The framework objection

Build vs. buy, once you’ve already picked a framework.

LangGraph, Mastra, and the Vercel AI SDK solve the agent loop. None of them decides how you isolate one customer from another — and that is the decision you cannot make twice.

Start free trial

14-day free trial · No credit card required

Use the framework.

Reaching for LangGraph, Mastra, or the Vercel AI SDK first is the right call. The agent loop — the part that calls a model, calls a tool, and decides what happens next — is exactly the part a framework is built to solve, and any of the three solves it well.

We didn’t use one of them for our own agent loop, and that’s not a knock on the frameworks. It’s because the loop was never the hard part of what we were building. What we needed was the layer underneath it: a tenant model, per-customer keys and limits, a UI we could hand to a customer under their own brand, and a way to run work on a machine we don’t own. None of that ships with a framework. That’s the rest of this page.

Not an agent. A feature.

You’re not shipping an agent. You’re shipping a feature your customers buy — a product with tenants, not a chatbot with users. That’s the deliverable your roadmap actually promised, and it’s not what a framework gives you.

The one you can’t add later.

Scheduling you can bolt on. A connector is a day. Most of what a framework leaves out, you can add the week you need it.

That word — tenants — is different in kind. It isn’t a feature that sits next to your code; it’s a property of every table, every query, every key lookup, every audit row. A framework doesn’t make that hard, it simply has no opinion about it, so the app you build on one is shaped for a single customer by default. Threading a tenant through it afterwards isn’t a feature you add. It’s a second pass over everything you already wrote, by hand, on a deadline someone else set.

We started there. Not from discipline — because a thing you resell has no other sensible shape. A tenant of your customer base is the primitive here, not a column added in month four:

  • Isolated by default

    A read across tenants returns 404, not filtered results. The default is deny, so scoping is not something a developer can forget on one endpoint.

  • A tenant is one API call

    Provisioning a new isolated tenant is a request, not a migration and not a deploy.

  • Keys belong to the tenant

    Model credentials sit at the account level or per tenant, so your customer's usage can run on your customer's own provider account.

  • Limits that actually stop

    Per-tenant token and cost caps return HTTP 402 at the ceiling. Enforcement at request time, not a report you read afterwards.

  • Scoped down to the browser

    Read, write, and admin API key scopes; short-lived ephemeral tokens for browser auth, so no long-lived key ever reaches a customer’s page.

  • Per-tenant history

    Message history, instruction and prompt versions, task runs, and webhook delivery attempts — scoped per tenant, because an audit question is always about one customer.

None of that is exotic. It’s just work you would rather not discover halfway through, after the architecture has already decided against you.

And then the rest of it

Tenancy is the one that shapes the architecture. These are the ones you can add later, and will:

  • A UI you can actually put your customer's brand on — not an admin console, not a fork of someone else's chat app.
  • A way for agents to run on a schedule or a webhook, not just answer when a user types.
  • The ingestion pipeline that gets a customer's documents in front of an agent at all — parsing, chunking, embedding, keeping it in sync.
  • A way to touch a file or run a shell command on your customer's own machine, for the work that has to happen where their data lives.

What the three actually give you

Being accurate here is what makes the rest of this page worth reading.

LangChain / LangGraph

A graph orchestration runtime, MIT licensed, and it does that job well. Their own docs don’t address a tenant of your customer base — that’s left to you, the app built on top. Want a UI on it? Their Agent Chat UI is a self-hosted Next.js app you fork, not something you hand a customer under their own brand.

Mastra

Mastra ships a hosted platform alongside the framework itself — a builder studio, schedules, and its own auth. That auth secures your own team’s access to that studio with role-based access, not a tenant of your customer base, and model key bindings are scoped to a project or a key, not to an individual customer — per-tenant keys are left to you. Its Channels connect to Slack, Teams, and Discord; they aren’t a UI you put your own brand on.

Vercel AI SDK

The leanest of the three: primitives, not a platform — generateText, a tool loop, and three UI hooks. There’s no tenant concept in any of it — isolating your customers, and building any UI beyond those three hooks, is left to you.

What else we run

Tenancy is the load-bearing one. The rest of the layer comes with it:

  • The runner — A daemon on your customer's own machine — outbound-only, no inbound ports — for the file and shell work that has to happen where their data lives.
  • The embed — @vectrify-ai/ui, one component, themed to your customer’s brand, not ours.
  • Scheduled and webhook runs — Work that fires on a clock or an event and reports back — not just a chat turn.
  • Ingestion and tenant-scoped search — Confluence, SharePoint, web crawl, and direct upload in — then hybrid dense and keyword search, every query scoped to the tenant that asked.

Full detail on every one of these lives on Harness →.

The cost, scoped.

About six months of one senior engineer — not for the agent loop, for the platform underneath it: the tenant model, the isolation, the embeddable UI, the runner. Roughly $100,000 of engineering time on a mid-market $145,000 base salary, fully loaded per BLS compensation data.

What we don’t do

  • Four connectors are live today — Confluence, SharePoint, website crawl, direct upload. Need one we don’t have? We build it on request, usually about a day.
  • Not SOC 2 certified. Tenant isolation, scoped keys, ephemeral tokens, and per-tenant BYOK exist today — the certification doesn’t yet.
  • Pre-launch. No case studies, no logos on this page — every claim above traces to the code or a cited number, not to who’s using it.

Ship the feature your customers buy. Not the platform underneath it.

14-day free trial · No credit card required

Start free trial