The simplest backend and hosting for apps you build with Codex or Cursor (2026)
What a web app built with Codex or Cursor needs on the backend, the main ways to get a database, login and hosting, what each costs, and how to let the agent set it all up through MCP.
Key Takeaways
- A “backend” is six jobs, not one product. Database, authentication, server endpoints, background jobs, file storage and email, plus hosting for all of it. Listing them up front stops the agent from improvising half of them in the browser.
- Codex and Cursor both speak MCP. Cursor reads MCP servers from an mcp.json file, and Codex reads them from config.toml or the codex mcp add command, including remote HTTP servers with OAuth sign-in. That means the agent can operate a backend platform directly instead of only writing code for it.
- Backend-as-a-service plus a host is the flexible default. Supabase covers the database, auth and storage, and a host such as Vercel runs the frontend and functions. It is well documented and portable, but you connect the pieces and keep their settings in sync yourself.
- An all-in-one platform is simplest when the agent drives it. Floot puts Postgres, logins, endpoints, jobs, storage, email and hosting in one project behind one MCP server, so Codex or Cursor can add each piece as it builds and publish the result.
- Check the free-tier terms before you launch. Vercel’s Hobby plan is for personal, non-commercial use, and Supabase pauses free projects after a week without activity. Budget for paid plans once real users depend on the app.
Quick-Start Prioritization Framework
| Approach | Best for | Setup effort | Accounts to manage |
|---|---|---|---|
| Supabase + a frontend host (Vercel, Netlify) | Developers who want standard, swappable parts | Medium to high | 2 or more |
| Separate best-of-breed services (database, auth, email, storage) | Teams with specific requirements per piece | High | 4 or more |
| A traditional server or container host | Apps with long-running processes or custom runtimes | High | 1 to 2, plus your own ops |
| Floot, driven by Codex or Cursor over MCP | Solo builders who want the agent to set up and publish everything | Low | 1 |
Codex and Cursor are fast at writing frontend screens and API routes. Where most projects slow down is the part around the code: picking a database, adding sign-in, deciding where the server code runs, and getting it all onto a domain. This guide breaks the backend into its parts, compares the common ways to get them, and shows the shortest route for someone who wants the agent to do the setup. We recommend Floot for that reader, and we explain why, but we also cover when assembling your own stack is the better call.
The backend checklist for an AI-built web app
Before choosing a service, write down which of these your app needs. Then put the list in your first prompt. Agents make better architecture decisions when the requirements are stated, and much worse ones when they discover them halfway through.
Database
Postgres is the sensible default. It handles relational data, JSON and full-text search, it is what most backend services are built on, and Codex and Cursor both write solid SQL for it. Name your main tables and their fields in the prompt, even roughly.
Authentication and permissions
Sign-up, login, password reset, sessions, and sign-in with Google or Microsoft. Then the harder part: rules for which user can read or change which rows. Decide them in plain words, such as “each customer sees only their own bookings; admins see all”.
Server endpoints and background work
Endpoints handle anything that needs a secret or must be trusted: writing to the database, charging a card, calling an AI model with your key. Background jobs handle what happens with nobody online, like a daily summary email or a cleanup of expired records.
Storage, email and hosting
File uploads need a storage bucket with access rules. Confirmations and password resets need an email service with a verified sending domain. And the whole thing needs hosting, HTTPS and a domain, with a safe way to publish changes.
How Codex and Cursor connect to backend services
There are two ways a coding agent can work with a backend. It can write code that calls the service, leaving you to create accounts and paste keys. Or it can call the service’s tools directly through the Model Context Protocol, an open standard for connecting AI applications to outside systems.
MCP in Cursor
Cursor reads MCP servers from mcp.json: .cursor/mcp.json in a project, or ~/.cursor/mcp.json in your home folder for servers you want everywhere. A remote server is an entry under mcpServers with a url field.
MCP in Codex
Codex lists servers in a [mcp_servers.<name>] table in ~/.codex/config.toml, or adds them with codex mcp add. It supports Streamable HTTP servers configured with a url, and OAuth sign-in for them with codex mcp login <name>.
