Describe it.
It's live.
Type what you need into the canvas and watch it get built: blocks, real JavaScript, storage, a live URL. Nothing to install and no API key of your own. Or drive the same tools from Claude, Cursor or Kiro over MCP.
Not a code generator that hands you a repo. What it builds is already running: an API, a web page on its own domain, or a job on a clock, with storage, secrets and real-time push included. No server. No Docker. No deploy.
No credit card. Or sign up with email.
Three Kinds of Thing, One Conversation
They're the same blocks underneath. What changes is how the flow starts and what the world gets back.
An API
A live HTTPS endpoint with path parameters, allowed verbs, versions and its own API keys. You control the status code, the headers and the body: JSON, XML, CSV or a redirect.
api.qu4zr.io/orders-api/ordersA web page
An HTML file served verbatim at an address of its own. No JavaScript runs, so a crawler gets exactly the bytes you wrote. robots.txt and sitemap.xml are generated for you.
A scheduled job
A cron expression in your own timezone, pinned to a committed version so a 3am run can't drift with your edits. It pauses itself and emails you if it starts failing.
*/5 * * * * · Europe/ParisYou Describe It. It Ships Itself.
The assistant lives inside qu4zr. Open the panel and type. Nothing to install, no API key of your own. Prefer your own client? The same tools are an MCP server for Claude, Cursor or Kiro.
“Take the Stripe webhook, verify the signature, store the paid invoices, and give me an endpoint that lists this month's.”
create_workspacemakes a place for the flow to liveset_vault_secretstores the signing secret, write-onlyset_workspace_contentadds two blocks and the link between themtest_blockdryRun runs the real engine with the outside world stubbeddeploy_endpointreturns a live URL, an API key and a version tag
Describe
Plain language, in the panel beside your canvas. It already knows every API the runtime offers, because the whole scripting reference is built into the tools.
It builds
Real JavaScript in connected blocks, not a config file. It can provision what the flow needs too: a domain, a vault, the secrets in it.
It tests
Each block runs on sample input in the real engine, and dryRun stubs fetch and sql so iterating costs no live API calls and touches no database. Built a page? It opens it in a headless browser and looks.
It deploys
One call publishes it: production URL, its own domain, API keys, path parameters, request logs, a schedule if it needs one, and a committed version you can roll back to.
It doesn't ask permission for every step. It takes a restore point before it writes anything, and leaves you a one-click undo when it's done.
And You Can See Everything It Wrote
The output isn't a black box you have to trust. It's blocks on a canvas: open one, read the code,
change a line, run it.
The assistant and you are editing the same thing.
Every Run, Logged
Input, output, console.log and errors, per block and per execution. Including what it cost: statements burned, milliseconds, outbound calls, storage operations.
See the Page, Not Just the Markup
A live preview renders what you built in a real headless browser, in its own sandbox, beside the conversation. The assistant looks at it too, and fixes what it sees.
Versioned, With a Timeline
Every change auto-saves; named commits sit on a timeline you can search and restore. A deployed endpoint is pinned to a version, so editing never breaks what's live.
Share the Workspace
Invite people by email as Viewer, Editor or Owner, even before they have an account. They get the canvas, the logs and the endpoints, scoped to their role.
Or Just Build It Yourself
The canvas came first and still works on its own: drag blocks, write JavaScript in a Monaco editor, link them, hit Run. The assistant is an option, never a requirement.
Open One. Read It. Take It.
Workspaces people published. Every block, every line of code, open to anyone — no account needed to look. Fork one and it is yours, running.
URL shortener
Three endpoints and a key-value store. Mints unguessable codes, refuses to become an open redirect, counts follows atomically.
Stripe webhook to Slack
Verifies the signature against the raw body, keeps the events worth reading, posts them to a channel. The signing secret never touches the code.
Password sign-in done properly
PBKDF2 with a per-user salt, a constant-time check that costs the same for an unknown account, rate limits on both the address and the caller, and sessions stored as hashes.
A Whole Backend, Already Wired Up
The reason it can ship in one conversation: the parts you'd normally provision are already there, reachable from a single line of block code.
