public address.

Content records (a headless CMS)
In Tessryx, content is a set of records. A record is one item, like a menu or a product, and it has to fit a shape you described, meaning which fields it has and what each one can hold. A save that doesn't fit is turned away with the field named.
Free holds 100 records and Pro 1,000; Agency goes to 10,000. Past the limit you can still edit and unpublish, and live records keep serving.
record
One JSON document bound to a schema (its published version, or its latest draft), with a slug, name, description and a server-stamped content hash.
folders
Slug segments are folders, up to 11 deep, with exact counts of what is directly inside each one.
unversioned
A record keeps one saved copy and one published copy; there is no version history for records.
Read more Docs
How it works
- Your AI writes the schema
- Your team edits in Content Studio
- Saving and publishing are separate
- Pages read it however suits them

Content types defined with JSON Schema
Describe a kind of content once, for example a menu item with a name and a price. Tessryx uses that to check the data and to lay out the form people edit it in.
Up to 100 schemas on Free, 200 on Pro and 1,000 on Agency.
standard
Plain JSON Schema, stored as written. draft-04, -06, -07, 2019-09 and 2020-12 are honored; no $schema means 2020-12.
checked at save
A schema that can't compile is refused when it's saved, with the offending field named: wrong keyword types, RE2-incompatible patterns, refs that leave the schema.
$defs / $ref
Reusable shapes inside one schema, recursive ones too. References to other schemas or URLs are refused.
uniqueItemProperties
No two items in a list may share a value (say, a SKU), enforced in the editor and on the server.
A public JSON URL for every published record
Publishing a record puts its JSON at a public URL, served from a global network. A site or app hosted anywhere can load it from there.
address
https://<workspace>.tessryxuserdata.com/<path>, with a path you choose. One record owns a path; republishing to a new path removes the old file.
headers
Content-Type: application/json and Cache-Control: public, max-age=60.
cost
Reads are free on every plan, with no bandwidth charge.
Every save checked against its schema
Records are checked against their shape on every save, including saves made by your AI or by a workflow. If something doesn't fit, the save is refused and the message names the field.
server-side
Create always validates; an update re-validates whenever the content or the schema binding changes. One shared compiler for every service.
errors
One "field: problem" line per failure, with union branches the data wasn't aiming for left out, and the keys an object accepts listed.
formats
For 2020-12 schemas, format (email, URL, date) is checked in the editor as a warning but not enforced on the server.
Lists, paging and exact counts
Build a "latest posts" list or a product index with paging and a total, even for big collections. Counts for votes and ratings stay accurate when lots of people submit at once.
list
A folder or the whole workspace; recent (newest created first) or slug order, either reversed; optional total and subfolders. Metadata only, never content.
paging
Opaque page tokens. There is no offset, so no jumping straight to page 9.
count
Folder counts update in the same transaction as every create, delete and rename. One record per vote, in a folder per option.
Edits that can't overwrite each other
If two edits to the same record collide, the second is refused and asked to reload, and the first is kept. Your AI can also change a single field without resending the whole record.
content_sha256
Updates can require the hash they read; a mismatch writes nothing. Publishing always requires it, so you publish exactly what you looked at.
patch_datafile
Ordered set, remove, replace_in and test operations on dot paths, with [field=value] selectors and [-] to append. Agents and workflow agents only.
unique claims
A workflow create writes only if the slug is free, so two visitors never get the same order number.
Rename or move a record
Rename a record or move it to another folder in one step. Its published address stays where it is.
atomic
The slug swap, folder counts and creation time move together, so newest-first order doesn't change.
references
Pages bind records by slug, so one that named the old slug stops resolving until it's updated.

Editors and forms

Forms are generated from the schema of the data they edit, so changing the schema changes the form.

Forms generated from JSON Schema
When your AI builds something on Tessryx, it also describes the data, such as a menu whose items each have a name, a price and maybe a photo. That description is a JSON Schema, and Tessryx reads it to lay out the form your team edits in, with dropdowns, date pickers and lists you can drag into order.
from the schema
title is the label, description the help text, examples[0] the placeholder, declaration order the field order. No form builder, no config file.
everywhere
The same renderer draws the editors for records and for the platform's own definitions: endpoints, workflows, schedules, integrations and apps.
depth
Nested objects, arrays and unions to any depth the data has; past 10 levels you edit in the JSON tab.
Read more Docs
How it works
- The schema picks each control
- A few hints cover the rest

Try it

A schema and the editor made from it

Schema

{
  "type": "object",
  "required": [
    "name",
    "email",
    "pickup",
    "items"
  ],
  "properties": {
    "name": {
      "type": "string",
      "title": "Your name",
      "minLength": 1
    },
    "email": {
      "type": "string",
      "format": "email",
      "title": "Email",
      "examples": [
        "sam@example.com"
      ]
    },
    "pickup": {
      "title": "Pick up",
      "oneOf": [
        {
          "const": "friday",
          "title": "Friday after school"
        },
        {
          "const": "saturday",
          "title": "Saturday morning"
        }
      ]
    },
    "items": {
      "type": "array",
      "title": "Order",
      "minItems": 1,
      "items": {
        "type": "object",
        "required": [
          "item",
          "dozens"
        ],
        "properties": {
          "item": {
            "type": "string",
            "title": "Item",
            "enum": [
              "Chocolate chip cookies",
              "Lemon bars",
              "Banana bread"
            ]
          },
          "dozens": {
            "type": "integer",
            "title": "How many dozen",
            "minimum": 1,
            "maximum": 6,
            "default": 1
          }
        }
      }
    },
    "notes": {
      "type": "string",
      "title": "Anything we should know?",
      "x-tessryx-ui": {
        "input": "textarea",
        "options": {
          "rows": 2
        }
      }
    },
    "paid": {
      "type": "boolean",
      "title": "Paid",
      "default": false
    }
  }
}

Edit the schema and the editor changes with it.

Editor

Your name

Pick up

Order

Anything we should know?

Paid

A small order form, the kind people ask their AI for. This is the form renderer from the Tessryx editor, running in your browser with the same validation. Nothing here is saved.

