Fusio
A self-hosted platform for publishing databases, services, and business logic as managed APIs for people and AI agents.
The evidence shows a self-hosted platform, recommends isolating the administrative app on an internal subdomain, and identifies external interactions with the marketplace, SDKgen, TypeHub, APImon, and multiple AI providers. The license and project channels provide some source attribution. Deductions apply because there is no demonstrated fine-grained least-privilege policy, explicit review or confirmation gate before AI-generated code runs, complete data-flow or telemetry disclosure, secret-storage/redaction controls, or rollback mechanism. The Docker example also embeds weak fixed demonstration credentials. Dependencies are installed through Composer and GitHub Actions referenced by mutable major tags, with no shown vulnerability scanning, supply-chain policy, or dependency-update controls. No red-line behavior is evident, but publisher identity remains unknown.
The Docker and manual setup instructions, database support, and Action/Operation model are broadly consistent with CI steps for migration, user creation, login, and deployment. CI covers PHP 8.4 and 8.5 with MySQL, providing reasonable evidence that the principal setup path and dependencies are coherent. Deductions reflect the absence of error-handling conventions, user-facing failure messages, retry or degradation behavior, and handling for unavailable dependencies; none of these paths were executed in this static review.
The material clearly addresses legacy databases, microservices, custom logic, developer portals, SDKs, monetization, and AI-agent use cases, while supporting several databases, implementation languages, and AI providers. Full credit is deducted because the Agent's safety and capability boundaries are underspecified, and the conditions for triggering, approving, or executing generated Actions are imprecise. Production environment guidance is limited to general Nginx/Apache or Docker direction.
The README has strong organization and supplies feature descriptions, Docker and manual installation, introductory examples, integrations, domain layouts, documentation, and support routes. The complete Apache-2.0 text fully establishes the license. Deductions apply because version history is represented only indirectly by a 7.0 reference and a releases link, with no supplied changelog or compatibility policy; known and security limitations and FAQ material are sparse. Maintenance channels are clear, but accountable ownership, release commitments, and publisher identity are not verified by the supplied files.
The Action examples, configurable forms, Workers, language support, SDKs, and portals indicate outputs that can be used directly to build and consume APIs, with plausible marginal value over assembling these facilities separately. Deductions apply because scalability, effortless SDK generation, load balancing, and AI-assistance benefits are primarily assertions without in-scope benchmarks, case evidence, or quantified outcomes. Model costs, external-service charges, and operational burden are not described.
Some claims trace to concrete installation commands, code examples, CI steps, and the license, while README and CI provide limited corroboration for migration and account setup. Deductions apply because most broad feature and effectiveness claims lack source locations, test mappings, or other evidence in the supplied files and instead point to unavailable external documentation. Marketing statements, established facts, and inference are not explicitly separated.
- AI-generated Worker Actions are executable backend logic. The supplied material shows no pre-execution approval, sandbox, permission restriction, or automated security check; review them manually and test in isolation before deployment.
- Do not reuse the README's project key, database password, or administrator example credentials in production. Delete install.php as advised and restrict exposure of the administrative backend.
- Before enabling ChatGPT, Gemini, the marketplace, SDKgen, TypeHub, or monitoring services, independently establish what data is transmitted, how credentials and data are retained, applicable costs, and failure behavior.
- The evidence does not include a dependency inventory, lock-file contents, security-scan results, or rollback procedure. Perform a separate supply-chain review and establish tested backup and recovery processes before production use.
What does this agent do, and when should you use it?
Fusio is a PHP-based, self-hosted API management platform and gateway that turns databases, microservices, and custom business logic into REST API products. Its execution unit is an Action: an Operation maps an HTTP method and path to code that receives RequestInterface, ParametersInterface, and ContextInterface and returns the API response. Teams can implement Actions as PHP classes or develop PHP, JavaScript, and Python logic through backend Worker actions. The platform also provides a developer portal, OpenAPI interfaces, client SDK generation, subscriptions, quotas, billing, analytics, and error logging. Native MCP support exposes APIs to AI ecosystems, while the Agent introduced in version 7.0 generates Worker actions through Ollama, ChatGPT, or Gemini. It fits teams seeking an API product layer under their own infrastructure, provided they are prepared to operate the application, database, credentials, and production web stack.
For each incoming request, an Operation selects an Action using the configured HTTP method and path. A PHP class implementing Engine\ActionInterface executes handle(), reads Engine\RequestInterface, Engine\ParametersInterface, and Engine\ContextInterface, and returns data for the response. An Action derived from Engine\ActionAbstract can declare editable backend parameters through configure() and Engine\Form\BuilderInterface. Worker actions provide another execution path for writing PHP, JavaScript, or Python logic directly in the backend; the Agent can generate those Worker actions from natural-language instructions. Fusio can expose MySQL, PostgreSQL, and other SQL/NoSQL data sources as REST APIs and can secure, route, orchestrate, and load-balance microservice traffic. Around that runtime, it produces a developer portal, OpenAPI specifications, and client SDKs, while managing keys, plans, quotas, automated billing, usage analytics, performance metrics, and error logs. Its MCP support presents API capabilities to AI systems as tools.
