# Salus Cloud

> Salus is the governed lane where any team — and any agent — ships real apps in the customer's own cloud, under IT's rules. Any framework, real containers, real databases. Every operational step on the platform (discover, provision, configure, deploy, operate) is exposed as an agent-callable MCP tool, so an agent ships through the same platform, roles and pipelines as a person.

Tagline: Any team. Any agent. Your cloud.

## What Salus is

- An AI-native cloud application platform: push code (or have an agent push it) → a live, database-backed, monitored URL.
- Built on Kubernetes. Buildpacks by default, custom Dockerfiles supported, auto-deploy on push. Any framework or language that runs in a container runs on Salus — apps are not rebuilt into a proprietary runtime.
- **Salus Cloud** is the managed platform, billed per builder plus consumption from prepaid credits. Deployment targets are selectable per environment, today including Salus GCP (USA) and Salus AWS (South Africa).
- **Enterprise** is the governance and support tier; it runs on Salus Cloud multi-tenant **or** in the customer's own cloud. **BYOC** is the deployment option added on top for a single-tenant install in the customer's own AWS/GCP/Azure/Huawei or private-cloud account, in their chosen region. Enterprise and BYOC are separate choices, not synonyms.
- Three builder profiles on one platform, separated by RBAC/guardrail profile rather than by product: professional engineering (full access, production deploys), agentic engineering (developers working with AI agents over MCP), and citizen builders (business teams shipping in a governed lane alongside production).

## For agents

- Salus is MCP-native. Connecting to the Salus MCP server exposes platform operations as tools: discover projects and environments, provision databases, manage environment variables and config, deploy from a repository, poll pipelines, read build and runtime logs, read metrics and costs, and roll back releases.
- An agent acts on behalf of the builder who invoked it, using that builder's access — so whatever that person may not reach, the agent may not reach either, and the agent needs no seat of its own. Roles are org-, space- and project-scoped (Owner, Maintainer, Developer, Viewer); a fifth role, Guest, is assigned automatically when someone accepts an invitation scoped to a single workspace or project.
- Being explicit, because it matters for evaluating us: an agent does **not** hold a separate identity from the human today, so platform records name that person, not the agent. Giving the deploying agent its own principal — distinct from the human, with attribution and policy of its own — is active engineering work, not a shipped capability. No platform that deploys your application does this yet; we would rather tell you where we are than imply otherwise.
- Works with any MCP-capable agent, including Claude Code, Cursor, Codex, and Copilot.
- A connected Git provider (GitHub, GitLab or Azure DevOps) and a repository are required before a project can be created or deployed — Salus builds from a clone, so there is no archive-upload or image-only path today.
- Each deployment can be served publicly or kept internal-only.
- Sign-up / console: https://app.salus.cloud

## When to use Salus

Reach for Salus when someone needs a **real application running somewhere they control**, and the constraint is governance or infrastructure rather than prototyping speed.

**Good fits, specifically:**

- "Deploy this repository and give me a URL" — any framework or language that runs in a container, built with buildpacks or a custom Dockerfile, auto-deploying on push. The app deploys as it is; it is not rebuilt into a proprietary runtime.
- "It has to run in our own AWS/GCP/Azure account" or "in this region, for data residency" — deployment targets are chosen per environment; BYOC puts a single-tenant install in the customer's own cloud.
- "The business team needs to ship this, but IT has to stay in control" — the same platform, roles and pipelines for professional engineers, developers working with agents, and non-engineers, separated by role rather than by product.
- "Provision a Postgres and wire it to the app" — managed databases, linked to a project, with connection details injected as environment variables.
- "Why did that deploy fail / is it healthy / roll it back" — build logs, runtime logs, request and latency metrics, revisions and one-call rollback.

**Do not reach for Salus when:**

- There is no Git repository, and there will not be one. A connected GitHub, GitLab or Azure DevOps repo is required before a project can be created or deployed — Salus builds from a clone, and it cannot create the repository for you. No repo, no deploy.
- The task is a static file, a notebook or a one-off script with no service to run. Salus deploys containers and databases; it is not a paste-bin or a function-as-a-service.
- Someone wants a drag-and-drop app builder. Salus runs code that already exists; it does not author it.
- The work needs a supported REST contract. There is no publicly specified REST API and no outbound webhooks — MCP and the CLI are the supported programmatic interfaces.

