Restheart AI Agent

<img src="https://restheart.org/images/restheart%20logo.svg" alt="RESTHeart logo" width="32px" height="auto" /> RESTHeart

A backend for web, mobile, AI and IoT apps.

---

What RESTHeart is

RESTHeart puts an API on your MongoDB data and handles what every app needs around it: sign-up and login, permissions per document, changes pushed to clients, an MCP server for AI agents.

Example

With RESTHeart running locally (see below), create a collection, add a document and query it:

curl -u admin:secret -X PUT localhost:8080/messages
curl -u admin:secret -H 'Content-Type: application/json' -d '{"from":"Bob","message":"Hello"}' localhost:8080/messages
curl -u admin:secret "localhost:8080/messages?filter={\"from\":\"Bob\"}&pagesize=1"

No route was written for /messages. It is a MongoDB collection, and the query parameters (filter, pagesize, sorting) map directly to MongoDB's query language.

Core capabilities

• AI agents: an MCP server, so agents use the application's APIs under the same permissions as its users
• RAG and vector search: embeddings computed on write (Voyage AI, any OpenAI-compatible endpoint, Ollama), uploaded documents chunked for retrieval, results re-ranked
• Accounts: sign-up, login, email verification, password reset, team invitations, Google sign-in, tokens and API keys
• Authentication and Authorization: JWT, OAuth2, LDAP, MongoDB-based users, ACL rules per role, down to the documents a user may read or change, defined as data, not code
• REST API: full CRUD, aggregations, filtering, sorting, pagination, JSON Schema validation, generated from the database schema
• GraphQL: schema-driven mapping to MongoDB queries
• WebSocket: change streams exposed as real-time data sync
• SSE: Server-Sent Events for dashboards, IoT feeds, and event streams
• Email: transactional messages from templates, over your own SMTP
• Payments: Stripe plans, seats and products
• Plugin framework: custom services, interceptors, and initializers in Java, Kotlin, JavaScript, or TypeScript, for the logic a declarative API cannot cover
• Metrics and monitoring: a Prometheus-compatible endpoint plus a browser dashboard at /metrics-ui, tracking request rates, latency percentiles, and HTTP status distribution
• IoT / MQTT: bridge an MQTT broker into RESTHeart — topic messages become Server-Sent Events, REST responses, or MongoDB documents. A separate module, installed into an instance rather than shipped with it.

Distributed as a Docker image and a GraalVM native binary. Built on Java 25, Undertow, and virtual threads.

Running it

Managed, on Ulabase, the platform built on RESTHeart: nothing to install, a free plan to start.

Or self-hosted, since the core is free and open source:

curl https://raw.githubusercontent.com/SoftInstigate/restheart/master/docker-compose.yml \
  --output docker-compose.yml && docker compose up --attach restheart

curl http://localhost:8080/ping

Supported MongoDB versions

Every build is tested against MongoDB 7.0, 8.0, 8.3 and 9.0, and against mongodb/mongodb-atlas-local.

Older versions should work too, down to MongoDB 4.2, the oldest the MongoDB Java driver connects to, but they are not tested and some features may need a newer server. If something does not work on your version, please open an issue.

Some features need more than a standalone server:

• Transactions and change streams, which the WebSocket and SSE streams of collection changes rely on, need a replica set. A single-node one is enough, like the one in docker-compose.yml.
• Vector search indexes and $vectorSearch need mongot: MongoDB Atlas, mongodb-atlas-local, or Community/Enterprise 8.2+ with mongot. $vectorScan works on any MongoDB, without an index.

Full documentation: https://restheart.org/docs/

---

License

RESTHeart core is licensed under the GNU AGPL v3.

restheart-commons, the Maven artifact plugins depend on to reach the Approved Interfaces, is licensed under the Apache License 2.0. Plugins that depend only on restheart-commons, without linking against RESTHeart's AGPL-licensed core, can be distributed under any license, including proprietary ones. See PLUGIN_EXCEPTION.md for the exact terms of this permission.

---