01 · Publish
Hand cyantula a URL, a zip or a conversation. It builds and runs the app behind the gateway.
THE PLATFORM
Auth, hosting and integrations, built once, switched on per app.
cyantula is the wall and the engine for every app your colleagues build: it authenticates the visitor and runs the app behind the same door.
ONE DOOR
One door, no password in the app
cyantula puts Google login, locked to your Workspace domain, in front of every app. Each request reaches the app with verified identity headers (email, name, role) plus a signed identity token, and the gateway strips any identity header a client sends itself. The app never writes login, and it never handles a password.
Request headers the app receives:
X-cyantula-email: alex@yourcompany.com
X-cyantula-name: Alex De Smedt
X-cyantula-role: editor
X-cyantula-token: eyJ...
HOSTING & DEPLOYS
Hosting and deploys, in the platform
cyantula runs the app behind the gateway, so hosting is not a second tool you wire up. Publishing is a URL, a zip or a conversation. Deploys, rollback and backups live in the platform, not in the app the colleague wrote in an afternoon.
INTEGRATIONS
Integrations, switched on per app
Everything you would otherwise bolt onto each app separately sits in the platform once: mail, Slack, Jira, HubSpot, an LLM, cron, a status page, feedback and usage statistics. You turn each one on per app with a tick, instead of wiring the same integration again for every tool.
AI LAYER
Built to be operated by an AI agent
cyantula ships with an MCP server, so Claude Code and other coding agents publish, repair and manage apps through the same door as a person. The agent is a real user of the platform with its own governance, not an add-on bolted onto a dashboard built for clicks.
MCP tool call
cyantula.publish({
source: "https://github.com/…",
app: "budget-tracker",
domain: "yourcompany.com"
})GOVERNANCE
Governance and visibility for IT
IT gets a view of what is running and control over it, per app, without becoming the bottleneck that has to review every app first. The choice is no longer shadow-IT on a laptop or IT reviewing everything; cyantula answers both at once.
What IT sees, per app
- Apps running
- 7
- Teams with access
- 3
- Last deploy
- 12m ago
- Login
- Workspace domain
HOW IT WORKS
How it works
Three steps take an app from a laptop to behind your login.
02 · The wall goes up
Google login locked to your Workspace domain sits in front, and the app starts receiving verified identity headers.
03 · Switch on what you need
Turn integrations on per app with a tick: mail, Slack, backups, an LLM and more.
WHERE IT FITS
Where cyantula fits next to the tools you know
cyantula does the whole job in one product: the wall, the hosting, the integrations, the AI layer and the governance. The tools below each do part of it well, and this is not a knock on any of them. The difference is what cyantula does together.
| Capability | cyantula | Coolify / Dokploy | Cloudflare Access / Pomerium | Posit Connect | Retool |
|---|---|---|---|---|---|
| Identity wall (auth gateway) | yes | they stop at the container | yes | yes | yes |
| Hosting and deploys | yes | yes | they stop at the sign-in wall | data apps only | builds inside Retool |
| Shared integrations per app | yes | wire each app separately | wire each app separately | not shared across apps | within Retool only |
| AI agent layer (MCP) | yes | dashboard built for clicks | no agent interface | no agent interface | no agent interface |
| IT governance and visibility | yes | per-server, not per-app | access rules only | per-tool, not per-app | within Retool only |
- Coolify and Dokploy run the container, but put no identity wall in front of it.
- Cloudflare Access and Pomerium authenticate before the app, but do not host or run it.
- Posit Connect publishes data apps behind SSO, but not arbitrary apps and shared integrations.
- Retool has you build inside Retool, within its components and its lock-in.
- cyantula is the wall, the engine, the integrations, the AI layer and the governance in one place.
Frequently asked questions
Does my app implement login?
No. cyantula puts Google login in front of every app and hands the app verified identity headers (email, name, role) plus a signed token. The app never touches a password or writes its own auth.
What integrations are included?
Deploys, rollback, backups, mail, Slack, Jira, HubSpot, an LLM, cron, a status page, feedback and usage statistics. They sit in the platform once and switch on per app with a tick.
How do I publish an app?
With a URL, a zip or a conversation. cyantula runs the app behind the gateway, and deploys, rollback and backups live in the platform instead of in your app.
How is this different from a PaaS or an identity proxy?
A PaaS runs the container but puts no identity wall in front. An identity proxy authenticates but does not host or run the app. cyantula is both the wall and the engine, with the integrations already wired in.
Can an AI agent operate it?
Yes. An MCP server lets Claude Code and other coding agents publish, repair and manage apps through the same door, with the same governance as a human user.
Is there self-serve signup yet?
Not yet. We onboard every team by hand, and sign-in is locked to your Google Workspace domain. Book a demo or ask for early access to start.
Does the app ever see a credential?
No. The app never sees a password and never holds a platform credential. The gateway strips every identity header a client sends and replaces it with verified ones.
See it running behind your login
Book a demo for a walk-through, or get early access to be one of the first teams we onboard by hand.