Inputs that fit the value
Fields marked as an email, a web address, a date or a duration get inputs made for them. A number with a range gets a slider and a yes-or-no gets a switch. Short lists of choices become radio buttons, long ones a searchable list.
format
email, uri, date, date-time (shown in the editor's timezone, stored in UTC), time, duration, uuid (with a generate button), ipv4/ipv6, hostname, regex, json-pointer.
numbers
A slider when minimum, maximum and a step exist; otherwise a number input.
enums
Up to 4 short options render as radios, 16 or more as a searchable combobox, anything between as a select. oneOf with const and title gives friendly labels.
Rich text, Markdown and code fields
Long text can be Markdown with a live preview or rich text with a toolbar. Code fields get a proper code editor, with highlighting for 22 languages.
contentMediaType
text/markdown gives a Markdown editor, text/html a rich-text (WYSIWYG) editor, a language type a Monaco code editor.
languages
json, javascript, typescript, css, scss, less, python, go, rust, ruby, java, c, cpp, csharp, sql, yaml, toml, shell, xml, graphql, proto, dockerfile.
jsonata
application/jsonata gets its own editor that compiles the expression as you type.
Lists, tags and drag to reorder
Lists of things, like the members of a team, get rows you can add and drag into order. A plain word list becomes tags, and pick-several fields become checkboxes.
arrays
Drag handles, a filter box from 9 items, collapsed rows titled from their own data; minItems and maxItems gate add and remove. Tuples keep fixed positions.
tags
items: { type: string } becomes a tag input that honors length, pattern and maxItems.
multi-select
An array of enums becomes checkboxes or a searchable multi-select.
Key and value maps
For data where you pick the keys, such as a price for each country, the form gives you a key-and-value editor with a proper field for each value.
additionalProperties
A schema there (or in unevaluatedProperties) renders a map editor with typed values; patternProperties give matching keys their own value schema.
false
With additionalProperties: false, stray keys already in the data show as delete-only.
Either-or choices and fields that appear when needed
A field can offer a choice, for example a link or an uploaded image, and show the fields for whichever is picked. Other fields can stay hidden until an earlier answer calls for them.
oneOf / anyOf
A variant picker; the discriminator is found from const properties or set with discriminator.propertyName, and errors come only from the chosen branch.
if / then / else
Evaluated live at any depth. dependentSchemas and dependentRequired react as you type; a scoped not: { required: [k] } hides k.
Defaults, locked and hidden fields
New records start with their default values filled in. Locked fields show but can't be changed, and hidden fields keep their value out of sight.
default
Written in when a field first appears, including fields revealed by a condition. A cleared default is not brought back.
readOnly / writeOnly
readOnly disables the input; writeOnly masks it as you type. Masking is display only, so credentials belong in Secrets.
hidden
x-tessryx-ui: { hidden: true } keeps the value and its validation and skips rendering.
Live validation and a raw JSON view
Problems show up as you type, written out in words on the field that has them. A JSON tab sits beside the form for pasting in a big block or fixing something by hand.
as you type
Re-validated 500 ms after each change with the same rules the server applies. Cmd or Ctrl+S saves.
JSON tab
Monaco with the record's schema loaded for autocomplete and error markers.
Cron, timezone, color and slug fields
A cron field shows the expression in words and lists the next few run times. Timezone and color pickers are built in, and a slug field fills itself in from the title.
cron
Standard 5-field cron with a plain-English reading and the next fire times, in a timezone named by a sibling field.
timezone
Stores an IANA zone such as America/New_York, picked by city or region.
color / slug
A swatch picker with a hex input; a slug derived from another field until someone edits it.
Pickers that point at other records
A field can point at another record, or at a page, workflow or integration in your workspace, picked from a search box that browses folders.
lookup: resource
schema, apiTemplate, workflow, dynamicEndpoint, schedule, datafile, secret or customDomain. Stores the slug, or slug@published / slug@latest when versioned.
lookup: from
Choices drawn from elsewhere in the same record with a JSONata expression, like the names of steps already defined.
not enforced
A reference is a slug string: unknown values are allowed with a hint, and renames don't cascade.
Image and file fields
Mark a field as an image and editors get an upload button and a browser for your media library. The field stores the file's public address.
media-upload
An optional contentMediaType (image/*, video/*, audio/* or an exact type) filters both upload and browse.
value
The absolute address on https://<workspace>.tessryxusermedia.com/<path>.
A form inside a form
Some settings depend on another choice. Pick the workflow a page runs, for example, and the form loads that workflow's input fields underneath.
schema-form
options { resource: workflow, from, schema }: from names the field holding the reference, schema the pointer inside it (default input_schema).
fallback
Nothing shows until something is chosen; with no schema to read it falls back to a JSON editor.
Content Studio
Content Studio is where your team edits records, in the form or as JSON, and publishes them. Folders and search help on a big site.
tabs
Form (needs a schema) and JSON over the same record, plus a settings dialog for name, schema binding, rename and delete.
publish
Shows the live address and an "outdated" tag when the saved copy is newer than the published one.
roles
Editors and up can edit and publish records.
Schema Studio
A visual editor for designing data shapes by hand, with the fields in a tree on one side and each field's rules on the other. The raw JSON is one tab away.
inspector
Basics, Validation and Display tabs covering types and unions, $ref, defaults, enums, lengths, patterns, formats, bounds, uniqueness and the display hints.
output
Writes 2020-12 JSON Schema. Saving needs Maintainer or higher.
A studio for every piece
Workflows, pages, integrations and schedules each have a studio where you can read what your AI built and change it by hand. Most let you try it with real data too.
studios
Content, Schema, Workflow, API, Delivery, Scheduler and App Studio, each editing a definition in a form drawn from its definition schema.
try it
Workflow Studio's run panel, API Studio's test call and Delivery Studio's preview each run the real thing.

Media and files

One library for the images, video and documents your site uses, served from a separate file address.

A media library for images, video and files
Keep the logos, photos, videos and PDFs your site uses in one library with folders, and use any of them on a page or in a record.
Storage is 100 MB on Free, 5 GB on Pro and 50 GB on Agency. Files over the allowance keep serving; only new uploads are refused.
upload
Straight from the browser to object storage with a presigned URL, then confirmed. Up to 100 MiB per file, one file per upload.
folders
A folder is a slug prefix such as products/hero/main.png, created on upload; empty folders tidy themselves away.
search
By name and slug across every folder.
delete
Admins and owners. A deleted file can keep serving from the edge for up to a day.
Media served from a global CDN
Each file gets a public address on a global network, so images and video load quickly wherever visitors are. Bandwidth is free.
address
https://<workspace>.tessryxusermedia.com/<path>, edge-cached for a day, with open CORS.
separate domain
User files are served apart from the brand and site domains on purpose, so a file can't act as one of your pages.
egress
Unmetered on every plan.
Files shown by their real type
Tessryx checks what an uploaded file really is. Pictures, video, audio and PDFs display in the browser, and anything else is served as a download.
sniffed
The first 512 bytes decide the stored type, so a PNG named .jpg still renders.
inline
PNG, JPEG, GIF, WebP, AVIF, APNG, BMP, ICO, SVG, PDF, MP4, WebM, Ogg, QuickTime, MP3, M4A/AAC, FLAC and WAV.
everything else
Stored as application/octet-stream with Content-Disposition: attachment, HEIC and TIFF included.
video and audio
Range requests work, so players can seek. Files are served as uploaded, with no transcoding.
Uploads served from their own domain
Uploaded files are served from a separate domain, and any script hidden inside an uploaded SVG is switched off, so an upload can't be served as a page on your site.
nosniff
X-Content-Type-Options: nosniff on every file.
sandbox
Content-Security-Policy: sandbox; default-src 'none' on everything except PDF, video and audio, so an SVG's scripts never run.
isolation
Cross-workspace paths are refused, encoded or not, and the storage origin is reachable only through the edge.
Private screenshots for your AI
Screenshots an AI agent takes while checking its work stay private. They don't go into your media library or count toward storage, and they're deleted after a week.
store
A separate private bucket with no public domain: PNG, JPEG or WebP up to 16 MiB each, keyed by workspace and run.
lifetime
Read links last 7 days, and the bucket deletes everything after 7 days. They never count toward storage.

Pages and APIs

A Tessryx site is a set of web addresses, each answered by its own workflow.

Pages and API routes
A Tessryx site is a set of web addresses. A visitor opens a page; the page's own scripts call routes to load more posts or save a sign-up. Every address is an endpoint backed by a workflow.
Pages and routes are capped at 100 on Free, 200 on Pro and 1,000 on Agency.
endpoint
Binds a slug to a workflow, by version (@published, or @latest to serve a draft on purpose). Each uncached request runs the workflow.
methods
GET, and POST to accept a JSON body. Anything else gets a 405.
input_mode
none, static (a fixed input on every request) or transform (built from the request with JSONata).
address
https://<workspace>.tessryx.app/<slug>, or your own domain.
Read more Docs
How it works
- An address and the logic behind it
- Routes take JSON
- Try it before it's live
Edge caching
Each page and route on Tessryx has a cache time. Within it, visitors get a copy from the network edge near them and the page's workflow doesn't run. Those visits are quick and don't use credits, since credits are only spent when a page is actually built.
cache.s_maxage_seconds
Honored exactly. 0 or unset means no caching and a run on every request.
Cache-Control
public, max-age=min(30, s), s-maxage=s, plus stale-while-revalidate when set. Each host keeps its own copy.
no purge
Publishing does not clear cached copies; a change appears when the cached one expires.
exceptions
POSTs are no-store and signed-in pages are browser-only (private). 404s are cached for 60 seconds.
Read more Docs
How it works
- Traffic spikes
- After the cache time runs out

