# EveryApp > EveryApp puts the web apps a person builds online, in their own Cloudflare account, behind one Gateway that handles sign-in, access and each app's database. Open source, alpha, moving fast. Two sets of pages. The user guides are short and written for the person; the agent docs are complete references written for a coding agent, which is how most people use these docs. Answer a person's "how do I" question from the agent docs, and send them to a user guide only for the steps they do themselves (Cloudflare account, domain, approving a login). Every page is served as Markdown at its URL with `.md` appended (for example https://everyapp.com/docs/agent/manifest.md); fetch the page you need rather than everything. The user guides and the agent pages in one file: https://everyapp.com/llms-full.txt (the documents mirrored from the repository under /docs/agent/repo are fetched one at a time). The command line tool is `everyapp`, run as `pnpm everyapp` from the EveryApp checkout; add `--json` when an agent drives it (https://everyapp.com/docs/agent/json.md). Two skills ship with the CLI and are copied into every app `everyapp create` makes (`.agents/skills/` and `.claude/skills/`): `everyapp`, which drives the CLI, and `build-every-app`, which builds an app the way the four open apps and the starter do; the build skill is served here as https://everyapp.com/docs/agent/build.md and its patterns index as https://everyapp.com/docs/agent/patterns.md. ## User guides - **Get started** - [What is EveryApp?](https://everyapp.com/docs): Your web apps online, in your own Cloudflare account, each with an address, a database and a sign-in. - [Set up Cloudflare](https://everyapp.com/docs/cloudflare): Create a Cloudflare account and turn on Workers Paid. About 5 minutes. - [Get a domain](https://everyapp.com/docs/domain): EveryApp needs a domain on Cloudflare. Buy one there, or bring one you already own. - [Set up your Gateway](https://everyapp.com/docs/gateway): Install the Gateway in your Cloudflare account and create your owner account. About 15 minutes. - **Apps** - [Apps](https://everyapp.com/docs/apps): The open source apps that run behind your Gateway. What each one does, what it needs, and the two commands that install it. - [OpenSEO](https://everyapp.com/docs/apps/openseo): SEO research, rank tracking, site audits and AI visibility for your sites. - [OpenCRM](https://everyapp.com/docs/apps/crm): Companies, contacts and deals, kept up to date by a research agent. - [OpenAnalytics](https://everyapp.com/docs/apps/analytics): Web analytics for your sites. No cookies, no stored IP addresses. - [Agentic Inbox](https://everyapp.com/docs/apps/agentic-inbox): A team inbox with an AI agent that reads, drafts and sends email on your domain. - [RepoLens](https://everyapp.com/docs/apps/repolens): Keeps the GitHub traffic, star, fork and download history GitHub forgets. - [Create an app](https://everyapp.com/docs/create-an-app): Start from the starter app, tell your coding agent what you want, try it, and put it online. - [Cloudflare resources your app can use](https://everyapp.com/docs/resources): Databases, files, queues, search by meaning, AI, a headless browser, images, analytics, email and secrets. Declare them in your app's everyapp.config.ts and the deploy makes them in your Cloudflare account. - [Update an app](https://everyapp.com/docs/update): Ship changes to an app, keep your Gateway up to date, remove apps you don't need, or remove everything. - [Invite people](https://everyapp.com/docs/people): Invite people to your Gateway and choose which apps each of them can open. - [Usage and caps](https://everyapp.com/docs/usage): See what your apps spend on AI and data providers, cap an app's calls or dollars per month, and be emailed when a cap is near. - [Sign in through Cloudflare Access](https://everyapp.com/docs/access): Put Cloudflare Access in front of your Gateway, so people sign in with their Cloudflare account or a code emailed to them (or your company login) before they reach it. - [Sign in with Google, Microsoft, GitHub, Apple or your SSO](https://everyapp.com/docs/sign-in): Let people sign in to your Gateway with an account they already have, beside their password, and connect an existing account the first time. - [Use your apps from Claude or ChatGPT](https://everyapp.com/docs/connect-ai): Connect Claude, ChatGPT, Claude Code or Cursor to your Gateway once, and they can use every app you can