Floot

Built apps take payments through Stripe with checkout, subscriptions, coupons and refunds, ship through Shippo, send and receive email, sign users in with Google or Microsoft, and reach each user's own Gmail, Calendar, Drive, Outlook and OneDrive, with no keys to manage for those services.

Any HTTPS API can be called, with keys entered through a one time link on Floot's site so the AI only ever sees the variable name, and published apps accept inbound webhooks. One Floot app can call another's exported functions once the user connects them, and a fixed outbound IP serves APIs that allowlist callers.

Sourcefloot.com/docs/integrations/whats-built-inread 2026-11-08

The building assistant works through Floot's tools step by step, slow calls return a job ID it can poll or cancel, up to 50 calls run at once per account, and Power sells five times as many agents working in parallel. Apps built on Floot run background tasks on every plan, where one task can start many more, plus timers from one minute to seven days ahead and recurring schedules on paid plans, each capped at 15 minutes a run with no automatic retry. Floot's own editor agent works in Plan, Build and Discuss modes with parallel file operations and queued messages.

Sourcefloot.com/docs/integrations/jobsread 2026-11-08

A new chat rereads the project through file reading and code search tools, Floot's own guides reach the assistant through a tool call, and the assistant can read other projects on the same account, so project context is gathered on each run. Each project carries a system prompt of up to 16,000 characters sent with every change, a design prompt, and notes and plans kept as files in a Docs tab. Apps that need search over their own content can use embeddings for semantic search.

Sourcefloot.com/docs/getting-started/editor-and-previewread 2026-11-08

Each assistant connection carries a permission level, full access, edit without publishing, read only, or a single project, and no tool can spend the customer's money. Nothing publishes automatically and every publish runs an error check first, checkpoints restore or revert code with agent created ones filterable, single files roll back through version history, and databases on paid plans restore to any point in the last seven days with an undo. Preview links last seven days, private publishing serves beta testers, and per tool approval prompts come from the assistant's own client.

Sourcefloot.com/docs/integrations/what-your-ai-can-doread 2026-11-08

Accounts sign in by emailed code, Google, GitHub or Microsoft, with optional authenticator codes and ten recovery codes, and projects have two roles, owner and collaborator, with no view only level, while each assistant connection gets its own permission scope.

Data is encrypted in transit and at rest, stored secrets are also encrypted with AWS KMS and never reach the AI, app passwords use bcrypt, and published apps get security headers, a rate limiting firewall and pinned safe versions of vulnerable npm packages. There is no single sign on or SCIM, and Floot names no SOC 2, ISO 27001 or HIPAA attestation.

Sourcefloot.com/docs/platform/security-and-dataread 2026-11-08

The assistant reads logs through a tool: preview backend requests from the last hour, browser console and network activity, published backend logs for 90 days, push records and job state, and the project view itself has no log screen. Plan and usage tabs track building actions, AI credits and hosting, each project shows credits used, email has delivery logs and a sending health view, and schedules show a cost estimate. When an account reaches a limit, the message names which assistant and project used the actions.

Sourcefloot.com/docs/faqs/troubleshooting-and-support-flowread 2026-11-08

The MCP server keeps no state between calls and issues no session IDs, and the conversation is not stored on the project, so continuity comes from the files, the project's system prompt and an activity record Floot keeps for the life of the project, while annotations last about a day. For apps people build, Floot's in app AI gives agents and chatbots conversation history and memory stored in the app's own database, with no stated lifetime or purge path.

Sourcefloot.com/docs/platform/security-and-dataread 2026-11-08

Apps run on AWS, with the backend on Lambda behind CloudFront and the backend, the Neon Postgres database and files in the US East region, and customers cannot pick another region or a private deployment. Custom domains come on paid plans and wildcard domains on Power. Paid plans can download the code as a zip and run it on a Node server, but every Floot package import breaks the build until it is replaced, so the download is a way off the platform, and mobile builds go out through TestFlight and Google Play.

Sourcefloot.com/docs/platform/reliability-and-limitsread 2026-11-08

Floot has no template library. Public projects can be duplicated as starting points when both owners are on paid plans, and a community showcase lists apps such as Union Worker OS and FileFoxPro. Ready made parts come as built in services for payments, shipping, email, sign in and calendar and drive access, plus an Examples feature that stages app states for review and native plugins such as RevenueCat for purchases inside mobile apps.

Sourcefloot.com/docs/projects/sharing-your-projectsread 2026-11-08

Building starts when a person asks their own assistant in Claude, ChatGPT, Codex, Cursor or another MCP client, or types an idea on the dashboard, which opens a connected assistant with the prompt filled in, and other products can embed Floot for their own users through dynamic client registration. No webhook, schedule or API hands work to the builder on its own. The apps it builds do run on cron schedules, timers, inbound webhooks, received email and realtime events, for as long as the owner's plan pays.

Sourcefloot.com/docs/integrations/build-from-claude-and-chatgptread 2026-11-08

Building runs on whatever model the customer's own assistant uses, and Floot recommends Claude Fable or at least Opus, or ChatGPT Astra or at least Sol. Floot's own editor agent draws on Anthropic, OpenAI, Google, Fireworks, Baseten, Cerebras and fal, with Floot choosing among them. In the apps people build, code picks a text model per call, GLM 5 by default or GPT 6 Luna and Sol, picks among image models, and can bring its own OpenAI or Anthropic key.

Sourcefloot.com/docs/integrations/floot-airead 2026-11-08

The MCP server is the product's interface: streamable HTTP with JSON answers, OAuth 2.1 with PKCE and dynamic client registration, a discovery manifest, and one tool set for every client. Its tools create and list projects, read, write, patch, rename and delete files, add packages and provision databases and storage, run SQL, typecheck and tests, call app functions, capture and drive the preview, generate images, publish and unpublish apps, and create checkpoints. Each call counts as a building action, six tools are free, and there is no REST API or SDK.

Sourcefloot.com/docs/integrations/what-your-ai-can-doread 2026-11-08

A run_tests tool executes Jasmine specs with React Testing Library in a Node VM with a simulated browser, with Floot services stubbed by spies and limits of two seconds a test, 15 seconds a file and 20 files a call, and the assistant writes the specs and fixes what fails. A typecheck tool checks the code before it ships, every publish passes an error check before going live, and the Examples feature stages app states so people can review each one.

Sourcefloot.com/docs/integrations/testing-your-appread 2026-11-08

The assistant drives the live preview in the user's own open Floot tab, taking screenshots, navigating pages and running code in the browser to click through what it built, and that tab has to be in front because Floot runs no hosted test browser. Floot Infinity, a Chrome extension for Floot's editor agent, opens other websites, inspects their designs and sets up integrations by working in the browser on the builder's behalf.

Sourcefloot.com/docs/integrations/connector-troubleshootingread 2026-11-08