Dynamic routes with URL parameters
One page design can serve every post in a blog by reading the post's name from the address. An address that matches nothing gets an ordinary "page not found."
:param
A slug segment like post/:slug captures exactly one non-empty segment. Exact slugs match first, then the pattern with the most literal segments.
input_transform
JSONata over { params, body, route } that builds $input. Input that fails the workflow's input schema is a cached 404, not an error.
limits
No catch-all or wildcard segments, and slugs are lowercase and matched exactly.
Form submissions and JSON posts
Forms and buttons on your pages can send things in, like a sign-up or a vote, and a workflow saves it or passes it along. Submissions are always handled fresh.
POST
The body must be JSON; it reaches the input transform as body. Form-urlencoded posts are not parsed, so pages submit with fetch.
no-store
Any request carrying a body is answered with Cache-Control: no-store.
not readable
Query strings, request headers, cookies and the visitor's IP never reach the workflow.
Pages built from your content
A page can be put together on the server from a record your team edits, and visitors and search engines receive finished HTML. It can read the published version or your working draft.
datafile
A versioned record reference bound as the workflow's $datafile: @published serves the live copy, @latest the draft.
alternatives
Or the workflow reads its own data in a step, or the page loads the record's public JSON in the browser.
HTML, JSON, XML, CSV and RSS
An address can return a web page, data for your scripts, an RSS feed or a CSV export, with accented characters intact.
content type
The endpoint's content type wins, then the workflow's output_handling.content_type, then what the output looks like (JSON for structured output, plain text for a string).
charset
; charset=utf-8 is added to any text/* type that doesn't name one.
output
Text output. Binary files belong in the media library.
robots.txt, sitemap.xml and security.txt
Serve robots.txt and sitemap.xml, or anything under .well-known, at the addresses search engines and security tools look for. They can be generated from your own data.
Your own robots.txt takes effect on a custom domain, which comes with a paid plan.
slugs with dots
Endpoint slugs allow dots so robots.txt, sitemap.xml and .well-known/security.txt serve at their usual places.
tessryx.app
On the free address the platform's robots.txt takes precedence; on your own domain, yours serves.
Status codes, redirects and headers
A page can answer "not found" when a record is missing, or redirect visitors to a new address. It can also add a few headers of its own.
output_status
An expression evaluated after the final transform: 404 for a missing record, 301 with a Location for a redirect. Unset serves 200.
output_headers
Only location, content-language, link, vary, refresh and custom x-* headers pass. Content-Type, Cache-Control and Set-Cookie are dropped.
errors
A 4xx or 5xx your workflow sets is cached for 60 seconds at most and never served stale.
Links that work on every address
A page works the same on your free address and on your own domain, because each request tells it where its app starts and what its full address is.
route.root
The relative prefix back to the app's root folder: '' for shop/home, '../' for shop/tag/maps.
route.origin / route.url
The serving host's https origin, and the full page address, for canonical and share tags.
route.path
The page's path below the app's folder.
Stale-while-revalidate for expired pages
When a cached page expires, visitors keep getting the last copy straight away while a new one builds in the background.
cache.stale_while_revalidate_seconds
Default 0 (off). A few hours is a normal choice for a live page.
triggered by visits
A request inside the window starts the rebuild; there is no timer, and it does not reduce the number of runs.
Preview a draft page
See what a page or route will return before it goes live, using your real data and settings.
preview_dynamic_endpoint
Renders any version (0 is the latest draft) through the same path as serving, with sample params, and returns the output, status and run id.
sign-in
Not enforced in a preview; a pretend viewer can be supplied to see a gated page as them.
cost
It really runs the workflow, so it spends credits and can write data. Previews keep their own run history.
"Not found" and "paused" pages
A missing page gets a clean "page not found." If a workspace runs out of credits, visitors see a neutral "temporarily unavailable" page that doesn't mention billing.
404
Unknown or unpublished slugs, input that fails validation and deleted workflows. Edge-cached for 60 seconds.
402
"Temporarily unavailable" while a workspace is out of credits or has a payment problem: noindex, edge-cached up to 60 seconds after it clears.
500
Any other failed render is a plain JSON error, not a branded page.

Workflows

Workflows hold the logic. They're written as steps that run in order, top to bottom.

Workflows
When a visitor opens a page on a Tessryx site, a workflow decides what they get. It's a list of steps. A step might look up a record or call a service, and the last one puts the page together.
steps
An ordered list. Each step runs once, in order; there are no jumps, so the flow can always be read top to bottom.
blocks
A step enables up to one of each block, and they always fire in this order: assert, conditional, loop, api_call, sub_workflow, data, llm, asset, variables.
variables
The only results a later step can see. Everything else a block returns lasts until the end of its own step.
final_transform
The expression whose value is the run's output: a page's HTML or a route's JSON.
Read more Docs
How it works
- Steps switch on the blocks they need
- Later steps read what earlier ones saved
- One expression produces the output
- Pages and schedules can share it

Try it

An expression over a league's standings

$standings

{
  "league": "Monday Night 8-Ball",
  "week": 9,
  "teams": [
    {
      "name": "Rack Attack",
      "wins": 7,
      "losses": 2,
      "points": 18
    },
    {
      "name": "Cue Tips",
      "wins": 6,
      "losses": 3,
      "points": 16
    },
    {
      "name": "Scratch & Win",
      "wins": 6,
      "losses": 3,
      "points": 15
    },
    {
      "name": "Side Pocket",
      "wins": 4,
      "losses": 5,
      "points": 11
    }
  ]
}

Expression

$standings.teams^(>points)[0].name

Result

"Rack Attack"

This runs JSONata in your browser with the reference library. Workflows run the same language on the server, where a step's result is a $variable like this one.

