create-dpas-appAgentic apps that operate the product, not the DOM

One command scaffolds a Dual-Plane Agent Stack application — semantic capabilities on both sides of the network, an agent host you own, server-side approvals for what matters, and a test suite that never needs a model.

Get started

The dual-plane model

Security model

🚀

One command, zero configuration

One command produces a running receivables console — ledger, three screens, a docked copilot, an approval flow and an MCP endpoint. No database, no API key, no setup.

🪟

Two planes, never blurred

View capabilities are registered by the components that own the state and execute in the browser. Domain capabilities are oRPC procedures, governed and re-authorized on the server. The model sees one catalog and cannot tell them apart.

🎯

Bind for context, gate for consequence

A mutation that must target what the user sees is bound to it, with the field removed from the schema. One whose risk is what it does stays a governed tool behind a server-side approval. Picking the wrong shape is the expensive mistake.

🧭

An agent host you own

The browser↔server protocol, per-request catalog composition, executor routing, correlation ids and run limits are application modules you can read and change — not framework glue.

🔌

One registry, several transports

The same capabilities serve the UI over oRPC, the copilot through the host, and external clients over MCP. Nothing is re-declared, and `expose` decides what each one sees.

🧪

Deterministic tests, no LLM

Governance and capability contracts are unit-tested; Playwright drives a production build through the live pipeline under a scripted model; both planes compile to committed inventories you diff like an API. CI never needs credentials.

bash

pnpm create dpas-app my-agent-app
cd my-agent-app && pnpm dev

Open http://localhost:3000. Filter, sort and hide columns — all URL-synced, so a narrowed view is shareable. Open a chase dialog and record a reminder. Switch identity in the header: as Ada — analyst, issue-invoice does not grey out, it disappears, and asking the server for it directly answers Capability not found.

Add a provider key, press ⌘J, and ask:

Which invoices are overdue, and by how much?

The copilot reads the ageing ladder on the server, narrows the table in your browser, reads the rows back, and answers from what it read. The table moves because the agent called the same setter your toolbar calls — it has no privileged channel into the UI.

Then ask it to issue a draft. It will not: a model-initiated issue-invoice comes back as an approval card, and nothing moves until you decide.

Reading paths

“Show me what this is.” — Getting started → The dual-plane model → Architecture
“I'm adding my own capabilities.” — Anatomy of a capability → Adding a capability → Testing
“I'm reviewing its security.” — Security model → Scaffolder guarantees → Host protocol → Decision records
“I'm putting it in front of real users.” — Connecting a model → Configuration → Deploying

Everything on this site describes the app the scaffolder actually generates, built on the published @agent-surface/* and @orpc-agent/* packages, Mastra and assistant-ui. The architecture, capability and security guides are the same markdown that ships inside every generated app, so the two cannot drift.