Build · Verify · Deploy · Monitor · Operate · Own

The backend you
run yourself.

From schema to production in one workflow. Your database, API and auth from one file, an audit that blocks a deploy that would leak personal data, and a server you own at the end of it.

Start free → Read the docs
Featured on Smol Launch
$ npx crescodb init
✓ schema.cresco · config.json · cresco.db
$ cresco dev
REST API on :3000 · dashboard ready
$ cresco create auth
✓ auth/register.js · login.js · middleware.js · code you own
1 command to a live API
0 critical findings, or the deploy stops
your own $5 box
every backup restored to prove it
What CrescoDB is
Six parts, one workflow

A backend is not finished when the code runs. Most of the work happens after that, and it is the part you get blamed for. CrescoDB is the layer that connects all six.

01

Build

Database, REST API, auth with roles, file storage and realtime, from one schema file.

02

Verify

An access audit reads your rules before anything ships, and refuses a deploy that would expose personal data.

03

Deploy

To a $5 box you rent, over SSH. Docker, the HTTPS certificate and the DNS record, handled.

04

Monitor

Every route watched from inside the app, the server under it, and the URL from outside. The alert names the part that broke.

05

Operate

Backups loaded into a throwaway database to prove they restore, and rollback checked before you need it.

06

Own

SQLite, Postgres or MySQL behind the same schema, and one command that ejects your code and data as plain SQL.

Build, Verify and Own run on your own machine, free. Deploy and Monitor run through CrescoDB Cloud against the server you already rent, with a free tier. Operate's backups and restore checks are on paid plans.

Build
Everything downstream of one schema file

Define your data once. The API, auth, storage, realtime and dashboard come from that file, on whichever database you choose.

Auto REST API

Every model gets full CRUD, bulk insert, filtering and pagination. Zero manual routing, instant endpoints.

Auth + RBAC

JWT login, roles (guest → admin), and per-table access policies enforced on every single request.

Full-code scaffolds

cresco create auth writes real, editable code: register.js, login.js, wired to your DB. Express & Next.js variants included.

Multi-database

SQLite by default; point at PostgreSQL or MySQL from day one. Same schema, same API, no swap at deploy.

File storage

Buckets for uploads: public or private, folders, a dashboard file browser, and an S3/R2 backend for production.

Realtime

Subscribe to live row changes over SSE using cresco.channel('posts').on('created', …), with per-row security respected.

Schema from a sentence

Describe your data in plain English and get a clean, validated schema you review, edit and apply in one click.

Coding agent

An in-dashboard agent reads and writes your project's files and runs commands, with your approval, diffs, and undo.

Auto REST API

Define a model → get the endpoints

Add a model to schema.cresco and the full REST surface is live immediately. No controllers, no routing, no boilerplate.

  • Full CRUD per model: GET, POST, PUT, PATCH, DELETE
  • Filtering, sorting & pagination: ?where, ?limit, ?offset
  • Bulk insert and single-record routes out of the box
  • Consumable from any language over HTTP
Explore the API reference →
GET /posts
POST /posts
GET /posts/:id
PATCH /posts/:id
DELETE /posts/:id
// instant, no code. also ?where, ?limit, ?offset
Auth & RBAC

Real auth in one command

cresco create auth writes complete, editable auth code into your repo: register, login, middleware, wired to your database. Prefer a managed module? cresco add auth enables the built-in version with per-table RBAC.

  • JWT register / login / me, scrypt-hashed passwords
  • Roles: guest · user · mod · admin
  • Per-table access policies enforced on every request
  • Manage users & policies from the dashboard
  • GitHub & Google OAuth on the hosted platform
How auth & roles work →
guest read public
user create & edit own
mod moderate content
admin full access
// "access" per model:
read: "*", write: "user", delete: "admin"
Scaffolds & modules

Install features, not boilerplate

cresco create writes a feature as full code you own. Models merged into your schema, endpoints live immediately. cresco add installs managed, database-aware modules from the registry.

  • Scaffolds: auth, blog, payments. Real files, wired to your DB
  • Framework variants: --express and --next
  • Payments = Paystack + Flutterwave, dev-mode until you add keys
  • Smart schema merges that add missing models & fields, idempotent
  • Private @org registry on Team · marketplace coming soon
Browse scaffolds →
$ cresco create payments
✓ payments/providers.js · routes.mjs
✓ payments table merged into schema
✓ wired into cresco.routes.mjs
$ cresco create blog --next
✓ app/blog pages · posts + comments
Multi-database

Develop on your real DBMS, from day one

SQLite is the zero-config default for local and solo work. Ship on Postgres or MySQL? Point CrescoDB at it from the start. Same schema.cresco, same API, no SQLite-to-Postgres rewrite at deploy.