JSONata and JavaScript expressions
Wherever a value has to be worked out, like a total or a filter, there's a small expression. Most are JSONata, a language for reshaping data, and the rest are JavaScript.
jsonata
The default. Values are referenced with a leading $ ($input, $response, your own variables); a bare name is a field lookup on an empty context and resolves to nothing.
js
JavaScript that returns a value, in a fresh sandboxed engine per expression: compute only, with no network, packages, timers or files. Up to 64 KiB of source and 30 seconds, within the run's own budget.
literal
Text returned exactly as written, with no evaluation: the place for embedded CSS, HTML or a script, up to 512 KiB.
Read and write records
A workflow can look up a record, save a new one, list a folder or count what's in it. A sign-up form, for example, posts to a route whose workflow saves the record.
data.operation
get, create, upsert, delete, list or count. The result is $data_result for the rest of the step.
create
Writes only if nothing exists at the slug yet, so two visitors can never claim the same number or name.
list
Pages of record metadata from a folder, newest first or by slug, with optional subfolders and a total count.
count
Counts the records directly inside up to 100 folders in one call, e.g. votes per option.
guard_content
Write only if the record still matches what this run read (by content hash). Off by default, which is last-write-wins.
on_conflict
fail ends the run; continue marks the conflict so the workflow can retry, for example with the next number.
pacing
Writes past a per-run allowance wait for it to refill instead of failing; the wait counts as run time.
Loops and parallel steps
A step can repeat for each item in a list, or for as long as a condition holds. Steps that don't depend on each other can run at the same time.
loop.mode
for_each over a collection (with item and index names) or while a condition is truthy.
concurrency
Iterations run one after another by default; raise it to run several at once. Shared variables update atomically.
parallel
Marks a step to run alongside the parallel steps next to it; the next ordinary step waits for all of them.
caps
10,000 iterations per loop, up to 50 at once per loop, and 256 concurrent branches per run.
Checks and error handling
A step can refuse to run unless something is true, or skip itself when it isn't needed. After a failure, the workflow can carry on and let a later step deal with it.
assert
A precondition. A falsy result fails the run, with an optional message.
conditional
A skip gate. A falsy result skips the rest of the step.
on_error
fail (the default) ends the run at the failed step; continue records it as $step_error { code, message, step } and moves on.
Sub-workflows
One workflow can run another and use what it returns. A page can be assembled from a few smaller workflows, one for the header and one for the rest.
sub_workflow
Runs another workflow by slug and version (@published or @latest), with an optional input. Its output is $sub_output for the rest of the step.
scope
In a scoped workflow, a sub-workflow runs only if its own scope fits inside the caller's.
depth
Sub-workflows can nest up to 10 deep.
Generated images and files
A workflow can draw an image, like a share card for a new post, and publish it to your media library. It can also save a picture from another web address.
asset.render
Rasterizes SVG markup to a PNG at the SVG's own size on the server and publishes it, e.g. a 1200x630 share card.
asset.publish
Uploads bytes from a URL the platform fetches or from base64 the workflow produced, create-only unless overwrite is set.
asset.get
Reads an asset's metadata by slug. Every result is $asset { media_id, slug, content_type, size_bytes, path, url }.
Typed input
A workflow can declare the input it expects. Each run is checked against it, and wherever a person starts the run, they get a form to fill in.
input_schema
A schema reference (with @published or @latest) describing $input. The runner validates input against it, including each run of a chain.
forms
The data editor, the run panel and a schedule's input field render that schema as a form.
Run time limits
Each run has a time limit, and a run that hangs is stopped when it gets there. Longer jobs run as a chain of runs.
Free runs up to 60 seconds, Pro up to 2 minutes and Agency up to 5 minutes.
execution_budget
Seconds, 1 to 900, default 10. A budget above the plan's limit is lowered to it, not refused; a run that hits it is stopped and still counted.
plans
Up to 60 seconds on Free, 2 minutes on Pro, 5 minutes on Agency. Anything someone waits on (a page, an editor run, a tool call) stops at 5 minutes on every plan.

AI inside your app

Models can do work inside your app too, either answering once or working through a job with tools.

AI agents with tools
An AI step without tools answers once and hands back text. Give it tools and it keeps going, turn after turn. It can call your integrations or run another workflow, build and edit things in your workspace, or open your site in a browser and look at it, until the job is done.
tools
Any mix of: one of your integrations, another workflow, Tessryx operations (build, edit, publish, run and preview in the workspace), and page snapshots.
max_turns
Model calls, not tool calls: 2 to 50, required with tools. Running out of turns while still asking for tools fails the run.
limits
Up to 32 tools per block. Tool calls within a turn run one after another, and prompt caching is applied for you.
tessryx
Each ticked operation becomes a tool. The agent acts with a credential minted for the run and is refused before it starts if it has no scope.
recursion
A run or preview an agent starts counts toward the same limit as the run it is inside, so it cannot loop back in through the front door.
Read more Docs
How it works
- You choose its tools
- It's limited to the folders it's given
- It can use a key without seeing it
- Jobs longer than one run

AI steps in a workflow
Any step can ask a model to write or summarize something, and the answer flows into the rest of the workflow. It runs on your own model account, with no markup from Tessryx.
llm
A block with a prompt and an optional system prompt (both expressions). With no tools it is one exchange; the reply is $llm.text.
provider / model
Anthropic's API, any model id you name, e.g. claude-sonnet-5-5.
secret
Your provider API key, read from a write-only secret at run time and never stored in the workflow.
effort / thinking_display
How hard the model works per turn, and whether run traces show a summary of its reasoning.
max_tokens
Per turn, reasoning included. A turn cut off at the limit fails rather than passing on half an answer.
Scoped agents
An agent that can build is limited to the folders it was given. It can't add to that list, and whatever it creates or connects has to fit inside it.
scope.grants
Folders plus what each allows: read (get, list, count, call), write (upsert, delete), publish (serve at a public path). A folder covers everything under it, by whole path segment.
llm.scope
A tool scope computed while the run happens, such as the one app being built. It can only narrow the workflow's scope; an empty or malformed one fails before the model is called.
attenuation
An agent inherits the scope of whatever called it. A workflow it saves without a scope gets the agent's written in; a wider one is refused.
required
An llm block with Tessryx operations must have a scope, on the block or the workflow, or the workflow is refused at save and at run.
Keys an agent can use but never see
A workflow that holds a key can be handed to an agent as a tool, like one that calls an image service. The agent can call it but never gets to read or reuse the key.
secrets
A scoped workflow lists the secrets it may use, for its own llm key and its integrations' auth. Using one not listed fails the step.
not inherited
The list belongs to the running workflow, never passed down from the caller, which is what makes delegation safe.
agents
A scoped agent can't save or edit a workflow that lists a secret, or build an integration that uses one.
Long-running agents
An agent can keep working across many runs. At the end of a turn it hands its conversation to the next run, and older turns get summarized to keep the conversation small.
resume
Continues a paused conversation from the handle the last run returned as $llm.transcript. It evaluates to nothing on the first run, so one block serves the whole chain.
compact_at_tokens
Once a request passes this size, earlier turns are summarized and the model reads the summary instead. $llm.compactions counts them.
compact_instructions
Replaces the default summary prompt: what later turns need verbatim.
chains
Resuming across runs needs a chain, and a chain only continues when a schedule started it.
Live progress and a stop switch
A long agent can write a progress report after each turn for a page to show. The person who started it can also stop it partway, without waiting for the run to end.
progress
After every turn, writes a record built from $progress { turn, total_turns, elapsed_ms, usage, compactions, tools, text, thinking, stop_reason, at }.
stop_when
Reads a record before each turn and stops the loop when its condition is true, with stop_reason 'stopped'. The steps after it still run.
Agents that look at your pages
An agent can open your site in a real browser and check its own work. It gets screenshots at desktop and phone sizes, plus a list of any text that overlaps or runs off the edge.
page_snapshot
Up to 6 screenshots a call, 1280x800 and 390x844 by default, with what the page logged and requested and any clipped or overlapping text, after hover, click or type steps.
published
Off by default: pages render from the latest versions, drafts included, which is what an agent checking its own work needs.
allow_writes
Off by default, so a form the page submits is refused. Pages load only from the workspace's own site, as an anonymous visitor, inside the scope.
Your own model server
Point an AI step at a model server you run yourself, as long as it speaks the same protocol as the provider. Your key is sent to it as usual.
base_url
The address before /v1/messages, e.g. https://llm.example.com. It must speak Anthropic's Messages API over public https. Unset calls the provider.

Schedules

Run a workflow on a timer, whether or not anyone visits.

Cron jobs and scheduled tasks
A schedule runs a workflow on a clock, whether or not anyone visits. The pool league template uses one to pull new results every morning; other sites rebuild a summary every hour or send a digest on Mondays.
Free includes one daily scheduled job. Pro has 10 that can run every 15 minutes, Agency 50 that can run every minute.
mode: interval
Every N minutes or hours, timezone-independent. every >= 1.
mode: cron
A standard 5-field cron expression evaluated in an IANA timezone, with daylight saving handled. The editor previews the next runs.
input
A fixed input passed as $input on every fire, edited as a form built from the workflow's input schema.
workflow
A versioned reference, @published or @latest; a bare slug means @published.
Read more Docs
How it works
- Point it at a workflow
- Test it with Run now

Try it

The cron field from the schedule editor

Timezone

New York

Examples

Schedule (cron)

0 9 * * *

At 09:00 AM

Next runs load in your timezone.

The next 7 days

The same field the schedule editor shows, running in your browser. It reads the expression back in words and lists the next runs in your own timezone.