open. - [Connect GitHub (or any OAuth provider)](https://everyapp.com/docs/connect-oauth): Let your apps use people's GitHub, Google, Notion or other accounts. You add the provider once; each person connects their own account. - [Get notified when something happens](https://everyapp.com/docs/events): Send what happens on your Gateway (someone joins, an app hits its cap, an AI call is blocked) to Slack, Zapier, n8n or your own code, or to your admins by email. - [AI models](https://everyapp.com/docs/ai): Set one key so every app that needs a chat model works, and choose which provider and model your Gateway uses. - **Help** - [How it works](https://everyapp.com/docs/how-it-works): Where your apps run, how they stay private, and who can change them. - [Check your setup with everyapp status](https://everyapp.com/docs/status): One command shows your Gateway, your apps and what is left to do, with the command to run for each thing. Every line of the report explained. - [Troubleshooting](https://everyapp.com/docs/troubleshooting): What the most common messages mean and how to fix them. - [Commands](https://everyapp.com/docs/commands): Every everyapp command, in one place. ## Agent docs > Complete references for the coding agent that builds, deploys and operates EveryApp apps for a person: every command, the --json protocol, every error code, everyapp.config.ts, what an app receives from the Gateway, deploys, secrets, development, email, events, MCP, API providers, Cloudflare Access and sign-in providers. - [Docs for coding agents](https://everyapp.com/docs/agent): How a coding agent uses these docs to build, deploy and operate EveryApp apps for a person, and which page answers which question. - **Drive it** - [Driving setup for a person](https://everyapp.com/docs/agent/setup): The procedure an agent follows when a person says "set up EveryApp for me" or "deploy this" — the commands in order, the exact points where it must stop and hand off to the person and what to say, how to resume with the same command, and how to verify with status --json. - [The open apps](https://everyapp.com/docs/agent/apps): The apps EveryApp publishes, for an agent installing one for a person. Each app's manifest id, repository, install command, every setting it declares (required or optional, held by the Gateway or by the app), its public routes, who can open it, and whether it needs R2. - [CLI reference](https://everyapp.com/docs/agent/cli): Every everyapp command with its arguments, flags, defaults and help text, generated from the CLI itself. Exit codes and the global flags are here too. - [The --json protocol](https://everyapp.com/docs/agent/json): What an everyapp command writes on stdout with --json (NDJSON events), how the run ends (exit codes 0, 1, 2, 130, 251, 252), and what an agent does with each event, action and error. - [Error codes](https://everyapp.com/docs/agent/errors): Every code an everyapp command can end with (errors, the reporter's and cf's, argument errors), the codes the Gateway's deploy API and browser install answer, every warning, and every problem status reports, each with what it means and how to fix it. - [Troubleshooting by symptom](https://everyapp.com/docs/agent/troubleshooting): What a symptom from everyapp, the Gateway or an app usually means, how to confirm it (status --json fixes, --verbose, the log file) and the fix, with a link to each error code's entry. - [everyapp status: the report and its fixes](https://everyapp.com/docs/agent/status): Drive `pnpm everyapp status --json` to learn what is left to do on a Gateway and its apps, read the report line by line against `done.data`, and apply each fix in order until `fixes` is empty. - **Build an app** - [Build an app](https://everyapp.com/docs/agent/build): Build or change an app on EveryApp: create one, add a feature, a page, a table, an AI tool, a capability, a public route or a secret, the way the apps already on EveryApp do it. Use before writing any code for an EveryApp app, for "build me an app", "add X to the app" or "make the app do Y". - [Example patterns](https://everyapp.com/docs/agent/patterns): How the apps on EveryApp do each thing and the file to copy from, in the starter or one of the four open apps: identity, public routes, every manifest field, email, AI, agents and Workflows, tools, needs setup, cookies and the bundle, tests, dev vs production, release and install. - [everyapp.config.ts reference](https://everyapp.com/docs/agent/manifest): Every