  • SQLite · instant, zero-config local default
  • PostgreSQL & MySQL · production-grade
  • One schema & API across every database
  • No deploy-time migration footgun
How the schema works →
SQLitePostgreSQLMySQL
// config.json
{ "db": "postgres://…" }
// same schema.cresco, same REST API
Verify

The deploy reads your access rules first.

Nobody reads the access rules. That is how the data gets out. cresco audit reads them for you, offline, from the schema in your repo, before anything is reachable from the internet. Every other tool for this is a scanner you point at a live URL, which only works once you have already shipped the mistake.

  • A table anyone can read is a note. A price list should be public.
  • A table anyone can read that also holds a column about a person is critical.
  • Critical is what stops cresco deploy. It does not warn, it refuses.
  • Fix the rule and the critical clears, and it tells you who can still read every row.
Run it on your own schema, free, no account →
Is my backend safe to deploy? →
$ cresco deploy
Refusing to prepare a deploy — this schema would expose data.
✗ Patient is readable by anyone, and holds email address, phone number, sensitive personal data
  Columns: patient_email, phone, date_of_birth.
  fix: Add "access": { "read": ["authenticated"] } to Patient.
1 critical, 0 warning, 0 note
When it stops being a side project
Ship it to a server you own

Point CrescoDB at any $5 VPS. It installs what it needs, builds your app, gets the HTTPS certificate, and keeps it running. Your data lives on your machine, and your bill is whatever you already pay for the box.

1

Connect

Paste one command into your server. CrescoDB sets up Docker and a locked-down deploy user, and never needs your root password again.

2

Deploy

cresco deploy --server web-1. It builds on the box, health-checks the result, and keeps the previous version so you can roll back.

3

Point a domain at it

We show you the exact DNS record to add, then check it for you. HTTPS is automatic, including behind Cloudflare.

Monitor

It tells you which part broke, not that something did.

Your app runs on the CrescoDB engine, so it is watched from the inside. There is no SDK to install and nothing to add per language. Every request is counted against its route, every query is timed by its shape, and a summary goes out once a minute. When checkout starts failing and the rest of the shop is fine, the alert says checkout.

  • A route alerts when at least half its requests fail over five minutes, not on one bad request.
  • No git? Drop a .zip of the project on the dashboard. It is unpacked safely, checked for open data and secrets left in the code, then built and run on your server. We run the SSH.
  • Divide a server's disk into fixed spaces for different apps, so one app filling its disk cannot fill the server. Disk space only: CPU and memory limits are set per app.
  • Every error, with its stack: a route that throws, a failed query, a request that hangs, a promise nobody handled, a crash. One bug is one row, you hear the first time it appears and again if a fix does not hold. Still no SDK.
  • Your servers are read every five minutes: CPU, memory against what is actually available, every partition, every container.
  • An app that stops reporting, a server that stops answering, a disk at 90%. One alert per problem, not one per check.
  • Email on every plan, Slack and Telegram on paid plans, and you choose which alerts you get.
How production monitoring works →
● POST /checkout is failing in shop-api
14 of 22 requests to POST /checkout returned a server error in the last 5 minutes. The rest of shop-api may be fine; this is the part that is not.
● db-1: /data is 94% full
11.7 GB left on /data. A full disk stops deploys and backups and can corrupt a database.
emailslacktelegram
And from the outside

One incident per problem, from the first alert to fixed.

What your users see is checked from outside your server too, and every problem becomes one incident with its whole story on it, closed by itself when the problem clears.

  • Uptime checks fetch your URL like a visitor: DNS, TLS, time to first byte, the certificate, and whether the page changed.
  • Your own rules, like checkout slower than 800 ms or sign-ups stopping, on top of the ones built in.
  • Acknowledge, investigate, add notes. Silence planned work; our own deploys silence themselves.
  • An alert is retried until it arrives, so a Slack outage does not swallow it.
How incidents and silences work →
Incident  POST /checkout is failing in shop-api
14:02  Opened · 14 of 22 requests returned a server error
14:02  Alert sent · email, slack
14:06  Acknowledged
14:09  Note · payment provider timing out, rolled back to v41
14:14  Resolved · cleared on its own after 12 min
Operate
And the part nobody else does

Every platform tells you "backup succeeded". That only ever means a file got written.