Run a schedule now
Fire a schedule on the spot to test it, without waiting for its next turn. You can switch it on or off whenever you like.
run_schedule_now
Fires the schedule's workflow immediately with the schedule's own input; the run is recorded like any other.
publish / unpublish
A published schedule fires on its recurrence; unpublishing stops it without deleting it.
Jobs longer than one run
A scheduled job that's too big for one run, like working through thousands of records, can run as a chain. Each run saves a bookmark and the next one starts from it.
continuation.max_links
The most runs one chain may use, counting the first: 2 to 50, default 10. Reaching it while still asking to continue fails the chain.
continue_with
Evaluated after the final transform. Nothing ends the chain; a value starts the next run with that value as its whole $input.
$link
{ index, chain_id, max } tells a run where it is. A chain keeps the workflow version it started on.
schedules only
A chain continues only when a schedule started it, on a due fire or Run now. Started from a page, the editor or a tool call, the workflow runs once.

Integrations and secrets

Your workflows can call outside services, and the keys for them are stored write-only.

API integrations
Connect a service like Stripe or your email provider once, and any workflow can call it. Your AI sets up the call and you paste in the key.
protocol: http
GET, POST, PUT, PATCH, DELETE, HEAD or OPTIONS. URL, query, headers and body are JSONata worked out per call from the variables passed in.
protocol: grpc
A service and method from proto files compiled at run time, TLS by default, with metadata and a JSONata request message.
timeout
Seconds for the whole request, 1 to 300, default 30.
$response
The API call block binds { status, headers, body } for the rest of the step. A 4xx or 5xx is a result to check, not a failure, and nothing retries on its own.
limits
JSON request bodies only, 8 MiB each way. Private and internal network addresses are refused, and redirects must stay on the same host.
count
100 integrations per workspace on every plan. A test call outside a workflow costs 1 credit.
Authentication for outside services
Calls sign in to the other service with a token, a password or a key, and can sign each request the way X (formerly Twitter) requires. The credential comes from a stored secret.
auth.type
none, bearer, basic, api_key (in a header or the query, under a name you choose) or oauth1.
oauth1
Names four secrets (consumer key and secret, access token and secret) and signs every request over its method, URL and query.
secret
Resolved to plaintext only at execution time; the definition holds the name, never the value.
Write-only secrets
Once a key is saved, no one can read it back, including you and your AI. You see its name and the last few characters, and rotating it means pasting a new value over the old one.
write-only
No read path returns the value: the UI, the agent tools and the API all show the name and a masked preview only.
roles
Setting a value takes an owner or admin. Maintainers can see that a secret exists, so they know an integration is wired.
use
Integrations and llm blocks name a secret; it's resolved at execution time. A scoped workflow must list the secrets it may use.

Sign-in and access

Any page can stay public or sit behind a sign-in, and a team-only page opens just for people in your workspace.

Visitor sign-in for your site
A page or route on a Tessryx site can require a sign-in. A visitor who isn't signed in goes to Tessryx, signs in with an email and password or with Google, approves your site the first time, and comes back to the page they asked for.
On every plan, and people who sign in to your site never use a seat. Sign-in on your own domain needs a plan with custom domains.
auth.required
Off by default. On its own it is a login wall: any signed-in Tessryx account gets in.
flow
OAuth 2.0 authorization code with PKCE, bound to the one site host (RFC 8707 resource), so a grant only works for that site. Consent is asked once per site.
session
A sealed, host-bound cookie lasting 30 minutes and renewed while the visitor is active. Signing in again is usually an invisible redirect.
caching
A gated page is never stored at the edge; at most the visitor's own browser keeps it.
Read more Docs
How it works
- Gate the pages that need it
- Anyone, or only your team
- Choose what everyone else sees

Members areas with each visitor's own data
Let anyone who signs in into a members area and show each person their own things, like saved items, without learning who they are.
auth.expose_identity
Adds auth { authenticated, viewer_id, tenant_id } to the input transform, and makes the response private, no-store.
viewer_id
32 hex characters from an HMAC of your workspace and the account: stable on your site, different in every other workspace, safe as a record slug (members/<viewer_id>).
Admin pages only your team can open
Build an admin area into your live site that opens only for people with a role in your workspace. Remove someone's role and they're out within seconds.
Only workspace members get in, and seats are 1 on Free, 3 on Pro and 10 on Agency.
auth.allow.tenant_roles
Any of ROLE_OWNER, ROLE_ADMIN, ROLE_MAINTAINER, ROLE_EDITOR, ROLE_VIEWER. Matching is exact, so list every role that should get in.
live roles
Read from your workspace on each request, cached 5 seconds. A failed lookup refuses rather than admits.
identity
With an allowlist and expose_identity, auth also carries user_id, email and roles. Never a name.
What signed-out and refused visitors see
Decide page by page whether a signed-out visitor goes straight to sign in or sees a page with a sign-in button. A visitor who isn't allowed can get "access denied" or be sent somewhere else on your site.
on_unauthenticated
redirect (default, a silent 302), prompt (a page with a Login with Tessryx button) or refuse (a 401 with a login_url, for routes a script calls).
on_denied
forbidden (a 403 page, the default) or redirect to a path on your own site, checked so it can't become an open redirect.
headers
Every sign-in and denial response is private, no-store, Vary: Cookie and noindex.
Pages that know who's signed in
Add one script tag and the page knows whether the visitor is signed in as soon as it loads. It can send them to sign in without losing what they typed, and show team-only buttons to your team alone.
/_tessryx/site-1.js
window.tessryx: signedIn, ready, roles, hasRole(), signIn({ preserve }), fetch() that handles a gated route's 401, and restore().
first paint
<html> gets ts-signed-in or ts-anon and ts-role-* classes before the page draws.
display only
Roles in the page decide what to show; the gate on the route that acts decides what is allowed.
Private visitor ids and a plain consent screen
Before a first sign-in, Tessryx tells the visitor which site is asking and that it gets an anonymous id, with no email or name. The id is different on each site, so two sites can't link up the same person.
pairwise ids
A visitor's id differs in every workspace, so sites can't join records on it. It is the same on your free address and your own domain.
consent
Per site, naming its host. Members of the operating workspace are told the site is run by their workspace.
account security
Visitors can see and disconnect each site they've signed in to.
Preview a page as a pretend visitor
Before publishing, your AI can render a members-only or team-only page as a made-up visitor with whatever roles you choose.
preview_dynamic_endpoint
Takes viewer_user_id, viewer_email and viewer_roles; email and roles apply only where a role allowlist does.
snapshots
Page snapshots can view a gated site as a synthetic signed-in visitor whose id can never be a real account.
where
Your connected AI only. The web preview has no pretend-visitor fields yet.

Domains and hosting

Each workspace starts on a free web address, and your own domain can take over when you're ready.