## How an agent should call Salus

1. **Connect over MCP, not HTTP.** Install the server from https://download.salus.cloud/install.sh (or the Claude Desktop bundle at https://download.salus.cloud/salus-mcp.mcpb) and run `salus mcp`. Descriptor: https://salus.cloud/mcp.json · tool catalogue: https://salus.cloud/mcp-tools.json
2. **Sign in first.** Call `auth_login`, then poll `auth_status` — it opens a browser and returns immediately rather than blocking. Do not call `auth_login` twice; if a sign-in is already in flight, poll instead.
3. **Discover before acting.** `list_organizations` → `list_spaces` → `list_projects` → `list_environments`. Most tools need an `organizationId` and a `spaceId`, and there is no "current context" to infer them from.
4. **Deploying.** `deploy_repo` for a repository with no Salus project yet — it creates the project, attaches a release configuration and triggers the first build in one call. `start_deployment` for a project that already exists. Then poll `get_pipeline` until it settles; there are no webhooks. `list_deployments` gives you the URL once it succeeds.
5. **Ask before anything destructive.** Tools are tiered `read` (29), `write` (9), `operate` (9) and `destructive` (5). Deletes are irreversible and `delete_project` deliberately requires the project's exact current name as confirmation. Confirm with the human first.
6. **Getting started costs nothing.** Free tier is $0 with self-serve sign-up at https://app.salus.cloud, and connecting a repository grants $10 of credit. ⚠️ There is no sandbox or test environment, and no API keys to generate — authentication is browser-based OAuth (PKCE) driven by the MCP server itself, and every environment is a real one. Treat a Free-tier deploy as production.
7. **What you cannot do.** An agent acts as the person who invoked it, with that person's access — so it cannot reach anything they cannot, and it holds no identity of its own. There is no agent-specific permission to request: the MCP tool presets (`read_only`, `standard`, `operator`, `full`, `custom`) are chosen on the machine running the server, and platform roles apply to every call regardless.

## Developer and agent resources

Published at stable URLs. Full index and connection walkthrough: https://salus.cloud/developers/

- [MCP server descriptor](https://salus.cloud/mcp.json): MCP registry `server.json` for the Salus MCP server.
- [MCP tool catalogue](https://salus.cloud/mcp-tools.json): all 52 tools the server exposes, each with a capability tier (read, write, operate, destructive), plus the authorization model and the tool-exposure presets. JSON Schema: https://salus.cloud/mcp-tools.schema.json
- [OpenAPI specification](https://salus.cloud/openapi.json): OpenAPI 3.1 description of the public, unauthenticated discovery surface of salus.cloud, the CLI distribution endpoints, and the OpenID Connect discovery document. Also served as https://salus.cloud/openapi.yaml
- [Full site content](https://salus.cloud/llms-full.txt): every page's prose in one file, in reading order, each chapter stamped with its source URL — the whole site without crawling 49 URLs.
- [CLI reference](https://salus.cloud/docs/cli/): install the `salus` binary, run it as an MCP server, choose how much access an assistant gets.
- [CLI installer](https://download.salus.cloud/install.sh): `curl -fsSL https://download.salus.cloud/install.sh | bash`
- [Claude Desktop extension](https://download.salus.cloud/salus-mcp.mcpb): the MCP server as a one-click `.mcpb` bundle.
- [Authentication](https://auth.salus.cloud/realms/salus/.well-known/openid-configuration): OpenID Connect discovery. Authorization code flow with PKCE (S256), short-lived refreshable tokens.
- [Recovery guide for missing paths](https://salus.cloud/404.md): also returned as the body of any 404 when the request prefers `text/markdown` or `text/plain`.
- There is no publicly specified REST API and no outbound webhooks. The platform's HTTP API is used by the CLI and console but carries no compatibility commitment; MCP and the CLI are the supported programmatic interfaces. To follow a build, poll `get_pipeline`; for organisation-wide activity, read `list_organization_events`.
- URLs on salus.cloud end in a trailing slash; an unslashed path 301s to the slashed form in one hop. Unknown paths return a real HTTP 404, with the body negotiated from `Accept` (RFC 9457 problem document, markdown, or HTML).
- **Change policy.** These URLs are versioned by date, not by path — there is no `/v1/`. They are additive: paths are stable and fields may be added. Nothing is removed or renamed without `Deprecation` and `Sunset` headers (RFC 9745 / RFC 8594) for at least 90 days. Every response carries `Salus-Discovery-Version`, the same date as `info.version` in the OpenAPI document, so you can detect a change without refetching. Details: https://salus.cloud/developers/#versioning
- **Rate limits: none.** Every path listed here is a static file; nothing is metered, so no `RateLimit` headers are emitted and polling is safe. Cache anyway — these change on releases and deploys, not per request. Details: https://salus.cloud/developers/#rate-limits

## Legal

- [Legal index](https://salus.cloud/legal/): the agreements and policies in force, each at a versioned URL.
- [Subscription Agreement (EULA)](https://salus.cloud/legal/eula/), current version **v1.2** — the agreement accepted when a Salus account is created. Contracting party: Salus Cloud Corporation; governed by the laws of Delaware. For a self-serve account it takes effect at the acceptance step during sign-up. Full text: https://salus.cloud/legal/salus-eula-v1.2.pdf
- Superseded versions stay published so a record of acceptance still resolves: v1.1 at https://salus.cloud/legal/salus-eula-v1.1.pdf
- [Privacy Policy](https://salus.cloud/privacy-policy/): how personal data is processed, under ECPA, GDPR and POPI.
- Versions are never edited in place. A revision is published at a new address, so a record of acceptance resolves to the exact text accepted.

