Sign inSign upDeploy now

SpringRoll Docs

The Control Plane and App Portal for AI-built Applications

Deploy AI-built applications safely, connect them to approved company data, and make them available to the right people.

SpringRoll currently deploys to managed Vercel and Cloudflare.

Use the agent you already work with. Connect it to SpringRoll over MCP, deploy the app, and connect it to approved company data.

How it works

Install the skill. Ask it to deploy. Share the URL.

Install the SpringRoll skill in the coding agent you already use, then ask it to deploy your AI-built app. SpringRoll hosts the app and returns a live URL you can share with your team. When the app is ready, you can securely connect it to approved company data without exposing source credentials.

For the bounded handoff and the evidence to keep at each step, read how to deploy an AI-built internal app.

Recommended setup

Install the skill, then ask for the outcome.

The SpringRoll skill covers the full control plane: app records, deployment, promotion, approvals, governed data access, and provenance. On the first live operation, your MCP client opens a browser so you can choose an organization and authorize it; there is no token to copy or store.

  1. Install the SpringRoll skill

    One command teaches your coding agent how to deploy with SpringRoll, request approvals, and access governed data.

    npx skills add springroll-dev/springroll-skill --skill springroll

  2. Ask your agent to deploy

    The agent registers the application, freezes an immutable release, and deploys it. The first live call opens your browser once so you can choose an organization and authorize. There is no token to paste.

    /springroll deploy

  3. Open and share the URL

    SpringRoll returns a live URL your colleague can open, with ownership and approval already recorded.

    https://your-app.comlive

Advanced: Connect SpringRoll MCP manually

Choose your client to configure and authorize the SpringRoll MCP endpoint yourself.

Terminal. One command, then authorize.

  1. 01

    Add SpringRoll

    Run this once, from anywhere.
    claude mcp add --transport http springroll https://springroll.dev/api/mcp
    Then start Claude and authorize. Your browser opens by itself.
    /mcp
  2. 02

    Authorize

    Choose your organization in the browser and approve the connection. No credential is exposed for you to store.

  3. 03

    Deploy

    Ask the agent to register, validate, and deploy the project.

    /springroll deploy

The simplified MCP flow

One deploy call does the heavy lifting.

  1. 01springroll.context

    Check which organization you are acting in and what you are allowed to do.

  2. 02springroll.deploy

    Register the app, capture its release, and start the deployment in one call.

  3. 03springroll.deploy.status

    Follow the build and get the public URL when it is ready.

  4. 04springroll.approval.submit

    Request production approval when your organization requires it.

  5. 05springroll.deploy.promote

    Promote the approved release to production.

  6. 06springroll.connect.data_products

    Find the company data products available to the app.

  7. 07springroll.connect.request_access

    Request a governed view of a data product for the app.

  8. 08springroll.connect.access_status

    Check the grant and learn what the approved app can query.

The everyday path is context, deploy, then status. SpringRoll creates the app record and release as part of the deploy call. Approval is optional by organization policy; Connect stays separate so data access can be granted, limited, or revoked without redeploying the app.

Machine-readable reference

Every SpringRoll interface, at a predictable URL.

Nothing here needs an account. An agent can read all of it before deciding whether SpringRoll is the right tool, and every page on this site is also available as markdown. Request it with Accept: text/markdown.

Detailed API reference
Authentication, versioning, quotas, errors, and the machine-readable descriptions behind the REST and MCP surfaces.
OpenAPI 3.1 specification
The full REST surface. Every operation carries a unique operationId, a description, and typed request and response schemas, so it converts straight into function-calling tool definitions.
API index
An unauthenticated index of every documented endpoint, plus how to authenticate. The right first fetch.
Capabilities
Every MCP tool with its summary and read-only flag, and the current application manifest contract with a worked example.
MCP Server Card
The MCP server, to the SEP-1649 discovery standard: streamable-http transport, endpoint, OAuth metadata, protocol versions, and every tool with a typed input schema. Also answered at /.well-known/mcp.json for clients using the older convention.
Agent instructions
When to reach for SpringRoll, when not to, and the normal call sequence.
llms.txt
The short version of all of the above, in the llmstxt.org format.
Health
Unauthenticated liveness and readiness probe.

