The framework your AI was waiting for. Schema-driven. Three lines of PHP. Production-grade by the second request.

Your AI ships a working backend before lunch.

Shape is the first backend framework where "have an AI build the API" is the supported path, not a hack. Schema-driven. Production-grade. One file.

Drop AGENTS.md into your AI → See the code on GitHub

01 — One file

That's the whole backend.

Point Shape at any database. The framework auto-generates JSON, OData, REST, OpenAPI, MCP, and LLM-tool definitions from your schema. No entity classes. No controllers. No DTO layer.

<?php
require __DIR__ . '/../vendor/autoload.php';
Shape\ShapeApp::quickStart(__DIR__ . '/../.env')->serve();

02 — One AGENTS.md

Your AI's onboarding doc.

~5k tokens of framework conventions. Drop into Claude / ChatGPT / Cursor / Codex once — the AI's defaults are now Shape-shaped. Errors are self-documenting (expected / example / hint); the manifest is one fetch away.

curl https://raw.githubusercontent.com/\
urbidata/shape/main/AGENTS.md \
  | pbcopy
# Paste into your AI of choice.

03 — Production by default

Not behind a paywall.

JWT + OIDC (Entra/Auth0/Okta), audit log, soft-delete, audit columns, SQL-bounded pagination, ETag/Cache-Control, MCP server, OpenAPI — every one detected by convention or shipped in the box. Zero opt-in needed.

# What you don't have to write:
- routes        - audit log
- auth          - soft-delete
- DTOs          - pagination
- MCP server    - cache headers

Not just PHP. Shape is a pattern, not a single stack.

A team picking Shape on PHP today isn't betting on a language — the same conventions and manifest shape ship across runtimes as the team grows.

PHP 8.4 Reference · Shipping

.NET Shipping

TypeScript Roadmap

Python Roadmap

Go Roadmap

Switch your stack without rewriting your app.

PHP and .NET share the substrate, not just the brand. The same config/shape.json runs on either runtime. The same database schema, manifest, OpenAPI, MCP tools, and JWT tokens come out the other end. Switching is a deployment change, not a rewrite.

What stays the same	Why it just works
Database schema + auto-detect conventions	Both runtimes read `deleted_at`, `audit_log`, `users_lookup_column` the same way
`config/shape.json` (masks, access, DSN, OIDC presets)	Verbatim — no translation step
`?manifest` and `?openapi` JSON	Byte-compatible; AI agents and SDK generators don't notice
`?mcp` server + tool definitions	Same JSON-RPC protocol; Claude Desktop config unchanged
JWT tokens	Same signing; sessions survive the switch
REST / OData / generic-mask URLs	Same paths; frontend code unchanged

Install the new runtime alongside the old.
Point it at the same config/shape.json and database.
Diff ?manifest — confirm parity.
Switch traffic at DNS or load balancer. Reverse to roll back.

Read the full migration guide →

Three audiences. One fit.

A framework that earns its place on every desk in the room.

The developer

Write less. Debug less. Ship sooner. Your AI agent now produces working PHP on the first try because the framework has stripped away the parts AIs get wrong.

The CTO / stakeholder

Backend MVPs in days, not weeks. Compliance-grade audit trail and role-based access on day one. One entry point makes scope-creep easy to govern.

The AI agent

Token-frugal manifest. Role-filtered tools/list. Errors that tell you how to fix the call. Every surface designed for tokens, not humans.