manifest.plugins list.
search
Full-text search backed by SQLite’s FTS5 (or Postgres tsvector on Postgres). Configured on the entity, not as a plugin — the presence of a search config creates FTS5 + facet-bitmap shadow tables on schema push, maintained on every write.
Declare it with the fluent builder’s .search({...}) (or the search key in the entity options):
Query via
POST /api/search/<Entity>, or the React hook:
facetCounts is the live count per facet value over the current filtered hit set — enough to build Algolia-style faceted UIs without Algolia.
LLM proxy
A built-in proxy to LLM providers so your API key stays server-side and clients never see it. It’s configured by environment variables, not a plugin entry. Two endpoints, both requiring an authenticated session:POST /api/llm/complete— non-streaming completion.POST /api/ai/stream— SSE streaming completion.
ctx.llm.complete(...) / ctx.llm.stream(...) (server-only — the key never reaches the client; neither is available in queries).
ctx.llm.stream
complete resolves when the model finishes. stream calls your handler for each event as the provider emits it, then resolves with the same assembled response — so you can push text to the client while it’s generating and still branch on stop_reason afterwards:
text_delta {text}, tool_use_start {id, name}, tool_input_delta {partial_json}, and done {stop_reason, usage}. Tool arguments arrive as raw JSON fragments — concatenate them and parse once at the end.
Same auth gate and same model allowlist as complete: streaming can’t reach a model complete would refuse. Streaming does not extend the call deadline (PYLON_FN_CALL_TIMEOUT, 30s default), so a long agent run has to declare timeout: <seconds> on the function.
To reach every client watching rather than only the caller, push the same deltas through ctx.rooms.broadcast. Full walkthrough, including an agent tool loop: Functions → Streaming LLM output.
Env
Model allowlist
Clients may request a specific model on/api/ai/stream only if it’s allowlisted — otherwise the request is rejected with MODEL_NOT_ALLOWED. Set the allowlist via the manifest llm() helper or PYLON_AI_MODELS_ALLOWED:
- API keys stay server-side — browser / native clients never see them.
- Auth-gated — both endpoints require a session.
- Model allowlist — cap which models clients can invoke.
Not yet built in
The roadmap catalog (pylon plugins list) names a few AI capabilities that are not implemented as built-ins today:
- Vector / semantic search — Pylon has no built-in embedding index. For RAG or similarity today, compute embeddings in a server function and store/query them yourself (a dedicated store like pgvector or Qdrant, or a table you scan), or wait for the built-in.
- MCP server — exposing your entities/functions as Model Context Protocol tools is planned, not shipped.