bmob

Bmob backend cloud — Main entry

Bmob is a BaaS (Backend as a Service) platform that provides out-of-the-box backend capabilities such as a NoSQL database, user system, file storage, cloud functions, push, SMS, payment, IM, AI, etc. Clients cover JavaScript / Android / iOS / Swift / Flutter / HarmonyOS / Mini Programs / Python / Go / PHP / C#, plus the language-agnostic REST API and MCP Server。

Routing order: first go through the entry decision tree below → then check the routing decision table(choose sub-skill) → for specific operations check shared/operation-routing.md(MCP / curl / SDK·REST three-channel comparison).

Core principles

1. Always confirm the platform before writing code. The API forms of Bmob SDKs on different platforms vary greatly (JS is Bmob.Query, Android is extends BmobObject, old iOS is BmobObject objectWithClassName, pure Swift is try await BmobObject.save(), REST is HTTP /1/classes/<name>), do not stuff JS code into the answer of an Android skill. First look at what platform / framework the user is using, then read the corresponding sub-skill.

2. Do not leak the Master Key on the frontend. In the Bmob console → app keys there are four values:

Key	Security level	Use case
Application ID	Public	All platforms
REST API Key	Semi-public	Browser / Mini Program / Mobile / Server
Secret Key	Medium	Client for encrypted authorization scenarios, together with SecurityCode
Master Key	Highest	Server-side / backend scripts only,never appears in the frontend bundle

3. Check the changelog before writing. SDKs are evolving, and method signatures change. Before starting a task, use the raw URL to fetch the corresponding platform's update_log.md(path see the sub-skill's metadata.docs_raw) to confirm there are no breaking changes.

4. Do not retry errors in a loop. After 2-3 identical failed attempts, stop and reassess:

HTTP 4xx: first take the code in the response body and look it up in bmob-error-codes。
Permission/ACL errors (9015, 9016, etc.): see the P1 temporary path below or the future bmob-acl-and-roles。
"Method not found": the SDK version may be too old or the documentation may not match the version you are using; go to the repository release page to compare.

Entry decision tree (go here first)

flowchart TD
    Start([用户提到 Bmob]) --> Err{响应里有错误 code?}
    Err -->|是| EC[bmob-error-codes]
    Err -->|否| Ship{代码要写进应用并发版?}
    Ship -->|否| McpCfg{IDE 已配置 Bmob MCP?}
    McpCfg -->|是| MCP[bmob-mcp<br/>11 个可调用工具]
    McpCfg -->|否| RestOnly[bmob-database-restful<br/>或 generate_code 需 MCP]
    Ship -->|是| Plat{平台 / 语言?}
    Plat -->|JS Web Node 小程序 Cocos JS 等| JS[bmob-database-javascript]
    Plat -->|Android Kotlin Java| AND[bmob-database-android]
    Plat -->|Pure Swift BmobSwiftSDK async/await| SWIFT[bmob-database-swift]
    Plat -->|Legacy iOS ObjC Swift Bridging Header| IOS[bmob-database-ios]
    Plat -->|Flutter Dart| FLUT[bmob-database-flutter]
    Plat -->|curl Python Go PHP 后端等| REST[bmob-database-restful]
    Plat -->|RN Uni-app JS 桥接| JS
    JS --> Schema{需要真实表字段名?}
    AND --> Schema
    SWIFT --> Schema
    IOS --> Schema
    FLUT --> Schema
    REST --> Schema
    Schema -->|是且已配 MCP| MCP
    Schema -->|否| Done([读对应 sub-skill 写代码])
    MCP --> OpTable[[shared/operation-routing.md<br/>操作级三通道表]]

Routing decision table (once matched, immediately go read the corresponding sub-skill)

