# Features > Every capability Scribase ships, grouped by data plane, platform, and agent operations. Source: https://scribase.com/features ## The data plane The APIs your app already speaks. Your client SDK, CLI scripts, and generated types point at Scribase by swapping the URL and keys. ### PostgreSQL database A full PostgreSQL instance per project with the relational model you already know: SQL, foreign keys, views, and extensions. Row-level security is first-class, and policies are linted for cost so a slow policy never surprises you in production. - Standard Postgres connection string plus the /rest data API - Row-level security with policy-cost linting - Extensions, views, functions, and full referential integrity ### Authentication A drop-in auth service on the /auth paths: email/password, magic links, and OAuth providers issuing standard JWTs. User IDs are preserved on import, so existing sessions and password logins keep working after a move. - Wire-compatible /auth endpoints and JWT claims - User IDs preserved on import — no forced password resets - Works unchanged with the standard client auth helpers - Sign-in email sent for you with a daily cap and a delivery log; `npx scribase add email` sends a proof to your own address ### Object storage Store and serve files through a wire-compatible Storage API. Buckets honor row-level access rules, and object bytes and metadata travel with every export and import so storage is never left behind. - Wire-compatible bucket and object API - Policy-aware public and private buckets - Bytes and metadata included in export/import bundles ### Realtime Subscribe to database changes and broadcast on channels using the standard realtime protocol. Clients built on existing realtime subscriptions connect without code changes. - Postgres change data capture on the /realtime path - Broadcast and presence channels - Compatible with existing realtime clients ### Edge Functions Run server-side logic close to your data on the Deno edge-runtime, served on the compatible /functions/v1 path. Deploy, list, and invoke functions through the /v1 API and the TypeScript SDK. - Compatible /functions/v1 routing - Deploy, list, and invoke over the /v1 API - Same database and JWT secret as the rest of the stack ## Platform and workflow The operations layer that makes the data plane trustworthy: branching, migration, portability, and verified recovery. ### Preview branches Every pull request can get an isolated preview environment, not just a database branch. Branches are secret-scrubbed and swept on a TTL when the pull request closes, so stale environments never pile up or leak credentials. - Full preview environments: DB + auth + storage - Secret-scrubbed and TTL-swept automatically - Copy-on-write branches with scale-to-zero compute ### Import an existing project scribase import connects to a live hosted Postgres project with its ref and service key and moves schema, data, auth.users, storage objects, and RLS policies. Edge functions move from your local functions checkout with --functions-dir. Run it with --dry-run to see exactly what will and will not move before committing. - Schema, data, auth users, storage objects, and policies - User IDs preserved so JWTs and foreign keys stay valid - --dry-run preview and resumable transfers - Edge Functions deployed from your local checkout with --functions-dir ### Full-stack export scribase export produces a runnable bundle — schema, table data, auth identities, storage bytes, RLS policies, grants, and roles — with a checksummed manifest so you can verify the bundle before you trust it. Portability is a product feature, not a support ticket. - Whole stack, not a database-only dump - SHA-256 manifest for verification - Boots elsewhere from one bundle ### Verified restore Every verified restore comes with proof: row-count parity, SHA-256 checksums, policy parity, and a real login. The same discipline powers export, so "it restored" and "it works" are the same claim. - Included, not a per-month add-on - Row-count, checksum, and policy parity evidence - Login proof after restore ### Portable backups Backups are portable logical bundles with SHA-256 evidence, aligned with the export format. A backup you can move is a backup you can trust. - Portable logical format with checksums - Shares the export/restore verification pipeline - No proprietary snapshot lock-in ## Agents and operations One control surface for humans and agents, and an operator model built for least privilege and bring-your-own-cloud. ### Agent-native control surface Scribase is designed so an agent can operate it as safely as a person. Every mutation is expressible on the CLI, mapped to an OpenAPI operation, carries an idempotency key, and returns an operation ID — with an approval model for sensitive actions and support for MCP-driven workflows. - CLI + OpenAPI parity for every mutation - Idempotency keys and operation IDs on every change - Approval model and MCP-friendly workflows ### Control API and CLI The scribase CLI and the authenticated /v1 control API sit over a durable Postgres executor, so operations survive restarts and can be audited by their operation IDs. The same surface manages organizations, projects, environments, previews, branches, migrations, backups, imports, and exports. - Durable executor — operations survive restarts - Auditable by operation ID - Single surface for projects, environments, branches, and migrations ### Bring-your-own-cloud Under a written agreement, our Helm chart runs the control and data planes in your own cluster with the same verified restore and preview features as the managed cloud. The control plane never requires cluster-admin inside your workloads. - Helm chart for the full control + data plane - Least-privilege operator role model - Same restore and preview features as managed