- A team maintaining a legacy MySQL or PostgreSQL system needs to publish managed REST endpoints without replacing the entire backend.
- A platform team running distributed services needs a self-hosted entry point for securing, routing, orchestrating, and load-balancing traffic.
- PHP developers want reusable business classes mapped to explicit HTTP methods and paths, with selected parameters editable from an administrative form.
- A JavaScript- or Python-oriented team wants to implement endpoint logic through backend Workers instead of creating custom PHP classes.
- An API product owner needs a developer portal, documentation, testing tools, credentials, SDKs, subscription plans, quotas, billing, and usage analytics.
- An AI integration team wants to expose backend operations through MCP or generate Worker actions using Ollama, ChatGPT, or Gemini.
What are this agent's strengths and limitations?
- Combines the API gateway, Action runtime, developer portal, SDK generation, monetization, and monitoring in one self-hosted platform.
- Supports both code-defined PHP Actions and backend Workers written in PHP, JavaScript, or Python.
- Native MCP exposes existing APIs to AI ecosystems, and the Agent supports Ollama, ChatGPT, and Gemini instead of requiring one model provider.
- Offers Docker, manual, and web-installer deployment paths, with documented MySQL, PostgreSQL, and SQLite connections.
- Generated configuration forms let developers make reusable Action behavior adjustable by non-technical backend users.
- The documented PHP built-in server is development-only; production requires a separately operated Nginx/Apache setup or Docker deployment.
- Adopters remain responsible for the Fusio host, database, domain layout, project key, administrator credentials, and removal of the web installer.
- Some ecosystem functions, including SDKgen, require registration with an external service and configuration of client credentials.
- The supplied setup examples do not detail MCP configuration, automated billing, load balancing, or individual AI-provider setup, so these areas require further deployment validation.
- AI generation depends on Ollama, ChatGPT, or Gemini, while provider-specific costs, connectivity, and output quality are not quantified.
How do you install or deploy this agent?
For the documented Docker path, create a compose.yaml with a fusio/fusio service. Set FUSIO_PROJECT_KEY, FUSIO_CONNECTION, FUSIO_BACKEND_USER, FUSIO_BACKEND_EMAIL, and FUSIO_BACKEND_PW, map port 8080:80, and add a MySQL 8.0 service configured with MYSQL_USER, MYSQL_PASSWORD, and MYSQL_DATABASE. Run docker compose up -d, open http://localhost:8080/apps/fusio, and sign in with the configured backend credentials.
For a manual installation, run git clone https://github.com/apioo/fusio.git. Configure .env with an APP_CONNECTION such as pdo-mysql://root:password@localhost/fusio; setting APP_URL=http://localhost:8080 is also recommended. PostgreSQL and SQLite use pdo-pgsql://user:pass@host/db and pdo-sqlite:///fusio.sqlite. Run php bin/fusio migrate, then php bin/fusio adduser and choose Administrator, followed by php bin/fusio marketplace:install fusio. For development only, start it with php -S 127.0.0.1:8080 -t public; production requires Nginx/Apache or Docker. A web installer is also available at /install.php, which should be deleted after installation.
How do you use this agent?
Create an Action in the backend, then configure an Operation that binds it to an HTTP method and path. A minimal PHP implementation of Fusio\Engine\ActionInterface defines handle(Engine\RequestInterface $request, Engine\ParametersInterface $configuration, Engine\ContextInterface $context): mixed and can return data such as ['hello' => 'world']. To expose editable configuration, extend Engine\ActionAbstract, add a field with $builder->add($elementFactory->newInput('message', 'Message', 'text', 'The message which should be returned')), and read it with $configuration->get('message'). Alternatively, use the Worker designer to write PHP, JavaScript, or Python logic in the backend. In the AI workflow, describe the desired behavior to the Agent—for example, request a list of popular nineteenth-century composers—and it generates a corresponding Worker action. The main administration app is at /apps/fusio/; apps and actions can be installed from the Marketplace, while consumers can use the official C#, Go, Java, JavaScript, PHP, or Python SDKs or call the REST API directly.
How does this agent compare with similar options?
Docker Compose is the shortest documented route to a local Fusio-plus-MySQL deployment. Manual installation provides explicit MySQL, PostgreSQL, and SQLite choices but requires migrations, administrator creation, Marketplace installation, and a production Nginx/Apache setup; the web installer offers an interactive path but leaves /install.php to be removed afterward. For implementation, a custom PHP Action gives a code-defined ActionInterface component, a Worker permits PHP, JavaScript, or Python development inside the backend, and the Agent uses Ollama, ChatGPT, or Gemini to generate Worker code from a prompt. Consumers can choose official SDKs for simplified integration or communicate with the REST API directly for greater control.
FAQ
Does Fusio require a cloud AI provider?
Can Fusio be used purely as an API gateway without its AI features?
Which databases are supported?
Is the built-in PHP server suitable for production?
php -S 127.0.0.1:8080 -t public is documented for testing only. Production deployments require a conventional Nginx/Apache setup or Docker, along with correct URL, database, and credential configuration.