A Database Per Workspace
Its own SQL database, with nothing to provision: no connection string, no host, no password. Blocks read and write it, and the canvas has a query editor and a schema browser over the same one. Included from Pro up.
db.query("SELECT * FROM orders")Or Connect Your Own
Parameterised SQL against Postgres, MySQL, SQL Server, Oracle or SQLite you already run. The connection string lives in a per-workspace vault; your code only ever holds an opaque handle.
sql.query(MyVault.prodDb, …)Built-In Storage
A key-value store per workspace for state that outlives a run: counters, caches, submissions. Atomic increments and compare-and-swap, optional TTL, batched reads and writes.
store.increment("views")Real-Time Push
Publish to a named channel and every connected browser updates instantly over Server-Sent Events. A stream is charged as one request, far cheaper than polling.
channel.publish("scores", state)Crypto That Matters
HMAC webhook verification, PBKDF2 password hashing, and RS256/ES256 JWT validation against a JWKS URL. The signing key can be a vault handle, so it never enters your code.
crypto.hmacSha256Verify(…)Shared Code & npm
Factor helpers into workspace code files and import them across blocks. Pull in vetted npm packages by pinned version, versioned along with everything else.
Full HTTP Control
Set status codes and headers, return XML, CSV or HTML verbatim instead of JSON, redirect, or serve a static file from the workspace with no execution at all.
Response(body, 201, headers)Ship the Page Too: On an Address of Its Own
A landing page, a status board, a client-facing dashboard. An HTML file served
verbatim at yourslug.qu4zr.com: no JavaScript runs for that request, so
a crawler receives exactly the bytes you wrote.
And the files that make it findable, the platform keeps correct for you.
An SEO Audit With One Answer
Title, description, canonical, headings, duplicate pages across the site. The canvas drawer, the API and your assistant all ask the same authority and get the same verdict, which is advisory and never blocking.
Indexable by Default, Private by Choice
A page is a page and gets no noindex header; JSON, CSS and error replies are kept out of the index automatically. Declare noindex yourself and every surface respects it.
Served From Cache, Revalidated
Static replies carry a strong ETag, so a repeat visit transfers nothing. Serving a file never loads or parses your workspace. It's the gateway's cheap path.
Static Where It Can Be, Live Where It Must
Mix them freely: the page is a file, the numbers on it come from an endpoint next to it, and updates arrive over a stream. Same workspace, same version, one deploy.
It Doesn't Only Wait to Be Called
Give a flow a cron expression and a timezone, and it starts on its own: the second way in, with the same execution, quotas, logs and versioning behind it.
Pinned to a Version
Enabling a schedule pins it to a committed version. A broken endpoint answers its caller with an error; a broken schedule runs at 3am with nobody watching, so it runs the code you approved, not the line you were editing.
It Stops Itself
Five failures in a row, or an exhausted budget, and it pauses, with a notification in the app and an email, because a schedule that auto-pauses is by definition one nobody was watching.
A History You Can Read
Every firing is recorded with its outcome, its duration and its status, timestamped when it was due, so a slow run never drifts off the minute it belongs to.
It's Real JavaScript, Not Boxes and Arrows
Three things that would each be an afternoon of plumbing. Every sample below runs as written. They're lifted from the scripting reference.
// The signing secret is a vault handle, resolved
// server-side, never visible to this block
const sig = (request.headers["x-hub-signature-256"] || "")
.replace(/^sha256=/, "");
if (!crypto.hmacSha256Verify(MyVault.hookSecret, request.body, sig)) {
return Response({ error: "invalid signature" }, 401);
}
store.set("event:" + crypto.randomUUID(), JSON.parse(request.body));
return Response({ ok: true }, 202);// MyVault.prodDb is a Connection secret. The connection
// string appears in neither your code nor your logs.
const rows = sql.query(
MyVault.prodDb,
"SELECT id, email FROM users WHERE id = @id",
{ id: request.params.userId } // always parameterised
);
return rows; // → [ { id: 1, email: "…" } ]// In the block the schedule runs every 5 minutes:
store.set("status", next);
channel.publish("status", next);
// In an Endpoint block, whose whole job is the stream,
// seeded so a page that just connected isn't blank:
return Response.stream("status", store.get("status"));
// On the page you published, reconnecting on its own:
new EventSource(url).onmessage = e => render(JSON.parse(e.data));Need Data That Can't Leave the Building? Run It There
A public qu4zr endpoint can reach an internal database or a legacy system by
executing part of the flow on your hardware.
