# Roadmap

> The public Scribase roadmap: shipped, in progress, planned, and considering, labeled honestly.

Source: https://scribase.com/roadmap

## shipped

- **Control API (OpenAPI)** (Q3 2026) — Full OpenAPI surface for every management action — projects, migrations, functions, secrets, backups, and billing. Every mutation carries an idempotency key and an operation ID for safe agent and CI use.

- **Verified restore with evidence** (Q3 2026) — Recovery proves itself. Each restore ships row-count parity, SHA-256 checksums, policy parity, and a real login proof — artifacts you can inspect and show auditors rather than a green checkmark you have to trust.

- **Preview branches** (Q3 2026) — Instant copy-on-write preview environments scoped to a pull request. Branches are stripped of production secrets on creation and swept on a TTL when the PR closes, so stale branches never become credential leaks.

- **Import and export bundles** (Q3 2026) — scribase import moves schema, data, auth users, storage objects, and RLS policies with IDs preserved — no forced password resets. scribase export produces a portable bundle that boots elsewhere.

- **Agent-native scribase CLI** (Q3 2026) — One binary for local and hosted work: scribase dev boots Postgres, auth, storage, realtime, and functions locally; branch, migrate --dir, import, export, queue, and schema commands drive the /v1 API, and every mutation returns an operation ID.

- **RLS policy cost linter** (Q3 2026) — Warns when a row-level security policy will cause a full-table scan so teams keep isolation switched on without paying for it in query latency.

- **Edge-function deploys over the API** (Q3 2026) — Deploy, list, and invoke an environment's edge functions through the authenticated /v1 API and the scribase TypeScript SDK (functions.deploy, functions.list, functions.invoke), on the Deno edge-runtime and the standard /functions/v1 path.

- **MCP server** (Q3 2026) — scribase-mcp exposes the control surface to AI agents over the Model Context Protocol: reads run immediately, every write waits for an explicit confirm, and schema changes must pass an RLS isolation test first. Setup lives at /mcp and in the console under MCP server.

- **SSO (SAML 2.0 / OIDC)** (Q3 2026) — Console single sign-on through your own identity provider over OIDC or SAML 2.0. Verify your email domains with a DNS record, let people on them join automatically with a role you choose, test the connection, then require SSO for everyone but owners. Configure it in the console under Single sign-on.

- **Team audit logs** (Q3 2026) — Append-only organization audit log of every mutating API call — actor, action, resource, and time. Filterable in the console under Audit logs and paginated over GET /v1/organizations/{org}/audit-events for SIEM ingestion or DPA evidence.

- **Familiar CLI command parity** (Q3 2026) — Matching verbs for the backend CLI workflows teams script today, so existing Makefiles and CI pipelines move over with a URL-and-keys swap: scribase functions deploy, scribase secrets set, scribase migrate --dir, scribase db pull, scribase gen types, and scribase login all ship today.

- **BYOC Helm chart** (Q3 2026) — By written agreement, run Scribase inside your own Kubernetes cluster with our Helm chart: the control plane always, plus an optional shared data plane. Same verified restore and preview capabilities as managed Scribase, with least-privilege operator roles and no cluster-admin in workloads.

- **Password reset for built-in sign-in** (Q3 2026) — Members who sign in with a password can reset a forgotten one: an administrator creates a single-use reset link for a member, and when mail is set up members can request an emailed link from the sign-in page.

## planned

- **Edge functions in the console import wizard** (Q4 2026) — The CLI already moves an imported project's edge functions from your local checkout (scribase import --functions-dir). The console import wizard will get the same step: upload a functions directory or archive and deploy it through the normal function deploy.

- **Metrics dashboard** (Q1 2027) — Built-in Postgres and application metrics — connections, query latency, storage IOPS — surfaced in the console without requiring an external Grafana stack.

- **Query insights** (Q1 2027) — Slow-query capture and index recommendations driven by pg_stat_statements, surfaced directly in the console so slow queries are visible without a separate monitoring tool.

- **Multi-region read replicas** (Q2 2027) — Attach read replicas in additional regions to reduce latency for globally distributed applications without duplicating the full write path.

## considering

- **Terraform provider** — Official Terraform provider for managing Scribase projects, secrets, custom domains, and team members declaratively alongside other infrastructure.

- **GitHub Actions integration** — First-class GitHub Actions for migration preview, deploy, and smoke-test so CI pipelines stay consistent with local scribase CLI flows without custom shell scripts.