Why
A few small apps usually means five services and five bills. Four small Next.js apps, each with a database and sign-in, plus a cache, error tracking and analytics, cost about $130 a month bought separately (Vercel Pro, Supabase Pro, Upstash, Sentry Team and Plausible, at their own published prices in October 2026). The same setup on one ShipTiffin box is about $29: $19 for the managed service plus about $10 for the smallest Hetzner server. Run it yourself and you pay only for the server.
You also stop juggling: one dashboard instead of five, no keys to copy between services, and your data in one place you control. Each project gets a hard limit on CPU, memory and its share of the database, so a busy app can't slow the others or grow the bill.
One small app on a free tier can cost less. ShipTiffin pays off from the second app.
Get started
Three ways to run it. Pick one.
1. Managed: ready in about 5 minutes
Go to shiptiffin.com/start, sign in, pay, and paste a Hetzner Cloud API key. ShipTiffin builds the box in your own Hetzner account; the page shows each step live. The key is used for that job and then forgotten, and every call made with it is listed in your account. When it's ready, Open your dashboard signs you in. Nothing to install.
- $19 a month per box ($12 for the first 100 customers, locked for 24 months), plus the server, which Hetzner bills you for: about $10 a month before VAT for the smallest, with its IPv4 address and a 40 GB data volume.
- You get updates, monitoring from outside the box, encrypted off-server backups every 6
hours (kept 30 days, with a key only you hold), a free
name.shiptiffin.appaddress, resizing from your account and support by email. - If you stop paying, the server and your apps keep running.
2. Self-host on Hetzner (free)
Install the tiffin CLI (macOS or Linux; on Windows, inside WSL), make a Read & Write API
token in the Hetzner Cloud console, then:
curl -fsSL https://shiptiffin.com/install.sh | sh
export HCLOUD_TOKEN=... # Hetzner Cloud read & write token
tiffin up --provider hetzner --name shop --dry-run # what it makes, and the monthly price
tiffin up --provider hetzner --name shop # a few minutes
It makes the server, a 40 GB data volume, a firewall and an SSH key. Run tiffin up --name shop
again any time to update it.
3. Self-host on any Ubuntu server (free)
Any Ubuntu 26.04 server you can reach over SSH with passwordless sudo (24.04 also works):
curl -fsSL https://shiptiffin.com/install.sh | sh
tiffin up --provider ssh --name shop --host root@YOUR_SERVER_IP
Self-hosted, tiffin up ends by printing the dashboard's address and a one-time sign-in
link.
Connect your computer and your agent
A box you made with tiffin up is already connected: every tiffin command on that
computer talks to it, and claude mcp add --scope user tiffin -- tiffin mcp connects Claude Code
(codex mcp add tiffin -- tiffin mcp for Codex).
For a managed box, or from another computer, create an API key in the dashboard (Settings › API keys), install the CLI as above, and point it at the box:
export TIFFIN_URL=https://dashboard.<name>.shiptiffin.app # the dashboard's address
export TIFFIN_TOKEN=<key>
tiffin whoami
Your agent gets a key of its own and connects over HTTP; the dialog that shows a new key shows the line to paste (agents).
Ship your first project
In the dashboard, New project starts from a starter app or imports a GitHub repository: every push deploys, and every pull request gets a preview. Or from your app's folder:
cd hello
tiffin init # tiffin.config.ts, AGENTS.md and an agent skill
tiffin plan # every step, its risk and why
tiffin apply --confirm <hash> -m "Set up hello"
tiffin deploy # live at https://hello.<box domain>
The quickstart has the details.
Or hand it to your agent
Paste this into Claude Code or Codex:
Set up ShipTiffin for me: follow https://shiptiffin.com/agent-setup.md
The agent asks which way you want (managed or self-hosted), does the steps it can, and stops for the ones that are yours: paying, your Hetzner token, a passkey and its first API key. Then it connects itself to your box and deploys your first app. Some agents summarize a page they fetch, so for the surest result paste the full prompt instead.
What's in the box
Every project on the box gets these parts. There are no extra accounts, keys or bills.