Custom domains with automatic HTTPS
Every Tessryx workspace starts on a free tessryx.app address. To put a site on your own name, claim the domain in your dashboard and add two records at your DNS provider. One proves the domain is yours and the other points it at Tessryx.
Custom domains come with a paid plan: 2 on Pro, 10 on Agency, unlimited on Scale. More are $8 a month each.
records
A TXT at _tessryx-challenge.<host> to prove ownership, and a permanent CNAME from <host> to custom.tessryx.com.
states
PENDING, VERIFIED, CERT_PENDING, ACTIVE. Verification is a live lookup; the certificate is issued and renewed for you.
claims
Unverified claims expire after 30 days. The first workspace to verify a hostname takes it.
hostnames
No wildcards, no hostnames containing "tessryx", and international names as punycode.
Read more Docs
How it works
- Claim it
- Add the records
- Wait for the certificate
- Point it at an app

A free yourname.tessryx.app address
Each workspace gets a secure web address as soon as something is published, with no domain to buy. Pages there show a small "Served by Tessryx" badge and stay out of search results.
address
https://<workspace>.tessryx.app/<slug>. Each workspace is its own browser origin, with wildcard TLS on an HSTS-preloaded domain.
on this host
X-Robots-Tag: noindex on every response, the platform robots.txt, and a badge on public HTML pages (never on signed-in pages or non-HTML responses).
root
The bare workspace address has no home page; that needs a custom domain.
Point a domain at one app
Choose which project a domain shows and which page is its home page. Several sites can share a workspace, because each domain only reaches its own project's pages.
Needs a custom domain, so a paid plan.
slug_prefix
Mounts a folder: a request for /P is served by <slug_prefix>/P. It is an isolation boundary, so a storefront domain can never reach admin/... pages.
root_endpoint
What / serves, relative to the prefix. Empty means / is a 404.
propagation
Routing changes show within about a minute.
Root domains like yourbrand.com
A bare domain like yourbrand.com works if your DNS provider can point a bare domain at another name, as Cloudflare, Route 53 and DNSimple can. If yours can't, the www address does the job and your registrar forwards the rest.
Same as custom domains: a paid plan.
record
Always a CNAME to custom.tessryx.com. There is no A record or static IP option.
without flattening
The TXT check passes but the domain stays CERT_PENDING.
www
www and the bare domain are separate hostnames, each counted in your allowance; there is no automatic pairing.
Extra domains, $8 a month each
On Pro and Agency you can add domains one at a time without moving up a plan. Agencies use this when a new client site needs its own.
Pro and Agency. Scale already includes unlimited domains.
add-on
Quantities add to the plan's included domains. Buying needs a paid subscription; the change is prorated.
over the cap
After a downgrade the earliest-added domains keep serving and the rest pause, keeping their certificates, until you upgrade.

Versions and safety

Saves become numbered versions you can go back to, and your AI can check what depends on a piece before it changes it.

Version history and rollback
Saving a page, a workflow, a schema, an integration, a schedule or an app creates a new numbered version and keeps the earlier ones. Visitors get whichever version you published.
immutable
A version never changes once saved; a new one is v(latest+1) with a checksum.
retention
The newest 10 versions plus the published one are kept. Older ones expire about a day after they fall out of that window.
records
Content records are not versioned: one saved copy and one published copy.
Read more Docs
How it works
- Publishing is its own step
- Pieces follow live or draft
See what depends on what before you change it
A Tessryx app is built from separate pieces, and each one declares what it uses: this page reads that record, this workflow calls that integration. Tessryx stores those links as a graph your AI can query from either end.
get_resource_graph
Walks depends_on (default depth 3) or depended_on_by (transitive), showing each edge's @published or @latest text and what it resolves to now.
analyze_resource
Findings with severities, a deployable flag, and hypothetical delete, unpublish and publish previews. Read-only.
declared, not inferred
Edges come from the references each definition declares; values computed while a workflow runs are reported as unknowable rather than guessed.
deletes
Never blocked and never cascade. Anything left pointing at a deleted piece fails cleanly.
Read more Docs
How it works
- Ask in either direction
- Preview before acting

Hover any piece to see what it would break

custom domain
endpoint
workflow
datafile
schema

mcp · tessryx

$ analyze_resource --kind workflow --resource birthday/theme --hypothetical delete

deployable: false · errors: 7

errorworkflow:birthday/home-render would break: steps[0](theme).sub_workflow.workflow references "birthday/theme@published", which would no longer exist
errorworkflow:birthday/invite-render would break: steps[0](theme).sub_workflow.workflow references "birthday/theme@published", which would no longer exist
errorworkflow:birthday/admin-render would break: steps[0](theme).sub_workflow.workflow references "birthday/theme@published", which would no longer exist
errordynamic_endpoint:birthday/home would break: depends on birthday/home-render, which would break
errordynamic_endpoint:birthday/i/:token would break: depends on birthday/invite-render, which would break
errordynamic_endpoint:birthday/admin would break: depends on birthday/admin-render, which would break
errorcustom_domain:birthday.nickpage.tech would break: depends on birthday/home, which would break

The pieces of a real app, birthday.nickpage.tech, with the dependencies Tessryx's own analysis tools report for it. Hover or tap a piece to see what relies on it.

Drafts and publishing
Your changes are drafts until you publish them. You can try a draft with real data first and then publish the version you checked.
@published / @latest
One reference grammar everywhere: a bare slug or @published follows the live version; @latest follows the newest draft. References pick a channel, not a version number.
propagation
A publish reaches the serving layer within about a minute; a cached page then waits out its cache time.
who
Editors publish content records; Maintainers and up publish pages, logic, schemas, integrations, schedules and apps. There is no approval step.
Publishing refuses broken references
If a page or workflow points at something that doesn't exist or was never published, publishing it is refused, with the reason. Drafts can still be saved in any order.
workflows
Refused when an integration, sub-workflow, input or data schema, model key or agent tool reference fails to resolve.
endpoints
Refused with no workflow, a workflow that does not resolve, or static input that fails the workflow's input schema.
validate_workflow
Your AI checks a workflow before saving it; scoped agents that can build must have a scope.
Take something offline without deleting it
Take a page, a schedule, an app or a record offline and keep everything, ready to bring back later.
kinds
Endpoints (the URL 404s, versions kept), schedules (stop firing), apps and records (the public copy is removed, the content kept).
not for
Schemas, workflows and integrations have no unpublish; they stop mattering when nothing published uses them.
Rename anything in place
Rename a page, a workflow, an integration, a schedule, an app or a record where it is, and its history comes along.
atomic
A slug-lock swap; versions are keyed by id, so history follows the rename.
no redirects
References are slug text and aren't rewritten, and an old page address simply stops resolving.
tools
Every studio can rename; over MCP, apps and schedules can.
Apps: one project, managed as a unit
An app gathers a project's pieces, from its data to its pages and schedules, into one place you open and manage together. New pieces in the project's folder join automatically.
membership
Prefix rules (a folder plus the kinds they cover), plus explicit includes, minus excludes, resolved live. A rule matches a resource's folder.
kinds
schema, datafile, api_template, workflow, dynamic_endpoint, schedule and secret.
versions
An app's definition is versioned. Publishing an app doesn't publish its pages, and it never freezes their versions.
limit
100 apps per workspace on every plan.
App Studio
Opening an app lists its pieces in one sidebar and opens each in its usual editor without leaving the project. A short setup checklist ticks off each step once it's done.
sidebar
Six kinds from the app's latest definition; New opens the right create dialog already in the app's folder.
checklist
Describe your data, add your content, turn it into a page, give it an address.
Export and import an app
Download a whole project as one file and import it into another workspace you belong to. Before anything is created, you see what it will add and what's already there.
zip
<slug>.tessryx-app.zip with one manifest: the app and every member's latest draft, which were published, and each record's schema binding.
left out
Secret values (only names travel), media files, custom domains and version history.
import
Creates kinds in dependency order. On a slug that exists you choose skip or update; schema bindings are re-resolved by slug.
where
In the web app. Your connected AI can't export or import.
Start from a template
Pick a ready-made app, fill in a short form, and Tessryx builds a working copy in your workspace and runs its first data sync. Today there is one template: a pool league site.
The template's daily sync uses a schedule, and Free includes one.
pool league site
Six pages per division, synced each morning from FargoRate LMS, with a share card redrawn on every sync.
how
An exported bundle plus a JSON Schema form whose answers are written into the bundle, imported, then its first workflows run in order.
Delete an app, or everything in it
Deleting an app usually removes just the grouping and leaves its pieces alone. A separate action deletes every piece and then the app, once you type its name to confirm.
delete all content
Deletes members in dependency order (endpoints, schedules, workflows, integrations, records, schemas) and the app only if every member went cleanly. Secrets stay.
permanent
There is no trash or restore.

Runs, usage and billing

Each run is recorded with what it cost, and a failed run shows the step that broke.

