Skip to content
Restura Docs

Capability matrix

Restura’s capability matrix is data-driven: there’s a single source of truth at src/lib/shared/capabilities.ts and a CI gate (npm run capabilities:check) that fails if the published doc drifts from the code.

Quick summary

Section titled “Quick summary”

Available on both web and desktop

Section titled “Available on both web and desktop”
  • HTTP / REST (all methods, body types).
  • GraphQL — queries, mutations, subscriptions over a graphql-ws WebSocket.
  • gRPC unary + server streaming (via the Connect protocol).
  • WebSocket — connect, send/receive, full history.
  • Server-Sent Events — basic stream viewer with reconnection.
  • MCP — streamable-HTTP transport (http-sse is desktop-only).
  • Socket.IO — emit / listen / ack.
  • Collections, environments, scripts, and the safe OWS workflow profile (do, set, wait, timeout/cancellation, and bound HTTP saved-request calls). OWS event/process tasks, controls without a bounded runtime, and non-HTTP calls are rejected.
  • Load testing — fire an HTTP request at bounded concurrency (browser caps effective concurrency ~6).
  • Persistent IndexedDB storage (not encrypted at rest).
  • SSRF guard on all upstream requests.

Desktop only

Section titled “Desktop only”
  • Kafka — produce / consume / SASL / TLS (needs raw TCP).
  • MQTT — publish / subscribe / QoS / TLS / MQTT 5.0 (needs raw TCP).
  • MCP http-sse transport — rejected in web mode; use streamable-http on web.
  • WebSocket custom handshake headers — the browser WebSocket API can’t set upgrade headers.
  • mTLS client certificates.
  • SOCKS4 / SOCKS5 proxies.
  • Custom CA bundle, disable TLS verification.
  • Pre-flight DNS guard against DNS-rebind.
  • Filesystem-backed collections + git operations.
  • OS keychain storage (via safeStorage).
  • Encrypted local storage backed by an OS-keychain-wrapped key.
  • Native shell / notifications / tray.
  • Local mock HTTP server.
  • AI assistant — request-aware chat (OpenAI / Anthropic / OpenRouter); Electron-first, streams over IPC. No Worker /api/ai route.
  • AI Lab — prompt/model testing workbench (Playground, dataset evals with deterministic + script + LLM-as-judge + tool-call + pairwise scorers, an execute-and-score http-exec target, model-vs-model Arena, and versioned agent suites) against local and cloud models. Needs the localhost SSRF carve-out.
  • AI Lab agent tools — saved HTTP requests and MCP servers run through the existing execution/security boundaries; non-read requests require explicit approval. Pluggable code-sandbox contracts exist, but no sandbox provider ships yet.

Self-hosted

Section titled “Self-hosted”

Self-hosted (Docker) inherits the web capability profile — the SPA runs in a browser, just from your own server. Kafka, SOCKS, mTLS, etc. remain desktop-only because they require Node-level networking that the browser doesn’t expose.

If you need both self-hosted and the desktop-only capabilities, run the desktop app locally and point it at your self-hosted gateway as a normal upstream.

Section titled “Related”
ResturaThe API client that speaks every protocol.
Built byDipjyoti MetiaGitHubMIT licensed