Built for coding agents
Every box serves an MCP server at https://dashboard.<box domain>/mcp. Give each agent its
own key (Settings › API keys), then connect it once:
# Claude Code (--scope user: in every folder, not only this one)
claude mcp add --transport http --scope user tiffin https://dashboard.<box domain>/mcp \
--header "Authorization: Bearer <key>"
# Codex: first add `export TIFFIN_TOKEN=<key>` to your shell profile and restart Codex
codex mcp add tiffin --url https://dashboard.<box domain>/mcp --bearer-token-env-var TIFFIN_TOKEN
On the computer that ran tiffin up there is no key to make: claude mcp add --scope user tiffin -- tiffin mcp,
or codex mcp add tiffin -- tiffin mcp.
In each app's folder, tiffin init writes AGENTS.md (Codex and Claude Code both read it)
and a tiffin skill for each agent (.claude/skills/tiffin and .agents/skills/tiffin).
Codex's sandbox blocks network by default, so approve tiffin commands when it asks, or
set network_access = true under [sandbox_workspace_write] in ~/.codex/config.toml.
Cursor, VS Code and other clients: see connecting an agent.
- One API, three ways in. Every operation is a CLI command, an MCP tool and an HTTP call,
generated from one OpenAPI description (
/v1/openapi.json), so they always agree. - Plan, then apply. Every change lists its steps and their risk (reversible, outbound, irreversible), and applies only with that plan's hash.
- A key per agent. Each agent, script or CI job gets its own API key: all projects or a few, full or read-only access.
- Recorded and undoable. Activity shows who changed what, from which agent session, and
why.
tiffin undo <change>reverts it. - Fenced data. Logs, rows and emails reach agents marked as data, never as instructions. To run an agent of your own on the box, see always-on agents.
The dashboard
How it works
you ── tiffin CLI ──┐
you ── dashboard ──┼──▶ API ──▶ your server
agent ── MCP server ──┘ ├─ edge: HTTPS, your domains, rate limits, firewall
├─ shop web · api · worker limit 40%
├─ blog static site no limit
├─ Postgres · Valkey · S3 · SMTP · jobs
├─ metrics · logs · errors · analytics
└─ backups, with an optional off-box copy
- One binary.
tiffinis the CLI, the MCP server and the box itself. On the server it runs the edge, the services and your apps in containers. - A config per project.
tiffin.config.tssays which apps and services a project has.tiffin planshows what would change, andtiffin applymakes exactly that change. - Standard pieces. Postgres, S3, the Redis protocol and SMTP. Export any project to one
.tiffinfile with its code, data and files, and import it on another box. - Updates. A box installs signed releases by itself in a window you choose, and rolls back if the new build isn't healthy.
Honest limits
It is one server: if it's down, your apps are down. It suits side projects, small products
and experiments, not anything that must survive a hardware fault or serve many regions.
Backups stay on the box unless you copy them off it (tiffin backups offsite set, or a
managed box). It is pre-1.0, so interfaces may change.
What works and what doesn't lists every framework, limit and gap. Read the security model before you put anything important on it.
Docs
Agents can read everything in one file: shiptiffin.com/llms-full.txt.
Building from source
Go 1.27+, Bun and, for a local box, Lima (brew install lima).
make build # bin/tiffin (uses the committed dashboard and SDK builds)
make test # Go tests with the race detector, Bun tests and the site tests
make lint # gofmt, go vet, staticcheck
CONTRIBUTING.md has the rest: the repository layout, a dev box, the module contract and how to send a change.
Contributing and security
Issues and pull requests are welcome, including ones written with a coding agent, as long as the tests pass. Start with CONTRIBUTING.md. Please report security problems privately, as SECURITY.md describes, not in a public issue.
License
The Tiffin platform (the tiffin binary, the box, the dashboard and the auth engine) is
free software under the GNU Affero General Public License v3.0 only
(AGPL-3.0-only). If you run a changed copy as a service for others, offer them its source.
What ends up inside your apps is Apache-2.0, so your apps stay yours under whatever licence you choose:
- the SDK:
packages/sdkand its embedded copy ininternal/sdkpkg/files/shiptiffin-sdk - the starters, templates and examples:
internal/starters/files,templates,examples - the analytics tracker:
packages/trackerandinternal/mod/analytics/script.js - the build glue the box writes into builds:
nextadapter.js,reactrouterserve.js,workflowinstr.jsandworkflowsetup.mjsininternal/mod/runtime - the agent files
tiffin initwrites:internal/cli/scaffoldandskills/tiffin
Each of these has its own LICENSE file or an SPDX-License-Identifier line.
NOTICE and THIRD_PARTY_NOTICES list the third-party
software inside the binary and its licences; tiffin licenses prints them.