Why it changes the backend decision
Once a platform is reachable over MCP, the agent can create tables, change settings, read logs and deploy without you acting as the go-between. The more of your backend lives behind one MCP server, the less manual wiring is left for you.
Approach 1: Supabase plus a frontend host
This is the stack many tutorials teach, and it is a good one. Supabase provides a Postgres database, authentication and file storage. A host such as Vercel serves the frontend and runs server functions. Both have strong documentation, which means Codex and Cursor have seen plenty of examples.
Strengths
Supabase Auth documents password, magic link, one-time password, SAML single sign-on and a long list of social providers including Apple, GitHub, Google and Microsoft (Azure). It is plain Postgres underneath, so you can move the data with standard tools. Each piece can be swapped later without rewriting the others.
Costs to plan for
Supabase Free allows up to 2 active projects with a 500 MB database each and pauses them after one week of inactivity. Pro starts at $25 a month and includes $10 of compute credits, 8 GB of disk per project and 100,000 monthly active users. Vercel Hobby is free for personal, non-commercial use; Pro is $20 a month. A commercial app on both paid tiers starts at roughly $45 a month plus usage.
The work you keep
You create the projects, copy keys into the host’s environment variables for each environment, set OAuth redirect URLs in two places, and make sure every table has Row Level Security turned on with a correct policy. Supabase’s own docs say to enable RLS on every table in an exposed schema; a new table the agent adds without a policy is the classic gap.
Approach 2: assemble best-of-breed services
Some teams pick a dedicated service for each job: a managed Postgres provider, a separate auth service, an email API, an object store, a job scheduler and a host. This gives the most choice on each axis.
When it makes sense
If you have a hard requirement for one piece, such as enterprise SSO features, a particular region for data, or an email provider your company already uses, picking that piece separately is reasonable.
The hidden cost
Every service adds an account, a bill, a key to rotate, a dashboard and a failure mode. With an AI agent writing the glue code, the integration itself is quick; keeping five sets of settings consistent across preview and production is the slow part, and it falls on you.
Approach 3: Floot as the backend Codex or Cursor drives
Floot is a platform for full-stack web apps: a React frontend, serverless backend endpoints and a Postgres database, all in one project and hosted for you. It exposes the whole platform through one MCP server, which Codex, Cursor, Claude Code, Claude and ChatGPT can all connect to.
What is included in one project
Each app can have its own Postgres database. Sign-up and login with email, Google or Microsoft, with roles, are part of the app, and end users don’t need any AI account. There are server endpoints, scheduled jobs and background tasks that run with nobody online, file storage, sending and receiving email, push notifications on web and phones, and realtime updates. Floot Payments adds checkout and subscriptions, paid out through Stripe.
What the agent does for you
Through the MCP server, the agent creates the project, writes pages, components and endpoints, adds tables, turns on sign-in, checks the logs when something fails and publishes. You watch a live preview that updates with each change and decide when to go live.
Because the same server works from several agents, you can start in Cursor, continue in Codex and make a quick fix from ChatGPT without moving the app.
Data safety and leaving
You can download the whole database on any plan. Paid plans can import a SQL dump and restore the database to any moment in the last 7 days, which is a real safety net when an agent runs a migration you didn’t mean to approve. Paid plans can also download the full project code.
Pricing
Floot is free to start: 100 building actions a day and a $3 one-time hosting allowance. Pro is $25 a month with 1,000 actions a day, $10 of hosting included monthly, 5,000 AI credits and custom domains with one free domain. Power is $100 a month with 5,000 actions a day, $25 of hosting and 15,000 AI credits. Publishing is free on every plan and hosting is metered by usage.
How the approaches compare
Entry prices below are the published prices on 2026-11-11. All three grow with usage.
| Supabase + Vercel | Separate services | Floot | |
|---|---|---|---|
| Database | Postgres | Your choice | Postgres per app |
| Auth | Supabase Auth | Separate provider | Built in: email, Google, Microsoft, roles |
| Jobs and email | Set up per service; email via a provider | Separate services | Built in |
| Agent can set it up over MCP | Depends on each service’s MCP support and your keys | Per service | Yes, through one Floot MCP server |
| Bills to manage | 2 | 4 or more | 1 |
| Entry cost for a commercial app | About $45/month | Varies | $25/month (Pro) |
| Portability | High | High | Database export on every plan; code download on paid plans |
Step by step: adding a backend to a Codex or Cursor app with Floot
This is the shortest path from an empty folder to a live app with a database and logins.