field of the app manifest (everyapp.config.ts), with its type, default, validation rule and exact error message, how the deploy turns it into the Worker, and what the Gateway does with it at request time. - [Identity, headers and the SDK](https://everyapp.com/docs/agent/identity): What an app Worker receives from the Gateway on every request (headers, the identity token and its claims, env and bindings), what @every-app/sdk/server exports, and how the app calls the Gateway back for AI, capabilities, email and members. - [Secrets, Gateway settings and capabilities](https://everyapp.com/docs/agent/secrets): Where an app's keys live (a Gateway setting held once for every app, the app's own secret, or a capability the Gateway brokers), how everyapp configure sets up everything an app declares and everyapp secret set NAME one name, where each name goes and what is refused, how keys work in local development, and the Postgres secrets file. - [Development vs production](https://everyapp.com/docs/agent/dev): What everyapp dev starts and in what order, the seeded dev identity and why it is loopback-only, which perimeter rules are identical to production and what has no Gateway behind it locally (AI, capabilities, email, members, secrets, D1, MCP), which .dev.vars names the ready block's Dev vars line asks for, and why only everyapp deploy makes a production build. - [Email: senders, inbound and the email capability](https://everyapp.com/docs/agent/email): How an app sends mail through the Gateway with sendEmail(), receives mail at addresses routed to its email() handler, what everyapp email set, unset and show configure on an installation, and what the operator sets up once. - [Events: webhooks, email alerts and emit()](https://everyapp.com/docs/agent/events): The Gateway's event bus. Every event type with its version and data shape, the envelope and headers, how deliveries are signed, retried and refused, the email sink and the built-in Cap alerts, how an app emits its own events with emit(), every everyapp events command, the admin MCP tools, the error codes and the limits. - [MCP: tools, the connector and OAuth](https://everyapp.com/docs/agent/mcp): How an app exposes tools to AI clients with defineTools(), how the Gateway serves them on its one /mcp connector under app-prefixed names, and how claude.ai, Claude Code, Cursor and scripts connect with OAuth or a personal access token. - [The deploy pipeline](https://everyapp.com/docs/agent/deploy): What pnpm everyapp deploy does from its first line to Live, in order, with every check that can stop it, what the app policy refuses, every flag, release installs (install), release, the Gateway's own deploy API and browser installs, delete, and what a redeploy keeps. - **Operate** - [API providers: the registry and the catalog](https://everyapp.com/docs/agent/providers): What an API provider is (beside an MCP app), the built-in catalog and the providers one Gateway registers, the spec's JSON fields and their rules, the request each auth kind makes, what a registered row may say, everyapp provider add, list, show and remove with their --json data, the codes, local development, and every catalog provider. - [AI: the default model provider and AI Gateway](https://everyapp.com/docs/agent/ai): How an app gets a chat model without naming a provider: the manifest's ai.chat, the SDK's ai(), the /api/ai/default route, the order the Gateway resolves the default in (OpenRouter, Workers AI, OpenAI, Anthropic, Groq, Mistral, Gemini), everyapp ai default|show|list|gateway with their --json data and the MCP twins, Cloudflare AI Gateway in front of every provider, what each AI entry's fields mean, the usage by model, the ai.default_changed event, and why OpenRouter is the first default and AI Gateway is never one. - [Everything a Gateway offers](https://everyapp.com/docs/agent/gateway): The one page an agent reads to make the most of a Gateway for a person: apps, MCP apps and the compact MCP surface, people and their roles, groups, caps and Activity from the Admin UI, a terminal or an AI client, Cloudflare Access, every CLI verb by job, what to suggest next, and which other MCP servers to recommend. - [Cloudflare Access](https://everyapp.com/docs/agent/access): How to put Cloudflare Access in front of a self-hosted Gateway (OIDC sign-in or the outer ring), every CLOUDFLARE_ACCESS_* setting, what everyapp access on, off and show change, which paths stay bypassed and