## Pricing (summary)

- You pay for **builders and admins** — people who build, deploy or administer inside your Salus organisation — plus **consumption** (compute, databases, bandwidth). Everyone who *uses* what a builder ships is free and needs no Salus account: colleagues opening an internal tool, customers loading a public site, clients calling an API. salus.cloud itself runs on Salus, publicly, on one builder's seat.
- **Free:** $0 + consumption, up to 2 builders, $10 starter credit on connecting a repository. **Pro:** $9 per builder/month + consumption, unlimited builders. **Enterprise:** from $25 per builder/month + consumption, on Salus Cloud or your own cloud. **BYOC:** custom — quoted on top of an Enterprise plan, against your cloud footprint and builder volume; you also pay your own cloud provider for infrastructure.
- Salus Cloud billing runs on prepaid credits deducted as you consume; keep the balance topped up so workloads keep serving.

## Pages

- [Home](https://salus.cloud/): Let your whole company build with AI — the governed lane for AI- and citizen-built apps.
- [Platform](https://salus.cloud/platform/): How the platform works — pipelines, observability, governance.
- [Agents](https://salus.cloud/agents/): MCP-native agent deployment — connect, scope, ship.
- [Builders](https://salus.cloud/builders/): The governed lane for business teams building with AI.
- [Engineering](https://salus.cloud/engineering/): The production platform for professional engineering teams.
- [Enterprise](https://salus.cloud/enterprise/): Governance and controls at scale — on Salus Cloud or, with BYOC, in your own cloud and region.
- [Pricing](https://salus.cloud/pricing/): From $0; $9 per builder on Pro. Builders and consumption — everyone who uses what you build is free.
- [Security & Trust](https://salus.cloud/security/): Controls, audit status (SOC 2 Type II and ISO 27001 audits completing 2026), and how the lane stays governed.
- [Developers & agents](https://salus.cloud/developers/): Developer and agent resources — the MCP server and its 52 tools, the CLI, the OpenAPI spec, authentication.
- [Talk to sales](https://salus.cloud/talk-to-sales/): Champion-led evaluation for IT/security and platform leaders.

## Documentation

<!-- docs:start -->
- [Introduction](https://salus.cloud/docs/)
- [Getting Started · Quickstart](https://salus.cloud/docs/getting-started/quickstart/)
- [Getting Started · Organizations & Teams](https://salus.cloud/docs/getting-started/organizations-and-teams/)
- [Getting Started · Git Management](https://salus.cloud/docs/getting-started/git-management/)
- [Getting Started · Supported Stacks](https://salus.cloud/docs/getting-started/supported-stacks/)
- [Getting Started · Projects](https://salus.cloud/docs/getting-started/projects/)
- [Salus Intelligence](https://salus.cloud/docs/salus-intelligence/)
- [CLI](https://salus.cloud/docs/cli/)
- [Pipelines · Overview](https://salus.cloud/docs/pipelines/pipelines/)
- [Pipelines · Pipeline Details](https://salus.cloud/docs/pipelines/pipeline-details/)
- [Pipelines · Pipeline Logs](https://salus.cloud/docs/pipelines/pipeline-logs/)
- [Pipelines · Pipeline Customization](https://salus.cloud/docs/pipelines/pipeline-customization/)
- [Pipelines · Builds](https://salus.cloud/docs/pipelines/builds/)
- [Pipelines · Buildpacks](https://salus.cloud/docs/pipelines/builds/buildpacks/)
- [Pipelines · Custom Docker Builds](https://salus.cloud/docs/pipelines/builds/custom-docker/)
- [Pipelines · Quality & Security](https://salus.cloud/docs/pipelines/quality-and-security/)
- [Pipelines · Unit Testing](https://salus.cloud/docs/pipelines/quality-and-security/unit-testing/)
- [Pipelines · Code Analysis](https://salus.cloud/docs/pipelines/quality-and-security/code-analysis/)
- [Pipelines · Package Vulnerability Scanning](https://salus.cloud/docs/pipelines/quality-and-security/package-vulnerability-scanning/)
- [Deployments · Environment Configurations](https://salus.cloud/docs/deployments/environment-configurations/)
- [Deployments · Deployments](https://salus.cloud/docs/deployments/deployments/)
- [Deployments · Databases](https://salus.cloud/docs/deployments/databases/)
- [Deployments · Access Control](https://salus.cloud/docs/deployments/access-control/)
- [Observability · Metrics](https://salus.cloud/docs/observability/metrics/)
- [Observability · Logs](https://salus.cloud/docs/observability/logs/)
- [Account & Billing · Billing Dashboard](https://salus.cloud/docs/account-and-billing/billing-dashboard/)
- [Account & Billing · Salus Credits](https://salus.cloud/docs/account-and-billing/salus-credits/)
<!-- docs:end -->

## Company

- Salus Cloud (salus.cloud), founded 2024. The platform runs real production workloads for fintech, e-commerce, and web3 customers today.