User intent	Platform clue	Route to
Create/view table structure, add test data, generate curl boilerplate, hands-on database	—	`bmob-mcp`(precondition: the user has configured MCP)
One-click website deployment / static hosting(HTML or dist to CDN)	—	`bmob-mcp` → `deploy_static_site`(or `generate_code` only generate curl)
NoSQL create, read, update, delete, conditional queries	JS / TS / Web / Node / WeChat/Alipay/ByteDance/QQ/Baidu Mini Programs / Quick App / Cocos Creator JS / Electron / Tauri / hybrid App	`bmob-database-javascript`
NoSQL create, read, update, delete	Android / Kotlin / Java	`bmob-database-android`
NoSQL CRUD	Pure Swift SDK / `BmobSwiftSDK` / SPM / `import BmobSDK` / `async/await`	`bmob-database-swift`
NoSQL CRUD	Legacy iOS SDK / Objective-C / Swift Bridging Header / `BmobSDK.xcframework` / `saveInBackground`	`bmob-database-ios`
NoSQL CRUD	Flutter / Dart（`bmob_plugin`）	`bmob-database-flutter`
NoSQL CRUD / any language without an SDK	curl / Python / Go / PHP / C# / Rust / Ruby / Java backend	`bmob-database-restful`
React Native / Uni-app (connect to Bmob at the JS layer)	—	`bmob-database-javascript` or REST
HarmonyOS ArkTS	—	`bmob-database-restful` + BmobDocs
User registration / login / SMS verification / third-party login / email verification	All platforms	`bmob-auth-{platform}`(P1, see table below)
File upload and download / CDN	All platforms	`bmob-storage-{platform}`(P1, see table below)
Call cloud functions	All platforms	`bmob-cloud-function-{platform}`(P1, see table below)
Write cloud function code that runs on Bmob servers	—	`bmob-cloud-function-development`
ACL / roles / permissions / row-level security	—	`bmob-acl-and-roles`(P1, see table below)
BQL queries (SQL-like syntax)	Any	`bmob-bql`(P1, see table below)
Troubleshoot error codes 9015 / 101 / 105, etc.	—	`bmob-error-codes`
Push / SMS / payment	All platforms	`bmob-push-` / `bmob-sms-` / `bmob-pay-*`（P2）

For which channel to use for specific operations (CRUD, login, upload, deploy), see shared/operation-routing.md。

Temporary paths while P1 / P2 are not yet released

When the dedicated sub-skill is not installed,do not wait idly, degrade according to this table:

User intent	Target skill (unreleased)	Currently available alternative
Registration / login / SMS verification code	`bmob-auth-*`	REST：`bmob-database-restful/references/users.md`; MCP already configured:`generate_code`（`注册` / `用户名密码登录` / `手机号验证码登录` , etc.)
File upload / CDN URL	`bmob-storage-*`	REST：`references/files.md`；MCP：`generate_code` → `上传文件`
Call an existing cloud function	`bmob-mcp` → `invoke_cloud_function`(execute);`generate_code` → `调用云函数`（curl）	REST `/1/functions/<name>`; SDKs for all platforms
Sync / pull online cloud functions to local	`bmob-mcp` → `list_cloud_functions` → `get_cloud_function`	REST `GET /1/functions`
Write and deploy cloud function source code	`bmob-cloud-function-development`	MCP already configured:`deploy_cloud_function` → `invoke_cloud_function`; MCP not configured: BmobDocs + console
ACL / row-level permissions / 9015·9016	`bmob-acl-and-roles`	REST create/update body with `"ACL":{...}`；`bmob-error-codes`
BQL / cross-table aggregation	`bmob-bql`	REST `GET /1/cloudQuery`；`bmob-database-restful`
Push / SMS / payment	P2 skills	REST corresponding module + BmobDocs `mds` directory tree

General security checklist (included by all sub-skills)

The target table of a write operation must have an ACL configured, otherwise any user can modify any row (see the ACL row in the P1 temporary paths).
Browsers / mini programs / mobile devices can use REST API Key (simple authorization / SDK method B) or Secret Key + security code (encrypted authorization / SDK method A)；Neveruse the Master Key.
In encrypted authorization scenarios, the SecurityCode is not transmitted over the network; do not hardcode it into the frontend bundle, inject it via environment variables or put it in the BFF.
For any batch / full table scan / cross-table query → prefer BQL instead of looping SDK calls.
When an error occurs, first look at the code field in the response body and check bmob-error-codes, do not guess randomly.
User password field (password) can only be written by Bmob, cannot update; for password changes, use /1/updateUserPassword/<objectId>。

