Dendra. An open source framework for APIs and AI tools.

The challenge

An application may need the same operation in several places: a typed web client, a REST API, an integration document and an AI assistant. Defining each interface separately creates extra work whenever an input, permission check or business rule changes.

Dendra approaches that problem at the procedure level. It is TechFoundry’s open source TypeScript framework for connecting application APIs and AI tools through a shared definition. This case study examines the product architecture and its implemented capabilities.

The product we built

A developer defines a procedure with an input schema and a handler, then adds middleware, an HTTP route or AI tool metadata where needed. Adapters expose that definition to the interfaces the application uses.

The result is one place to maintain the operation’s contract. A typed client can infer its inputs from the router. REST handlers and OpenAPI documentation use the procedure metadata. Procedures explicitly marked for AI use can also become model tools and Model Context Protocol tools.

One contract across several interfaces

Dendra separates the operation from the way it is called. The same router can support a typed client, HTTP adapters, REST routes, an OpenAPI 3.1 document and direct calls inside the server. Streaming procedures provide another way to return work as it progresses.

• Application developers get client types inferred from the router, without a separate client code generation step.
• Integration teams can use REST routes and an OpenAPI document derived from the procedure definitions.
• Agent developers can expose selected procedures as tools, using the existing input contract and execution path.

These are supported interfaces, not automatic deployment services. The application still chooses which adapters to mount and which operations to expose.

Real time connections and background jobs

Dendra 0.9.0 extends the shared procedure model to live connections and background work. WebSocket adapters include server origin checks and resource limits, while the browser client can reconnect. PostgreSQL pub/sub provides a shared event channel for applications running across multiple processes.

Background jobs support retries, backoff, leases and streamed status updates. Developers can choose an in memory store for local use or a PostgreSQL store for jobs that need to survive worker restarts. Applications supply the job context and must carry workspace identity and authorization into their job and status access policies.

The release also adds cancellation and batch responses delivered as individual calls settle. These capabilities let applications reuse the procedure model while choosing the transport and storage appropriate to each operation.

AI access is an explicit choice

Dendra requires a procedure to opt into AI exposure with .ai(). Unmarked procedures are excluded from the generated toolset, and the tool executor rejects attempts to call them. Input validation runs before the handler, including when a model supplies the arguments.

Middleware can reject a request or extend its context before business logic runs. That lets an application apply its authentication and permission checks through the same procedure path used by ordinary API calls and AI tools. The application must supply those checks and the correct user context; the framework does not invent an authorization policy.

Dendra also provides primitives for consuming tools from external MCP servers and combining them with local tools. Connection setup, transport and credentials remain application responsibilities.

A focused core with clear boundaries

The core package has no required runtime dependencies. Optional helpers, including the Anthropic agent loop and React assistant hook, use their own peer dependencies. Teams can adopt the procedure and tool primitives without adopting a complete chat interface or changing their database.

A runnable Next.js reference application

The Next.js notes example shows how application APIs and MCP tools use the same procedures. Developers can run it locally and explore RPC, REST, validation, streaming and other integrations through its interactive demo.

Updates to the example after the 0.9.0 framework release bind bearer credentials to a workspace and user. Nine regression tests cover workspace isolation for MCP and RPC reads, MCP writes, rejected deletion of another workspace’s notes, attempts to override identity with headers, OAuth workspace binding and legacy token configuration.

The browser tenancy and OAuth authorization flow still include demonstration defaults. A deployed application needs real authentication and workspace membership checks. This reference application demonstrates the implementation; it is not a customer deployment or a production performance benchmark.

Authentication, tenant permissions, storage, user interfaces and external connection management belong to the application. Keeping that boundary clear makes the framework’s role easier to understand and evaluate.

What the implementation delivers

• A shared procedure definition for application calls and explicitly exposed AI tools.
• Input validation and middleware reused through the central execution path.
• Typed clients, REST and OpenAPI support, streaming and MCP integration primitives.
• WebSocket connections, PostgreSQL pub/sub and background jobs with selectable storage.
• Public source, documentation and an example application that developers can inspect.

The source includes tests for tool exposure, invalid arguments and middleware rejection. These support specific implementation behaviors; they are not a security certification. No customer revenue, time savings or performance improvement is claimed in this case study.

Reviewed on 25 October 2026 against Dendra 0.9.0 and the later Next.js example updates on the main branch. Dendra remains a pre 1.0 project released under the MIT license. Teams upgrading should review the release notes, including changes to client result types and input composition, and validate their application’s access controls.

Explore the product

• Dendra documentation and quickstart: install the framework and define your first procedure.
• Next.js notes example and local demo: run the reference application and explore its integrations.
• Architecture guide: understand how procedures, adapters and tools fit together.
• Dendra on GitHub: inspect the source, examples and tests.
• Version 0.9.0 release notes: review new capabilities and upgrade changes.

Building an application that needs both conventional APIs and controlled agent access? Tell TechFoundry what the system needs to do.