We restore your backup to prove it works

Every night, your database is snapshotted and then loaded into a throwaway database to check it actually restores. If it does not, you hear about it that morning, not during the outage.

We check you can roll back

A rollback is only real if the previous image is still on the server. We test it, without touching your live app or its data.

We read the server, not a guess at it

CPU, memory, disk and what Docker is holding, read off the box itself. And every app's restart count, because a container that crashes and restarts forever looks healthy everywhere else.

Own
Leaving is a command, not a support ticket

Lock-in is not a feature we forgot to add. The exit is built, tested on every release, and documented.

Your code and data, as plain SQL

cresco eject writes a self-contained folder: your code, your data as plain SQL, the engine vendored, a Dockerfile and a compose file. It runs with no CrescoDB account and no dependency on us.

Three databases, one schema

SQLite, PostgreSQL or MySQL behind the same schema.cresco and the same API. Develop on the one you will ship on, from day one, with no rewrite at deploy.

Stop paying and nothing stops

Your database is a file on a server you rent and your code is in your repo, so your app keeps serving traffic exactly as it is. You lose the nightly backups and the alerting, not the app.

What happens if CrescoDB disappears? →
Pro dashboard

A real admin studio, local

Every project ships with a polished dashboard: browse and edit data, design your schema, run SQL, upload files, watch changes live, and manage users, all on your machine.

  • Data browser with inline edit & bulk actions
  • Visual schema editor + a full SQL editor
  • An API explorer that already found every endpoint
  • Storage file browser · live Realtime feed · request logs
  • Users & roles, access policies, migration log
See the dashboard →
Data browser
Schema editor
SQL editor
API Explorer
Storage
Realtime
Logs
Users & roles
Works with your coding agent

Your agent can actually operate this.

Connect Claude Code, Cursor or Codex with one command and they get typed access to the real thing: read your schema, change it, call the API they just generated, and check whether anything is exposed. A hosted backend can only be guessed at from the outside. There is also a built-in assistant if you would rather not leave the dashboard.

  • One command connects your agent (cresco mcp)
  • It reads your real schema, not a description you pasted
  • It can call your running API and read the actual response
  • Every command needs your approval; it runs locally
  • Or use the built-in assistant, included on every plan
Start building →
“Add a comments table linked to posts, and seed 5 rows.”
✓ proposed Comment model (FK → posts)
✓ wrote routes/comments.mjs
✓ ran 5 INSERT statements
// review the diff · apply · or undo
Built for everyone who ships
From a weekend project to a whole org

The same instant backend, scaled to how you work: solo, in a team, or across an enterprise.

Individuals

Solo devs & side projects

Stop wiring boilerplate. Get a database, API, and auth in one command and spend your time building.

  • Free local dev, forever
  • SQLite, Postgres or MySQL
  • Auto REST API + dashboard
  • Auth & roles included
Start free
Startups & teams

Ship MVPs, then scale

Move from prototype to production without a rewrite. Add the coding agent and shared modules as you grow.

  • Built-in API explorer and SQL editor
  • Team workspaces & shared live projects
  • Postgres / MySQL in production
  • Cloud backups & higher AI limits
Start Pro
Enterprise

Scale & support

Our most capable coding model on every big task, unlimited cloud resources, and the support larger teams need.

  • Advanced model first, always
  • Highest AI limits
  • Unlimited backups & projects
  • Dedicated support & SLAs
Contact sales
What you can build
One backend, many shapes

SaaS products

Auth, roles, billing and multi-tenant data. cresco create auth + payments and you're most of the way there.

Internal tools

Admin panels and dashboards over your data, with a real UI from day one.

APIs & backends

Instant REST over any schema, a backend for your mobile or frontend app.

Prototypes & MVPs

Go from idea to a working demo in minutes, then grow it into production.

Everything included
No add-ons, no glue code

It all comes in the box: the workflow, not just a database.