No VPN. No firewall rules. No exposed ports. Just one outbound connection.
Example: a public endpoint that runs an internal SQL Server stored procedure, with no VPN and no inbound firewall rule.
Public webhook
An HTTPS request hits your qu4zr endpoint.
Your runner
qu4zr calls out over the runner's own outbound connection. The C# handler, which you reviewed, compiled and run yourself, executes on your server and calls the stored procedure.
JSON back
The result returns through the public endpoint. The cloud never connects into your network.
Describe what you want reached. The assistant authors the C# handler and stands the runner up. You approve the sensitive steps.
One-Command Setup
With your OK, the assistant downloads, builds, onboards and launches the runner on your machine. No template to hand-edit: the handler is baked into the download.
Your Code, With Full Local Access
The handler runs unsandboxed on your machine: query internal databases, read local files, reach the internal network. Connection strings stay in the runner's local config and are never sent to qu4zr or the assistant.
Test, Then Keep It Always-On
Launch in test mode and the assistant compiles and verifies the handler on your machine, iterating until it's green. Then install it as a Windows service or systemd unit so your endpoint survives reboots.
Logs Come Home
Everything the local runner logs is captured and visible in the dashboard: input, output and your own messages, alongside the cloud blocks in the same execution.
Four Doors, One Platform
The same services underneath, so nothing is UI-only and nothing is API-only. The doors differ in reach on purpose: the assistant works in the workspace you have open, MCP and REST address any of them.
The Assistant
Built into the canvas, working in the workspace you have open: blocks, files, endpoints, schedules, an SEO audit and a live preview. It acts without asking and leaves you one-click undo. Free builds on Haiku 4.5, Pro picks Sonnet 5 or Opus 5.
open the panel, typeThe Canvas
Drag blocks, write JavaScript in Monaco, link them, run. Code files, an SEO drawer, execution logs and a version timeline are all right there.
qu4zr.com/dashboardMCP Server
A published npm package your own assistant loads. Create workspaces, patch a single block or file, test, provision domains and vaults, schedule, deploy, read logs.
npx qu4zr-mcpManagement API
Versioned REST over OAuth2 client credentials, with scoped tokens for read, write, deploy and execute. Build qu4zr into your own tooling or CI.
POST /api/v1/workspacesDocumented, not guessed: a full scripting reference covering every global available inside a block, its limits and what's blocked, plus an API reference. The assistant's grounding comes from the same pages.
How Does It Stack Up?
The honest comparison isn't feature count. It's what you have to stand up yourself before the first request works.
| What you need | qu4zr | Repo + cloud function | Zapier | n8n |
|---|---|---|---|---|
| Built by an AI assistant, end to end provision, write, test and deploy, with nothing to install | ✅ built in, + MCP | ⚠️ code only, you deploy | ❌ | ❌ |
| Reach private / on-prem systems internal DB or legacy, with no VPN and no open ports | ✅ runner on your infra | ⚠️ VPN or tunnel | ❌ cloud-only | ⚠️ self-host only |
| Publish a web page, not just an endpoint own domain, sitemap and robots.txt generated | ✅ site hosting | ⚠️ a second stack | ❌ | ❌ |
| Start on a schedule cron, timezones, auto-pause when it breaks | ✅ built in | ⚠️ you wire it up | ✅ | ✅ |
| Database, storage & secrets included nothing to provision or bill separately | ✅ SQL database + store + vault | ❌ bring your own | ⚠️ per-app only | ⚠️ self-managed |
| Real-time push to browsers one connection, not a polling loop | ✅ SSE streams | ⚠️ you build it | ❌ | ❌ |
| Real code, and you can read it JavaScript with imports and npm, on a canvas | ✅ | ✅ | ⚠️ limited | ✅ |
| Infrastructure you maintain | None | Pipeline, secrets, monitoring | None | A server |
| Pricing | $0–$29 | Hosting + your time | $20+ | Free + hosting |
Describe It. Ship It.
Your next API, page or nightly job is one conversation away, and it runs where you need it to. Free to start.
Create Free AccountFree tier forever. Upgrade anytime. Cancel anytime.
Get Started Now
No credit card required. Start building in seconds.