Cortera Framework

Cortera Framework simplifies the development of modern applications by allowing a single Action definition to be utilized across various platforms, including both human users and AI agents. This framework seamlessly incorporates observability, safety, and compliance measures from the start.

Key Features

• Observability-First: Automatically generates structured traces and events for every request, mutation, and error without requiring separate APM tools.
• Agent-Native: Every route and action is accessible via a UI trigger and a callable tool schema, complete with built-in permissions and audit logging.
• Safe by Default: Implements unique runtime defenses against rogue agent chains through features like Blast Radius and Auto-Containment.

The Core Primitive: Action

All functionalities in Cortera Framework are centered around the Action, which auto-generates the following components:

• A REST endpoint (e.g., POST /actions/:name)
• An MCP tool schema for agent interactions via Model Context Protocol
• A UI form/trigger through the React component @cortera/ui
• A trace span, ensuring structured audit logs in PostgreSQL

Example definition of an Action:

import { z } from "zod";
import { defineAction } from "@cortera/core";

export const createInvoiceAction = defineAction({
  name: "createInvoice",
  description: "Creates a new invoice for a customer",
  permission: "invoices:write",
  blastRadius: ["invoices:*", "notifications:send"],
  inputSchema: z.object({
    customerId: z.string().min(1),
    amount: z.number().positive(),
    dueDate: z.string().datetime(),
  }),
  handler: async (input, ctx) => {
    const invoice = await db.invoices.create(input);
    await db.notifications.send({ to: invoice.customerId, type: "invoice_created" });
    return invoice;
  },
});

Benchmarking Performance

Cortera Framework demonstrates significant efficiency compared to traditional development approaches, as illustrated in the following benchmark:

The drift test highlights that modifying fields in Cortera Framework requires noticeably fewer changes—only one file update, compared to five for other frameworks.

Scalability and Safety

Blast Radius + Auto-Containment

Each Action defines a blastRadius, specifying the downstream permissions it can access. If an Action exceeds its authorized permissions during execution, the framework automatically contains the actor, preventing further actions until reviewed.

Risk Modes

Cortera Framework supports flexible risk configurations per Action, facilitating various execution behaviors based on the defined risk tier.

API Accessibility

Cortera Framework does not provide a prebuilt admin dashboard but offers robust APIs for seamless integration into existing systems:

• Action Endpoints: Create, review, and manage Actions through the REST API.
• Event Streams: Utilize Server-Sent Events (SSE) to monitor live action events.

This framework is designed to streamline the development cycle while ensuring that applications are observable, secure, and compliant from the ground up.