Why config-driven UI breaks in production

The UI contract you can audit, own, and run yourself.

Blueprint turns a screen into an open JSON contract — no logic, no eval, no lock-in. Describe the UI, validate it in CI, compile it to real components, and ship it on your own infrastructure.

Get early access See how it works

Open-source runtime · self-hosted · CSP-clean · no data egress

kyc.contract.jsonvalidated

{
  "version": "1.0",
  "root": {
    "type": "form", "id": "kyc",
    "fields": [
      { "type": "input",  "label": "Legal name" },
      { "type": "select", "label": "Country",
        "visibleWhen": { "field": "kind", "eq": "business" } },
      { "type": "button", "label": "Verify identity" }
    ]
  }
}

Identity check

Compiled from the contract — real components, no eval.

Legal name

Ada Lovelace

Country

United Kingdom

Built for regulated teams

FintechInsuranceHealthcarePublic sector

The problem

You didn't write config. You invented a programming language.

Every low-code builder starts as simple config. Then it grows conditions, then bindings, then expressions — until your UI is running an interpreter over untyped JSON, with no debugger and no tests.

✕Logic in config — bindings become eval, rejected by strict CSP and broken on deploy.
✕Unsearchable, untestable — logic buried in a tool you can't grep, refactor, or review.
✕Changes without a deploy — a server can mutate your screen — a live audit liability on a payment page.

the-other-guys.json

{
  "button": {
    "onClick": "eval(fetchUser(row.id) && 
               ctx.state.open = true)",
    "visible": "{{ user.role == 'admin' }}"
  }
}

# A string that runs as code. Untyped, untestable, CSP-blocked — and shipped in your data.

The Blueprint difference

A thin contract that describes the screen — not the behavior.

The JSON has zero logic and zero eval. Real logic stays in typed, testable React. What you ship is a screen you can read, diff, and prove.

Auditable by design

Every screen is a versioned, diffable contract. "Prove this behaves correctly" becomes a code review — not "trust me." No interpreter hiding in your data.

Own it, run it yourself

The contract is open JSON you keep. The runtime is open source and self-hosted. Leave anytime — the artifact is yours and runs without us.

Never hit a wall

Anything the catalog doesn't cover, you drop in as real, typed React. The escape hatch means the abstraction never corners you.

How it works

Four steps. No black box.

01 · DESCRIBE

Compose from a closed catalog

Build the screen from a fixed set of atoms. The output is portable JSON — no code generation, no proprietary format.

02 · VALIDATE

Schema-check it in CI

Invalid UI fails the build, not production. The contract is validated against a schema; logic lives in typed React, never in the JSON.

03 · COMPILE

Map to real components

A thin runtime renders the contract with your design system — Tailwind or MUI. No eval, CSP-clean.

04 · SHIP

On your own infrastructure

Deploy self-hosted. No data leaves your perimeter. The same contract renders anywhere it's mounted.

The reality check

We didn't invent the positioning. We inverted the pain.

Teams that adopted config-driven builders documented the same failure modes across every vendor. Each one maps, one-to-one, onto a Blueprint design decision.

Config grows rules, then a DSL — until you're hand-coding everything, just in a worse language.

— The Configuration Complexity Clock, 2012

On a payment page, a script that can change without your deploy must be inventoried and tamper-monitored.

— PCI DSS 4.0 · §6.4.3 / §11.6.1

The recurring verdict on visual builders: they make hard things easy and easy things impossible.

— documented across Retool, Builder.io, Plasmic

Read the full reality check — with sources

Regulated by default

The compliance story is the architecture.

PCI-clean payment UI

No eval, no runtime-injected scripts. A compiled, inventoried screen your scanner can verify — not one that mutates behind your back.

Data residency, solved

Self-hosted end to end. The contract compiles and renders inside your perimeter — no proxy, no egress, no BAA on the UI layer.

Change control = a diff

Every screen is versioned JSON. Approvals, reviews, and audit trails are just Git — evidence you already produce.

See the regulated-teams brief

Early access

Own your UI. Literally.

Get early access to the Builder and the runtime. Be first when Blueprint ships — and help shape it.