NocoBase combines visual pages, workflows, and relational data
NocoBase is a business-application platform for approval tools, customer records, dashboards, and similar structured work. Administrators define collections, pages, actions, workflows, and roles in a visual interface. Developers use plugins, HTTP APIs, MCP, a CLI, and coding-agent skills. That shared model suits teams whose spreadsheets have become fragile but whose processes do not justify separate custom applications.
At commit 2ff358d, our checkout contained 26,552 files and roughly 1,800,208 lines of source before dependencies. The code is organized as Yarn workspaces, and the project describes a microkernel design where features arrive through plugins. A team can begin with visual configuration, then add code where the built-in blocks stop fitting its process.
Relational data is the reason to pick it over a page builder
The README says business data stays in standard relational structures, separate from the interface, and can come from the main database, outside databases, or third-party APIs. Visual screens, workflows, and permissions sit on that model. This fits an approval system or case-management tool better than a builder centered mainly on disconnected forms.
Coding agents can use the CLI and skills, while AI employees work inside the application with assigned roles and field-level read and write permissions. The README also describes audit logs for data changes and workflow triggers. Those controls give operators something concrete to test, especially because the 150.4 MB checkout contains a wide plugin surface.
What happened when we ran it
Our sandbox install failed with exit code 1 after 309 seconds. We used commit 2ff358d in an unprivileged container with 3 CPUs, 8 GB of RAM, no secrets, and an image labeled lab-node:22. Yarn's final error said @langchain/anthropic@1.3.17 expected Node 20 or newer and that the running version was 18.20.8. The log does not say why the image label and reported runtime differed.
The failure happened during dependency fetching, after warnings about pinned dayjs and nwsapi resolutions. Installation stopped there, so build and tests were not reached. Our repository scan found 25 CI workflow files, a Dockerfile, a compose file, workspace configuration, and no tests directory. These are structural signals only; they do not substitute for a test result.
The published quick start is shorter than preparing all 26,552 source files for development. It installs the NocoBase CLI and starts nb init --ui. The current guide calls for Node 22 or newer and Yarn 1.x, then covers storage, port, and database choices. Docker must already be running for that option. A public instance also needs HTTPS and a reverse proxy.
Version 2.2 makes the /v/ frontend a migration decision
Release 2.2.0 introduced an independent /v/ frontend that removes compatibility with V1 pages and client plugins. The notes advise V1-heavy applications to migrate pages and related plugins before switching. They list capabilities that differ or remain unavailable under /v/, including workflow manual nodes and older blocks. Existing deployments should inventory those dependencies before changing the entry path.
File access changed in the same 2.2 release. Managed files now use stable /files/ URLs that pass through NocoBase for identity and permission checks before a 302 redirect to storage. Manual proxies must route that path before the frontend fallback and avoid caching the redirect target. The notes recommend a database snapshot where rollback matters because new URLs may not work on an older version.
The license excludes public platform products
GitHub reports no standard SPDX license for NocoBase. Its February 24, 2026 agreement incorporates Apache 2.0, then adds terms that take precedence. Community Edition users may use the software commercially, but most NocoBase branding must remain. The agreement forbids offering the original or modified software to the public as a no-code, low-code, or AI platform SaaS or PaaS.
That boundary can settle the decision before a 309-second install is attempted. An ordinary internal application may fit, while a hosted platform for customers may not. Commercial licenses add rights, including branding changes, yet retain restrictions around platform products and redistribution. Product teams should have the current agreement reviewed against the service they intend to sell.
Two open reports require review before lower-trust access
Issue 10416, opened August 26, reports stored cross-site scripting when a user writes arbitrary HTML to a rich-text field through the collection API. The report says the editor limits browser input, while the API stores HTML without server-side sanitizing before rendering. It identifies a commit and file; no published advisory exists. Deployments accepting lower-trust API writes should reproduce it and track the response.
Issue 10269 describes unsafe template interpolation in the SQL workflow plugin when unsafeInjection is enabled. It remained open after an August 21 update. The report says the safe path uses parameterized replacements and identifies a migration that enables the unsafe mode for some existing nodes with template parameters. Teams using SQL workflow nodes should inspect those settings before user-controlled values can reach them.
August 26 activity shows maintenance and rapid change
The repository was pushed on August 26, 2026, and v2.2.3 was released the same day with fixes for V2 forms, association fields, GigaChat startup, and WeCom behavior. GitHub showed 23,874 stars and 296 open issues and pull requests combined; a separate issue search returned 113 open issues. Recent issue and pull-request updates show active maintenance.
NocoBase has enough documentation and deployment options to justify a representative pilot, but upgrades deserve application-level checks. Build one real workflow, apply field permissions, test file access through the production proxy, back up the database, and rehearse rollback. The measured install failure makes the published CLI or container path the sensible first trial for most teams.