Run history and step traces
Each run is listed with how it went. Open one to see the steps, what each read and what it got back, and your AI can read the same history to debug its work.
Free keeps the step trace only for runs you start and for failed runs.
retention
Runs are kept 14 days on every plan, for workflows, schedules and endpoints alike.
traces
Paid plans keep the step trace of every run. Free keeps it for runs you start yourself and for every failure.
sizes
Unattended runs keep a 4 KiB head of output and 16 KiB per trace item; editor runs, previews and Run now are kept whole.
tools
list_runs, get_workflow_run and get_workflow_run_traces for workflows; list_schedule_runs and list_dynamic_endpoint_runs for schedules and pages.
Run a workflow on demand
Run any workflow by hand from Workflow Studio, or ask your AI to, for a test or a one-off job. You don't need a website for this.
run_workflow
Runs an exact version with an input, from the run panel or over MCP. Editors and up can run a workflow someone else built.
billing
Billed like any run. An agent's run_workflow output is capped at 32 KiB.
Credits for runs
Tessryx charges for the work your logic does, in credits. A typical page build is 1 credit, and a longer job costs 1 credit per 10 seconds, whatever started it.
A month of credits is 10,000 on Free, 100,000 on Pro and a million on Agency.
rate
max(1, ceil(seconds / 10)) per run, the same on every plan. Parallel branches and concurrent loop iterations count in full.
free
Cached views, building, editing, saving, publishing and every read. Published records and media are static files, with no bandwidth charge.
billed
Cache misses, form posts, schedules, previews, test runs, agent runs and failed runs. A bare integration call is a flat 1 credit.
models
Never in credits: AI steps bill your own model account.
See where your credits went
A live balance, a chart of credits used each day, and a breakdown by workflow, page, domain or trigger.
breakdown
By source, workflow, endpoint or domain: the top 20 plus an "other" row, so totals still add up.
range
This month, last 30 days or last 90 days; usage is kept 62 days.
who
The workspace owner.
Low-credit warnings
You'll hear before you run out: a dashboard note at half, emails at 20% and 10%, and one more when credits hit zero.
emails
To the owner at 20%, 10% and 0% of the monthly allocation, once per threshold per period.
no auto top-up
Nothing is bought for you.
No overage bills
Credits are prepaid, so there are no overage bills. If they run out, runs pause until you top up, while cached pages, published records and media keep serving.
gate
A run starts only while the balance is above zero. A run already going finishes, and any overshoot is absorbed.
visitors
Pages that need a run show a neutral "temporarily unavailable" page that never mentions billing, for up to a minute after you top up.
Credit packs that never expire
Credit packs are one-time purchases, available on every plan including Free. Bought credits don't expire, and on a paid plan unused monthly credits carry over for a month.
packs
Lift only the credit balance; storage, records and domains stay set by the plan.
rollover
Paid plans: unused allocation stays usable through the next month, then expires. Free resets each month.
refunds
A refunded or disputed payment voids the unused credits it bought, and a dispute won restores them.
Plans and limits
Plans differ in their limits. Where a feature isn't on Free at all, like custom domains, it says so on this page.
Free
1 seat, 10,000 credits a month, 60-second runs, 100 MB media, 100 records, 1 daily schedule, no custom domains.
Pro
$20 a month: 2 domains, 3 seats, 100,000 credits, 2-minute runs, 5 GB, 1,000 records, 10 schedules every 15 minutes.
Agency
$99 a month: 10 domains, 10 seats, 1,000,000 credits, 5-minute runs, 50 GB, 10,000 records, 50 schedules every minute.
every plan
100 apps, 100 integrations and 1,000 secrets per workspace. Workflows, endpoints and schemas are 100, 200 and 1,000 by plan.
Change plans without losing work
Change plans from the dashboard whenever you like. Moving to a smaller plan doesn't delete anything; what's over the new limits waits until you upgrade again.
proration
Upgrades charge the prorated difference right away; downgrades leave a credit for future invoices.
over the limit
Extra domains pause, extra teammates lose access until there is room, records can still be edited and unpublished. Live pages keep serving.
portal
Cards, invoices and cancellation in a billing portal. Cancelling keeps the plan to the end of the paid month, then moves to Free.
A grace week when a card fails
If a subscription payment fails, your sites keep serving for a week while you fix the card. Once it goes through, everything comes back with no fee.
day 0
Scheduled jobs pause; pages and routes keep running.
day 8
Pages and routes stop running and visitors see the neutral "temporarily unavailable" page; cached pages serve until they expire. Credits are untouched.
Plain messages at a plan limit
If something would go past your plan, the message says which limit and how to raise it. Your connected AI is told not to keep retrying.
messages
For example "DataFile limit reached. Your plan allows 100 datafiles." Limits are checked inside the create, so they hold under concurrency.
timing
Limits are cached up to 60 seconds, so an upgrade can take a minute to lift one.
Free sites stay up while they're used
The free plan has no trial clock. A free site that's in use stays live; only an account with no activity for 90 days gets a warning before anything is removed.
activity
Tracked per account; the warning comes before any removal.

Team and account

Teammates get one of five roles. Your own sign-in can use two-factor, and you can see every device that's signed in.

Workspaces
Each workspace has its own apps, content, domains, team and bill. You can belong to several and switch from the account menu.
ownership
The creator is the Owner. You can own one workspace, and create one while you belong to fewer than 2; joining by invite has no such limit.
address
3 to 30 lowercase letters, digits and hyphens, checked as you type; names that could pass for Tessryx or a well-known brand are refused. It can't be changed later.
plan
Each workspace carries its own plan.
Five team roles
There are five roles, from Viewer, who can look but not change anything, up to Owner. A copywriter can edit and publish content without being able to change how the site works.
Viewer
Reads everything.
Editor
Edits and publishes content records, uploads media, runs workflows someone else built.
Maintainer
Builds and publishes schemas, workflows, integrations, schedules, endpoints and apps; sees which secrets exist.
Admin / Owner
Admins add domains, set secret values and delete media; the Owner also handles members and billing.
everywhere
The same matrix applies in the web app and over MCP, tool by tool.
Invite your team
Add people by email and pick their role. They'll see the invitation on their dashboard the next time they sign in with that address.
Seats are 1 on Free (the owner), 3 on Pro and 10 on Agency, so inviting someone starts on Pro. People who only sign in to your sites never use a seat.
roles offered
Admin, Maintainer, Editor or Viewer; there is one Owner and it isn't assignable.
no email
Invitations aren't emailed yet, so tell the person to sign in with that exact address.
seats
The owner and pending invites count toward seats.
Seats, and what a smaller plan does to them
Your plan sets how many people can build in the workspace. After a downgrade, the most recently added teammates lose access until there's room again; nothing about them is deleted, and the owner keeps access.
Free 1, Pro 3, Agency 10.
ranking
Members are ranked by join time; those past the seat count read as non-members, on team-only site pages too, until the plan grows.
visitors
People who sign in to your published sites aren't members and never take a seat.
Two-factor sign-in
Turn on two-factor sign-in and every login also asks for a short code sent to your email. Turning it off again needs a fresh code too.
factor
A 6-digit emailed code: 10 minutes, 5 attempts, at most 3 sends. It is also asked for on a password change and on every new AI connection.
step-up
When the bot check can't complete at sign-in, a code is asked for even with two-factor off.
Active sessions
The Security page lists the devices signed in to your account, with where and when, and signs out any one of them or all the others.
policy
5-minute access tokens, a 30-day rolling window, and a 90-day cap from sign-in. Refresh tokens rotate on every use, with reuse detection.
password change
Signs out every other session and connected app, and emails you a confirmation.
Email and password, or Google
Sign up with an email and password or with Google, and add the other later if you want both. Password reset links never reveal whether an address has an account.
verification
A new account confirms its address from a link before it can sign in. Passwords are 8 to 72 characters, stored with bcrypt.
bot check
Sign-up, sign-in and reset forms run an invisible Cloudflare Turnstile check before credentials are looked at.
guessing
10 failed logins per address per minute, counting failures only, so an attacker can't lock the real owner out.
Connected apps you can revoke
Each AI assistant you've connected is listed with the workspace it can reach and when it was last used. Disconnecting one takes effect at once.
grants
A connection ends after 30 days unused and 90 days after approval at the latest. Revoking also forgets the consent, so the next connection asks again.
sites
Sites you have signed in to as a visitor are listed here too, one row per site.

