Docs
siDiscord

crab.toml

Declare a service's published image, tools, permissions, credentials, database and defaults.

crab.toml sits beside the service's Cargo.toml, or stands alone to select a published release. An unknown key is refused, and paths are relative to the file. crab build reads its build declarations into the image.

image = "alice/weather-desk"
public = true
template = true

[http]
fetch = ["api.example.com"]

[database]
size = "1GiB"
seed = "seed.db"
migrations = "migrations"

[crons]
tick = "*/5 * * * *"

[tools.forecast]
access = "public"
title = "Forecast a city's weather"
price = 2_000
catalog = "weather.forecast"
Key
image Optional published address, owner/service. crab publish builds and publishes there; the version comes from Cargo. crab deploy uses that published release and creates a private instance under the selected account. Without an image, deployment builds source and uses the Cargo package name. A standalone file selects an exact release with owner/service:1.2.3.
id, formerly Stable migration identity and former package names for a stateful crate reused as a dependency. See Reusing services.
public Makes a source deployment public. Defaults to false. Published-image copies start private. Tool access rules still apply.
template Whether crab publish publishes or withdraws the image and its documentation. Defaults to false.
logo Optional absolute HTTPS URL of the service's logo. Invalid URLs are refused before build, deploy or publication. Validation does not fetch the image.
deploy false keeps the service out of directory group deployments, and refuses it when named with -p or deployed from its own directory. crab publish still includes it.
secrets Hostless secrets, such as a webhook verification key. Outbound HTTP injection requires a credential with hosts.
secret_resources Allows explicitly granted runtime secret resources in outgoing requests; defaults to false. See Runtime secrets.
[credentials.<id>] Secrets a person gets together from one provider, with a guide. See Credentials.
buffer The most bytes a call's arguments, or a tool's result, may hold. 16 KiB when absent. Arguments past it are refused, and a result past it fails the call.
[http] Allowed outbound hosts under fetch and proxy. Missing or empty lists allow none. See HTTP.
[database] migrations, a directory of *.sql; size, what the database may hold, from 64 KiB to 10 GiB, 1 GiB when absent; seed, a SQLite file a service on Cloud with no database starts from. See Data.
[crons] Each cron tool's schedule, five fields in UTC. Embedded in the image and applied on deploy; a tool left out has no schedule.
[vars] Settings each deployed copy holds its own value of, each a default and a description: keywords = { default = "rust, wasm", description = "Words to watch" }. See Vars.
[tools.<tool>] Who may call the tool, its title, its price, its catalog job and its budget. See Tools.

Linked service libraries contribute their requirements and migrations from their own crab.toml; deployment settings are not inherited.

name is no longer supported. image is required for publication; its account must authorize the caller. For example, connect/tinyfish publishes under connect, even when another account is selected in the context. A key bound to another account is refused.

Use crab deploy --build to deploy local changes instead of the published image. A published release supplies its own tools, permissions, credentials, vars, migrations and schedules; local source declarations, seed, prices and publication settings are not applied to its private copy. An unavailable release fails without falling back to a build. See Deploying.

Tools

[tools.forecast]
access = "public"
title = "Forecast a city's weather"
price = 2_000
catalog = "weather.forecast"
budget = { cpu = 5_000, read = 1_000, written = 1, memory = 16 }

Each key of a tool's table is optional, and a table naming a tool the service lacks is refused.

Key
access Who may call it: "public", callers from outside and other services; "anonymous", public and also callable with no caller; or restricted to "accounts", callers from outside, or "services", other services. Absent, only the host calls it. A cron, stripe or webhook tool takes none. See Access.
title Its display name, at most 60 characters on one line. MCP clients show it as the tool's title.
price Its price per call on Cloud, in USD micros, at least 100: 2_000 is $0.002. A deploy replaces the service's prices with these.
catalog The job it does, as company.enrich: a platform in crab's list, ., then the job. See Service catalog for classification and registry contributions.
budget What one call may use: cpu in microseconds, rows read, rows written, memory in MiB, each at least 1. A key left out takes the default. See Budgets.

A price or catalog on a tool without access is refused. The build writes access, title, catalog and budget into the image; a deploy carries price, so whoever deploys the image sets it.

HTTP

[http]
fetch = ["api.example.com"]
proxy = ["*.example.org"]
  • fetch and proxy list the hosts direct and proxied requests may reach. Missing or empty lists allow none. Batch requests use the same lists. See HTTP for host patterns and network restrictions.
  • Linked libraries contribute their destinations; each list is merged without duplicates.
  • Syscalls are discovered from the final Wasm imports. A deploy is refused when the host cannot serve an imported call. No syscall declarations are needed in crab.toml.

From Cargo.toml

The service's page shows the package's description, homepage, repository, version and readme, as its Cargo.toml sets them when the image is built. Each is empty when unset; Cargo takes a README.md beside the manifest as the readme when it names none.