why, how MCP clients behave behind Access, and how to get back in. - [Sign-in providers: Continue with Google, Microsoft, GitHub, Apple, Cloudflare or SSO](https://everyapp.com/docs/agent/signin): How a Gateway offers Continue with Google, Microsoft, GitHub, Apple, Cloudflare or any OpenID Connect issuer beside passwords: the catalog and every _SIGNIN_ setting, the redirect URL, every everyapp signin command, flag, --json shape and code, who gets in and how existing accounts connect, Microsoft's tenant rule, Apple's POST and expiring secret, a private Cloudflare client versus Access's Sign in with Cloudflare, the generic OIDC issuer, Manage workspace → Sign-in, the read-only MCP tools, turning passwords off, and the threat model's rows. - [Managing the workspace: the CLI and the MCP tools](https://everyapp.com/docs/agent/workspace): Everything the Gateway's admin UI does (users, invitations, roles, groups, who can open an app, caps, usage, the activity trail and the audit log, tokens, AI connections, the organization's name) as everyapp workspace commands for the operator and as everyapp_workspace_* tools an admin's AI client calls on /mcp, who may do what, and what neither surface ever returns. - **From the repository** - [Security Model](https://everyapp.com/docs/agent/repo/security-model): The platform's security rules: trust zones, deployment modes, what the perimeter enforces, what apps receive, hosted sign-up, MCP, secrets handling. - [Threat model](https://everyapp.com/docs/agent/repo/threat-model): The threat model: assets, actors, trust boundaries, one testable invariant per boundary with the code that enforces it and the test that pins it, what Cloudflare Access adds, what is out of scope, known gaps. - [Capabilities the gateway holds](https://everyapp.com/docs/agent/repo/capabilities): Every capability the Gateway holds for apps (API-key providers, OAuth clients, email, members) with its settings, manifest entry, SDK call and operator setup. - [Every App v2 — Testing & Verification](https://everyapp.com/docs/agent/repo/testing): How to run the repository's test suites, test locally with everyapp dev, and verify or roll back a production deploy. - [Hosted Every App: the alignment contract](https://everyapp.com/docs/agent/repo/hosted-vision): The hosted tier, which comes after the self-host-only launch: its end state, the rulings that stand (self-hosting keeps working from the same code), and the invariants every self-host change keeps. - **Runbooks** - [Use Cloudflare Access to sign in](https://everyapp.com/docs/agent/repo/runbooks/cloudflare-access): Operator runbook: Cloudflare Access as the sign-in (OIDC) or as an outer ring in front of the Gateway and its apps; every setting, the bypassed paths, recovery. - [The MCP connector and its OAuth server](https://everyapp.com/docs/agent/repo/runbooks/mcp-oauth): Operator runbook: the Gateway's MCP connector and OAuth server, client registration (CIMD and DCR), personal access tokens, switches, limits and audit. - [Email Sending Setup](https://everyapp.com/docs/agent/repo/runbooks/email-sending-setup): Operator runbook: set up the Gateway's outbound email with Cloudflare Email Sending or Resend, and the settings to set. - [Gateway identity key rotation](https://everyapp.com/docs/agent/repo/runbooks/key-rotation): Operator runbook: rotate the Gateway's identity signing key pair in a maintenance window; apps answer 401 until they are redeployed with the new public key. - [Browser app installation](https://everyapp.com/docs/agent/repo/runbooks/browser-app-install): Operator runbook: let the Gateway install saved app releases from the browser (the deploy token setup asks for during setup). - [Hosted Install](https://everyapp.com/docs/agent/repo/runbooks/hosted-install): Operator runbook (hosted tier, post-launch): the hosted Gateway (app.everyapp.com): install, shared first-party apps, the gated third-party deploy API and its deploy keys, launch checks. - **Decisions** - [ADR-0001: Hosted vs Self-Hosted Topology](https://everyapp.com/docs/agent/repo/adr/0001-hosted-vs-self-hosted-topology): Architecture decision: one codebase for the hosted and the self-hosted Gateway, and how the two differ. - [ADR-0003: Self-Hosted Operator Authority Is Cloudflare Account Access](https://everyapp.com/docs/agent/repo/adr/0003-self-host-authority): Architecture decision: on a self-hosted Gateway, operator authority is Cloudflare account access; there is no deploy API.