Auto-generated REST API
CRUD, filtering & pagination
Bulk insert & relations
JWT auth & register/login
Role-based access control
Per-row security (RLS)
GitHub & Google OAuth
File storage (buckets, S3/R2)
Realtime subscriptions (SSE)
Request & query logs
Full-code scaffolds (auth · blog · payments)
Express & Next.js variants
JS client SDK (cresco-js)
SQLite, Postgres & MySQL
Production server (cresco start)
Visual schema editor
Full SQL editor
Self-discovering API explorer
Data browser & inline edit
Users, roles & migrations
Schema from a sentence
Coding agent (Pro and up)
Team workspaces & shared projects
Deploy to your own VPS
Automatic HTTPS certificates
DNS setup with checks
One-click rollback
Live CPU, memory & disk
Nightly backups, proven by restore
Production monitoring, no SDK
Uptime checks from outside
Your own alert rules
Incidents & maintenance silences
Alerts by email, Slack, Telegram
Webhooks & audit trail
From zero to API in a minute
Three commands
1

Init

Scaffold a project with cresco init. Schema, config, and a local SQLite DB.

2

Dev

Run cresco dev for an instant REST API on :3000 plus the dashboard.

3

Build

Scaffold features as real code, design schema with AI, and ship: cresco create auth, cresco ai.

Pricing
Building is free. Paying starts when it matters.

Everything on your own machine is free forever, with no card. You pay when an app starts holding something you would hate to lose.

Free
$0

Unlimited local development, 1 app deployed to 1 server you own, and 3 uptime checks.

Pro
$23/mo

Nightly backups we prove restore, alerts that name what broke, uptime checks every minute, and the coding agent.

Team
$65/seat

Shared servers and projects so you are not the only one who can fix it, plus an audit trail.

Enterprise
$499/mo

Unlimited everything, 90 days of restore points, a named contact.

See full pricing →
Questions developers actually ask
FAQ

What database is underneath, and is SQLite scalable?

SQLite is the zero-config default for local dev and read-heavy apps. For production scale you point CrescoDB at PostgreSQL or MySQL from day one and develop against it directly. Same schema, same API, no SQLite-to-Postgres rewrite at deploy.

I don't write Node. Can I still use it?

Yes. Your app talks to the auto-generated REST API over HTTP from any language (Python, Go, Rust, PHP, your frontend). You only need Node installed to run the CLI, the same way you'd need Docker to run a database container.

Is auth really one command?

cresco create auth writes complete, working auth into your repo: register.js, login.js, middleware you can read and edit, not a black box. Want it managed instead? cresco add auth enables the built-in module with per-table RBAC. Express and Next.js variants included.

How does the built-in assistant work?

Chat is included on every plan; the coding agent unlocks on Pro. Each plan comes with monthly Cresco tokens, and your dashboard shows your balance.

Is my code safe with the agent?

The agent is scoped to your project folder, every file edit shows a diff you can undo, and every terminal command needs your approval. It runs locally, on your machine.

Can I use it with my team?

Yes. Team plans (per seat) let you create shared workspaces where everyone works on the same live database, plus a private @org module registry. Enterprise adds our most capable model on every big task, unlimited cloud resources, and dedicated support.

I have never set up a server. Can I still deploy?

Yes, and this is the part we built for you specifically. You rent a $5 box from anywhere (Hetzner, DigitalOcean, Vultr), paste one command into it, and CrescoDB does the rest: Docker, a locked-down deploy user, the reverse proxy, the HTTPS certificate. When you add a domain, we show you the exact record to paste into Cloudflare or Namecheap, then check it for you and tell you what is wrong if it is not working. You do not need to learn Linux to use this.

What does the free plan actually let me do?

Everything on your own machine, forever, with no card: the database, the API, auth, storage, realtime, the dashboard, the scaffolds, and AI chat. On top of that you get one app deployed to one server. What free does not include is automatic nightly backups, and alerts are capped at 50 a month, by email only, with 3 alert rules and 3 uptime checks.

What happens to my stuff if I stop paying?

Nothing stops. Your database is a file on a server you rent, your code is in your repo, and your app keeps serving traffic exactly as it is. You lose the nightly backups and the alerting, not the app. We never hold your data to make you stay.

What does "backups we prove restore" mean?

Most platforms call a backup successful when a file finishes writing. That tells you nothing about whether it works. We take the snapshot, then load it into a scratch database and check the tables are really there. If the restore fails, you get an email that morning, while you still have older copies to fall back on.

From schema to production, on a server you own.

Free on your own machine, forever, with no card. You pay when an app starts holding something you would hate to lose.

Get started free →See pricing