Security

The controls stay in the request path.

Security is built into the route between an app and your data. SpringRoll checks the organization, the person, the app identity, and the approved data rules on every request. Change or revoke a grant and the next request follows the new rule; the audit trail shows who changed it.

  1. 01

    Deployment stays governed

    Tenant Admins choose Direct to Production or a staged approval route. Direct deployments skip only the workflow approval: runtime readiness, ownership, support, access, data, configuration, scan, authorization, and provider checks still apply. Staged production deployment, connector access, scope increases, tenant-wide visibility, ownership changes, domain changes, rollback, and retirement require a person. Agent tokens cannot record an approval decision.

  2. 02

    No secret is ever displayed

    Connector credentials, runtime tokens, and secret environment variables are write-only. The interface shows names, scopes, and shapes. An approved connector grant injects environment variables into the deployed application; neither the coding agent that requested the grant nor the person who approved it can read the value back out. Agent tokens and invitation links are shown exactly once, at creation, with the reason stated.

  3. 03

    Organizations are isolated twice

    Multi-tenant from the first migration. Primary isolation is the application's own query scope, which injects and asserts the tenant id on every read and write. Behind it, PostgreSQL row-level security reads a tenant id set inside the transaction and makes a cross-tenant row unreachable even if a future query gets its filter wrong. FORCE ROW LEVEL SECURITY is applied so those policies bind the table owner, which is the role the application connects as. It is a second line of defence for scoped work rather than a substitute for the scope. A schema test suite fails if a policy is dropped.

  4. 04

    The audit log cannot be rewritten

    Every governed action appends an event carrying the actor, the tenant, the resource, the correlation id, and a hash of the previous entry. The chain is verifiable, and database triggers refuse UPDATE and DELETE on the table outright. Pruning requires an explicit session flag an application connection does not have. The question it exists to answer is who deployed what, when, with which permissions, using which data sources.

  5. 05

    Identity comes from your directory

    SCIM 2.0 provisioning for users and groups, plus OIDC and SAML for sign-in. Deprovisioning in your identity provider removes access here. Roles are Tenant Admin, App Creator, App Owner, Approver, and App User, with a separate platform superadmin path that is not a tenant role.

  6. 06

    Agents authenticate like software, not like people

    The remote MCP endpoint implements OAuth 2.1 with PKCE, RFC 7591 dynamic client registration, and RFC 9728 protected-resource metadata. A client discovers the authorization server from the endpoint itself, opens a browser, and receives its own credential. Nobody pastes a token anywhere. Every credential resolves to exactly one membership, so an agent acts as a named person and inherits only that person's permissions.

  7. 07

    Where enforcement reaches

    SpringRoll controls who can discover and launch an application through the App Portal, and which approved data and connector grants that application holds. A provider URL is not behind SpringRoll. Anyone who knows a deployment's own hostname reaches the provider directly, so treat that hostname as reachable and put nothing behind it that the grant model is not already protecting.

Things the control plane refuses

  • Redirect URIs must be https, loopback http, or a reverse-domain private-use scheme. Clients registering a bare custom scheme are refused, because two of them could collide and receive each other's authorization codes.
  • Authorization is enforced server-side. The interface never hides an action the server would allow, and never offers one it would refuse.
  • Promotion always references an immutable release. There is no deploy latest operation that quietly rebuilds from a branch that has moved.
  • Requests are rate limited before authentication as well as after, so an unauthenticated flood is bounded.

These are current product controls. SpringRoll does not claim a certification, compliance status, benchmark, uptime figure, or availability commitment here.

Start in development

Connect an agent and ship to production in minutes.

Deploy nowSign up