One platform for agents to store data and ship frontends.

What is Launchbase?

Launchbase is the deployable product and shared platform. It owns people, workspaces, projects, memberships, authorization, browser sessions, and audit. Setbase and Shipbase are cohesive product modules mounted on that authority—not separate accounts or services to configure.

Mental model

User
└── Workspace             Launchbase membership boundary
    └── Project           shared namespace
        ├── Collection    Setbase schema + records
        └── Site          Shipbase frontend + deployments

Guidance: Workspace → Project → Collection

Projects connect the system. A single project can hold both a Setbase collection and a Shipbase Site, letting an agent build a frontend backed by validated public-intake records without merging module ownership.

Choose an interface

Prefer MCP when your client supports remote Streamable HTTP servers and OAuth. The user signs in and approves access in the browser; the client handles the resulting credential.

Use HTTP + skills when the agent cannot connect to MCP or needs to implement direct protocol calls. Start from the served Setbase skill, then discover Shipbase when frontend hosting is needed.

# Give this to an MCP-capable client
https://launchbase.remotely.works/mcp

# Give this to any coding agent
READ https://launchbase.remotely.works/skill.md completely and follow its instructions.

HTTP quick start

GET https://launchbase.remotely.works/.well-known/setbase
GET https://launchbase.remotely.works/skill.md
GET https://launchbase.remotely.works/openapi.yaml

Authentication

Bearer tokens

Authenticated HTTP routes use an opaque agent token:

Authorization: Bearer {agent-token}

Never ask a user to paste a token. The Setbase skill defines the portable browser-approved device flow and protected per-user credential storage. Tokens expire after 30 days and do not refresh.

Device flow

POST https://launchbase.remotely.works/v1/device/authorizations
Content-Type: application/json

{
  "clientName": "my coding agent",
  "scopes": ["workspaces:read", "projects:read", "collections:read"]
}

Show the returned verificationUriComplete and userCode to the user, persist the device code outside the project, and stop. After approval, exchange the same request at /v1/device/authorizations/token.

Scopes

• workspaces:read
• workspaces:create
• workspaces:admin
• projects:read
• projects:write
• members:read
• members:write
• audit:read
• collections:read
• collections:write
• records:read
• records:export
• records:write
• guidance:read
• guidance:write
• sites:read
• sites:write
• deployments:write

Launchbase Platform API

The Platform establishes authority used by both modules.

Workspace administration, membership changes, invitation lifecycle, browser sessions, and authorization revocation are specified in the aggregate OpenAPI contract.

Setbase API

Setbase turns JSON Schema into durable, validated collections. Every record permanently pins the immutable schema version used at insertion.

Collections and schemas

POST /v1/projects/{projectId}/collections
Authorization: Bearer {agent-token}
Content-Type: application/json

{
  "slug": "rsvps",
  "name": "RSVPs",
  "mode": "publicIntake",
  "schema": {
    "type": "object",
    "additionalProperties": false,
    "properties": {
      "name": {"type": "string"},
      "attending": {"type": "boolean"}
    },
    "required": ["name", "attending"]
  }
}

Records and public intake

Guidance

Workspace, project, and collection Guidance is versioned, attributed operating context. Read inherited layers at /v1/{resourceType}/{resourceId}/context. Records and public input never become Guidance automatically.

Shipbase API

Shipbase hosts complete frontend deployments. Sites are private by default; making one public is a separate, explicit mutation.

{
  "baseDeploymentId": null,
  "idempotencyKey": "docs-v1",
  "files": [{
    "path": "index.html",
    "contentType": "text/html; charset=utf-8",
    "size": 1234,
    "sha256": "{actual-lowercase-sha256}"
  }]
}

Use every returned siteUrl, upload URL, method, and header unchanged. Upload instructions expire and must not be committed. Finalization performs storage work outside the database, then reacquires live authority before publication.

Agent skills

Skills are URL-served, versioned Markdown operating instructions. They explain safe credential storage, reuse-before-create behavior, one-time secret handling, concurrency recovery, and module-specific workflows that do not fit in an API schema.

HTTP conventions

• JSON requests reject unknown fields; timestamps are RFC 3339 UTC and public IDs are UUIDs.
• Inaccessible tenant resources return 404 to avoid disclosing existence.
• Errors use {"error":{"code":"machine_readable_code","message":"..."}}. Branch on the code.
• Lists are bounded and use opaque cursors. Pass cursors unchanged.
• On 429, wait at least Retry-After seconds and add jitter.
• One-time capabilities, tokens, upload URLs, cookies, and invitation URLs must never be logged.

Connect with MCP

Launchbase exposes a stateless Streamable HTTP MCP server at:

https://launchbase.remotely.works/mcp

Add that exact URL to a remote MCP client. The client discovers OAuth from the protected-resource metadata, opens browser authorization, and stores its own access token. Do not configure a static API key.

For Claude, add a custom connector named Launchbase, use the URL above, connect, sign in with Google, review requested scopes, and select the workspaces you want to share.

MCP authorization

Omitting OAuth scope requests all supported scopes. Review the consent screen carefully. The selected workspace set is a snapshot; later memberships do not expand it.

MCP tool catalog

Up to 109 tools are generated from bearer-authenticated OpenAPI operations and use each operation's operationId as the tool name. Discovery is filtered to the token's live scopes: 49 are Launchbase core tools and 60 are Frontdesk tools.

Useful first calls

• getCurrentPrincipal — verify the identity, scopes, and workspace grants received.
• listWorkspaces and listProjects — find existing resources before creating.
• listCollections / listProjectSites — route work to Setbase or Shipbase resources.
• getGuidanceContext — load current attributed operating context before changing data.

The OpenAPI document is the complete, current catalog, including tool input schemas and exact response shapes.

MCP tool behavior

MCP is a transport facade, not a second implementation. Every tool call is translated into an internal HTTP request and forwarded to the same authenticated router used by the REST API.

• JSON responses are returned as structured content.
• NDJSON exports are wrapped with status, content type, body, and optional next cursor.
• REST failures become MCP tool errors containing the HTTP status and standard Launchbase error envelope.
• Signed Shipbase uploads still happen directly against the returned storage URL, outside MCP and without the bearer token.
• Tool listing shows what exists, not what the current user may execute.

Security model

• Raw access tokens, capabilities, device codes, browser secrets, PKCE values, and invitation tokens are never persisted by Launchbase; only cryptographic hashes are stored.
• Public IDs are not credentials. Public Setbase writes require revocable insert-only capabilities.
• Record bodies cannot select their workspace. Tenant authority comes from the authenticated route context.
• Private Site content requires a live Launchbase browser session; public visibility must be explicitly requested.
• Generated frontend code may contain a public-intake capability, but never an agent token.
• Committed domain mutations append safe audit metadata in the same transaction.

Machine-readable resources

Current limits

Launchbase RC1 has no billing, email or webhook delivery, refresh tokens, record undelete/history API, async exports, object cleanup worker, custom-domain API, or operator support/restoration interface. Operators provide monitoring, backups, recovery, DNS, and storage lifecycle policy.

For exact body, schema, record, pagination, deployment, file, and time limits, consult the current OpenAPI contract and served skills rather than copying values from an older client.