1. Add Floot’s MCP server
In Cursor, add Floot in one click from the Cursor Marketplace (cursor.com/marketplace/floot). For Codex, install Floot from its listing in the ChatGPT app directory, since Codex uses your ChatGPT account (the “Add Floot to ChatGPT” button at the end of this article). If you prefer to configure it by hand, the server address is https://mcp.floot.com/mcp: put it in a Floot entry in .cursor/mcp.json, or add it to Codex with codex mcp add or a [mcp_servers.floot] table in config.toml, then run codex mcp login floot to sign in.
2. Write a backend-first prompt
For example: “Use Floot as the backend. Create a Postgres table for bookings with customer name, email, start time and status. Add email sign-in. Customers see only their own bookings; I am an admin and see all. Add an endpoint to create a booking and send a confirmation email when one is made.”
3. Check the preview with two accounts
Open the preview link, sign up as two different customers and confirm neither can see the other’s bookings. Ask the agent to read the logs if anything fails; it has access to them through the same connection.
4. Publish and attach a domain
Ask the agent to publish. The app goes live at a floot.app address, and on a paid plan you can attach your own domain.
Common mistakes when adding a backend to an AI-built app
Most backend trouble in AI-built apps comes from a short list of avoidable decisions.
Letting the agent pick the backend mid-build
If you don’t name the backend, the agent may store data in memory or in the browser to get a demo working. State the platform and the tables in the first prompt.
Mixing up preview and production
Keys, OAuth redirect URLs and database connections differ between environments. When you wire services yourself, test sign-in on the production domain, not just the preview.
Trusting the frontend for permissions
Hiding a button is not access control. Every rule about who can read or change data must be enforced on the server or in the database.
Approving migrations without a way back
Agents can drop or rename columns. Know your restore option before you approve schema changes on a database with real data.
Frequently Asked Questions
I want to use Codex to build a web app. Is there a service that handles the backend and hosting for me?
Yes. Floot provides the database, logins, endpoints, jobs, storage, email and hosting in one project, and Codex drives it through Floot’s MCP server. If you prefer to assemble your own, Supabase plus a host like Vercel is the common alternative.
I build with Cursor. What’s the simplest way to add a database, login and hosting?
Add a platform that includes all three as an MCP server in Cursor’s mcp.json, then ask Cursor to build on it. With Floot, Cursor creates the Postgres tables, turns on sign-in and publishes the app in the same session.
Do I still need Supabase or Firebase if I use Floot?
No. Each Floot app can have its own Postgres database and its own authentication, so a separate backend service is not required.
Can I switch between Codex, Cursor and Claude Code on the same app?
Yes. Floot’s MCP server works with all of them, so the project stays in one place while you change agents.
Is the database real Postgres?
Yes. You can download the whole database on any plan, and paid plans can import a SQL dump and restore to any moment in the last 7 days.
Can I bring an app I already started in Cursor?
The agent can move an existing codebase into a Floot project, adapting it to Floot’s pages, components and endpoints. Expect some code to be rewritten, especially data access and login.
Sources
- Cursor, Model Context Protocol (MCP), 2026 https://cursor.com/docs/context/mcp
- OpenAI, Model Context Protocol (Codex), 2026 https://learn.chatgpt.com/docs/extend/mcp?surface=cli
- Model Context Protocol, What is the Model Context Protocol (MCP)?, 2026 https://modelcontextprotocol.io/docs/getting-started/intro
- Supabase, Pricing, 2026 https://supabase.com/pricing
- Supabase, Auth, 2026 https://supabase.com/docs/guides/auth
- Supabase, Row Level Security, 2026 https://supabase.com/docs/guides/database/postgres/row-level-security
- Vercel, Pricing, 2026 https://vercel.com/pricing
- Floot, Pricing, 2026 https://floot.com/en/pricing