FAQ and Anti-Patterns

Cross-Platform Common Issues(routing, keys, MCP, data formats):shared/faq.md
Typical Anti-Patterns(ACL, Master Key, 9015 misuse, etc.):shared/anti-patterns.md
Look up numeric codes by English error：bmob-error-codes top "Lookup by Symptom" table

Application Scenario Cookbook

End-to-end scenarios (table design + ACL + flow), then go to each platform skill to write code:

Scenario	Recipe
Blog / CMS (Article + Author)	`shared/recipes/blog-cms.md`
User-owned Todo (row-level ACL)	`shared/recipes/user-owned-todos.md`
WeChat Mini Program login	`shared/recipes/mini-program-login.md`
Avatar upload	`shared/recipes/avatar-upload.md`
Server-side batch migration	`shared/recipes/server-migration.md`
Static site MCP deployment	`shared/recipes/static-site-deploy.md`

Documentation Lookup Methods

Each sub-skill's references/snippets/(committed by BmobDocs sync) and handwritten references/*.md cover most APIs. If still insufficient, fetch the upstream docs:

Locate by filename: the upstream doc tree is at github.com/bmob/BmobDocs/tree/master/mds, organized by <feature>/<platform>/ .
agent direct fetch(bypassing the GitHub rendering layer):
```
https://raw.githubusercontent.com/bmob/BmobDocs/master/mds/<feature>/<platform>/<filename>.md
```
Verified to be directly pullable as pure markdown by the WebFetch tool.

List directory(when you don't know the filename):

https://api.github.com/repos/bmob/BmobDocs/contents/mds/<feature>/<platform>

Still can't find it: go to https://www.bmobapp.com/docs/。

Collaboration with MCP (Key)

If the user has configured the Bmob MCP Server in their IDE (see shared/mcp-install-snippets.md), any task involving "reading real table structures / writing test data / designing schemas / generating boilerplate curl / one-click website deployment" should prioritize MCP, and do not write field names based on guesswork.

tools/list 12 tools in total；agent only call 11 of them（get_project_tables、create_table、add_single_data、update_single_data、delete_single_data、generate_code、deploy_cloud_function、invoke_cloud_function、list_cloud_functions、get_cloud_function、deploy_static_site）。
mcp_endpoint_mcp_post is a server-side internal loopback,do not call。
Tool parameters and prompt comparison:bmob-mcp; operation-level three-channel table:shared/operation-routing.md。

flowchart LR
    User[User prompt mentioning Bmob] --> Root[bmob root SKILL.md]
    Root --> OpRoute[shared/operation-routing.md]
    Root -->|"schema / live CRUD / deploy"| McpSkill[bmob-mcp]
    Root -->|JS / Web / Mini Program| JsDb[bmob-database-javascript]
    Root -->|Android / Kotlin| AndDb[bmob-database-android]
    Root -->|Pure Swift SDK| SwiftDb[bmob-database-swift]
    Root -->|Legacy iOS / ObjC| IosDb[bmob-database-ios]
    Root -->|Flutter / Dart| FlutDb[bmob-database-flutter]
    Root -->|curl / Python / Go| RestDb[bmob-database-restful]
    Root -->|error code| Err[bmob-error-codes]
    McpSkill -.get_project_tables.-> JsDb
    McpSkill -.get_project_tables.-> AndDb
    McpSkill -.get_project_tables.-> SwiftDb
    McpSkill -.get_project_tables.-> IosDb
    McpSkill -.get_project_tables.-> FlutDb
    McpSkill -.get_project_tables.-> RestDb

One-Sentence Summary

User mentions Bmob → read this skill's entry decision tree → routing decision table to choose sub-skill → shared/operation-routing.md to choose MCP / curl / SDK·REST; end-specific code is in the sub-skill's references/ and SKILL.md.