What Tessryx doesn't do

These are the ones people ask about most. Where there's a workaround, we've put it under the item.

Crossed off lately Tessryx couldn't do these until recently.

Agents that look at your pagesOctober 2026
Live progress and a stop switchOctober 2026
Jobs longer than one runSeptember 2026
Scoped agentsSeptember 2026
Lists, paging and exact countsSeptember 2026
Custom domains with automatic HTTPSJuly 2026
AI steps in a workflowJuly 2026

No database queries or joins
Records are JSON documents in folders. You can fetch one, list a folder in date or name order, page through it and count it, but there's no query language, no joins across records and no full-text search.
Model it the way you'd model it for DynamoDB, with folders shaped around how pages read the data. A workflow can write one item into every folder it belongs in (a fan-out write), and a folder count gives a tally without reading the records. For real queries, call a database you run through an integration.
Apps don't export as code you can run elsewhere
An export is a zip of definitions that another Tessryx workspace can import. There is no self-hosted version and no source-code export.
The formats are open (standard JSON Schema, with logic in JSONata or JavaScript), so what you built can be read outside Tessryx even though it won't run there.
No drag-and-drop page builder
Pages are built by your AI and edited by describing the change to it, or by hand in Workflow Studio. Content is edited in forms, never by dragging boxes around a page.
No native mobile apps
What you build runs in the browser, including on phones. It isn't an app-store app.
No built-in email sending or payments
There's no email block and no checkout of its own.
Connect an email service or Stripe as an integration; the keys live in Secrets and your AI wires the calls.
No "run when something changes" triggers
A workflow runs when a page or route is requested, on a schedule, or when someone starts it. Saving a record or publishing something does not start one.
Receive outside events on a route that accepts posts, or check for changes on a schedule.
Incoming webhook signatures can't be checked
A route gets the parsed JSON body, not the raw bytes, and expressions can't compute an HMAC or read a secret, so signature checks like Stripe's aren't possible inside a workflow.
Query strings, headers and cookies never reach your logic
A page's workflow sees the parts of the address it declared, a JSON body and, behind a sign-in, who the visitor is. It never sees ?page=2 style parameters, request headers, cookies or the visitor's IP.
Put changing values in the path, like /posts/page/2, or send them as JSON.
Plain HTML form posts aren't read
Routes accept JSON bodies only, so a classic form-encoded post isn't parsed. Only GET and POST are supported.
Submit the form from the page with fetch and JSON. Pages your AI builds on Tessryx already work that way.
Other websites can't call your routes, and your logic can't set cookies
Responses carry no CORS headers, so browser scripts on other domains are refused, and workflows cannot set cookies of their own.
Published records' JSON addresses do allow any site to read them.
No websockets or streaming responses
Each request gets one complete response. There are no websockets, server-sent events or streamed pages.
Poll a route from the page, or let a long agent write progress to a record the page reads.
JavaScript in workflows is calculation only
A JavaScript expression can compute anything, but it can't fetch, use npm packages, set timers or touch files.
Outside calls go through integrations, which a step can use and pass on.
AI steps run on Anthropic models only
The AI step speaks Anthropic's API, with your key, or a server you run that speaks the same API. Prompts are text; images reach the model only through tool results, and there is no structured-output mode.
Call another provider's API as an ordinary integration. That covers a single answer; the tool-calling loop only runs in the AI step.
Integrations send JSON, and only to the public internet
Request bodies are always JSON, so form-encoded, XML and file-upload calls aren't possible. Private and internal network addresses are refused, a 4xx or 5xx is a result rather than a failure, and nothing is retried for you.
Put a small public endpoint in front of a private service, and check $response.status in the workflow.
No "connect your account" sign-in for outside services
Integrations can't run an OAuth 2.0 authorization flow or refresh tokens on their own. A credential is a static value you paste into a secret.
Store a long-lived token as a bearer secret and rotate it when it expires.
Every media file is public
Anyone with a file's address can open it. A members-only page doesn't protect the images or PDFs it links to.
Keep private material out of media, and put sensitive data behind a signed-in route.
No image resizing, thumbnails or video transcoding
Files are served exactly as uploaded, up to 100 MiB each. HEIC and TIFF download rather than display, and video isn't converted or streamed adaptively.
Upload web-ready sizes and formats; for long video, host it on a video service and embed it.
Visitors sign in with a Tessryx account
Login with Tessryx is the sign-in for your site. You can't plug in your own user directory, limit a page to an email domain, list who has signed in, or sign a visitor out from the server.
Use the private visitor id to keep each member's records, and workspace roles for anything admin.
No SSO, custom roles or audit log yet
Team sign-in is email and password, or Google. Signing in through your own identity provider (SAML or OIDC), SCIM, roles beyond the five built in, per-folder permissions and an audit log aren't built.
SSO is part of the Scale plan, set up with us when a team needs it.
Two-factor is an emailed code only
There's no authenticator app, passkey, SMS or hardware key, no backup codes, and no way to require two-factor for a whole workspace.
Records and media have no version history
Pages, logic and schemas keep their newest 10 versions plus the published one. A content record keeps only its saved and published copies, and a replaced or deleted file is gone.
Export the app now and then if you want a copy of its content to fall back on.
Publishing doesn't clear cached pages
There is no purge button. A change shows once the cached copy runs out, so the cache time is the longest an edit can take to appear.
Keep cache times short while a page is changing, and raise them once it settles.
No catch-all routes or automatic redirects
Each part of an address matches one path segment, addresses are lowercase, and renaming a page leaves no redirect behind.
Give each depth its own route, and send a 301 from the old address with a small workflow if it matters.
No built-in translations
Fields have no language versions of their own.
Model languages in the schema, for example an object keyed by language code, and have pages pick the right one.
No rate limits or bot checks for your own pages
Tessryx doesn't throttle visitors to your site, and you can't add a captcha to a form. A flood against a page that isn't cached runs its workflow every time.
Cache the pages you can. A cached visit doesn't run anything, so a popular page stays cheap.

Free to start

Connect your AI and build one thing

Most of what's on this page is on the free plan, and where something isn't, it says so. Connecting your AI takes a minute.

Connect in ChatGPT Connect in Claude

Using a different AI? Create a free account and connect it from your dashboard.

Everything Tessryx can do

All features

Building with your AI

Data and content

Editors and forms

Media and files

Pages and APIs

Workflows

AI inside your app

Schedules

Integrations and secrets

Sign-in and access

Domains and hosting

Versions and safety

Runs, usage and billing

Team and account

What Tessryx doesn't do

No database queries or joins

Apps don't export as code you can run elsewhere

No drag-and-drop page builder

No native mobile apps

No built-in email sending or payments

No "run when something changes" triggers

Incoming webhook signatures can't be checked

Query strings, headers and cookies never reach your logic

Plain HTML form posts aren't read

Other websites can't call your routes, and your logic can't set cookies

No websockets or streaming responses

JavaScript in workflows is calculation only

AI steps run on Anthropic models only

Integrations send JSON, and only to the public internet

No "connect your account" sign-in for outside services

Every media file is public

No image resizing, thumbnails or video transcoding

Visitors sign in with a Tessryx account

No SSO, custom roles or audit log yet

Two-factor is an emailed code only