One hull, every port, and agent-native.

Server + publishing API + CLI in one file; every heavy backend lives behind a compile-time feature.

Every serve setting is settable from BOATRAMP_* variables (the whole config, layered env > file > default), so a node needs no boatramp.cfg at all, even one running a managed co-located Postgres or issuing a wildcard cert. 12-factor deploys on fly.io, Cloudflare, or any container platform.

Author config in RON or JSON (auto-detected, so you can generate it from Nickel), and stamp an apply manifest with a version: that opts an older document into a loose-parse → migrate → typed pipeline; upgrade it in place with config migrate.

Linux (x86_64 + arm64), macOS, and Windows binaries, an install script, and a Homebrew tap.

A multi-arch, non-root container image at ghcr.io/boatramp/boatramp, a fully-static musl binary with jemalloc, ~49 MB compressed with zero dynamic dependencies (just the binary and CA certs).

A flake, an overlay, and a declarative services.boatramp module with a hardened systemd unit.

boatramp_node::assemble builds the exact serve-node graph the binary runs, so you can embed a full boatramp node (single-node or cluster) inside your own Rust service.

Deploy to Cloudflare over the CF REST API with boatramp cloudflare. No wrangler, nothing generated for you to run: it provisions R2 + D1, uploads the edge Worker + Durable Object, and creates the container app. --dry-run previews the plan.

The same binary ships a Model Context Protocol server, so an agent like Claude (Desktop, Code) or Codex operates your control plane in natural language: list sites, activate or roll back, tail logs, invoke functions, inspect the cluster.

A boatramp mcp stdio subcommand a desktop agent spawns, and a POST /mcp endpoint on boatramp serve to drive a node over the network; on by default, same tool set on both.

One named tool per control-plane operation (no generic passthrough), so every call is legible in an audit log rather than an opaque shell.

Every call runs with the caller's own bearer, re-checked per operation; hand the agent a least-privilege token and the write and fleet-admin tools simply 403. The endpoint grants nothing the token doesn't.

Register several boatramp nodes by name in mcp.toml and address them per request ("on prod, …"); secrets are stored as specs, never resolved into the file.

Turn the HTTP surface off fleet-wide with no restart (config set mcp.enabled false), and a Host-header allowlist keeps it loopback- or origin-only as a DNS-rebinding defence.

Ships an AGENTS.md guide so an AI coding agent (Claude Code, Codex, …) can build a project on boatramp and deploy it out of the box.

A resumable streaming lane for agent UIs and chat / tool-call streams: a client opens an SSE stream and POSTs frames back on the same route, and the host re-enters the guest per inbound frame while owning ordering, buffering, at-least-once redelivery, and resume-from-cursor.