Pre-launch. Not deployable to production. This page states what the tests prove and what is missing — nothing else.

Should you build a CRM from scratch, or start from a framework?

Building a CRM yourself

People ask this as: build a custom crm from scratch vs using a crm framework

The comparison with no competitor in it: your own empty repository against this framework. What you get is CRM machinery — module manifests that generate their own migrations, deterministic workflows, a human-approval boundary, audit and trace. What you still write is most of what a business calls a CRM: authentication, tenancy, import, export, search, email, and the database it should have been on. This is a framework, not an application, so the honest form of this page is a subtraction rather than a pitch.

Where this stops

Read this before the rest of the page. Every line below is a thing this does not do.

Every fact about another project on this page is single-sourced to docs/strategy/COMPETITOR_MAP.md and dated 2026-08-04. Nothing from another project was installed, configured or run, and there is no network access here to re-verify any of it.

  • This is a framework, not an application you sign up for. There is no hosted CRM, no free tier and no account (L-07).
  • Ownership today means copying source, not installing a dependency: the project bootstrap scaffolds from a checkout, the reserved `npm create` name still installs nothing, and upgrading means merging rather than bumping (L-08).
  • No authentication, tenancy or RBAC. An actor header is an assertion, not an identity, and this must not be exposed to a network (L-01).
  • SQLite only. PostgreSQL is on a track, not in the code (L-02).
  • No import, export, dedupe, merge, bulk edit, saved views or global search — table stakes in every commercial CRM, recorded here rather than left for you to discover (L-06).
  • No scheduler, task engine, queue or reminders: one follow-up Task is created inside lead qualification, and nothing recurring or delayed fires anywhere (L-04).
  • No email, calendar or marketing integration. A notification provider contract exists; no adapter sends anything to anyone (L-05).
  • No claim about how quickly an agent finishes a CRM with this, because the benchmark has not been run (L-03).
  • Real customer data does not go in yet: no export and no erasure path, so a subject access or deletion request cannot be serviced (L-09).

No authentication, tenancy or RBAC. The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network. Every claim and every limitation is on one page.

Where building from scratch wins

Total control is the real advantage, not a slogan: nothing in your schema is shaped by someone else's idea of what a Company is, and no upgrade ever asks you to reconcile your domain with a framework's opinion of it. That advantage is larger here than usual, because ownership in this project currently means copying source rather than installing a dependency — there is a project bootstrap that runs from a checkout of the repository and no published package: the repository's bootstrap command scaffolds a project that boots, inspects and passes the project doctor, while the reserved `npm create` name still reaches an empty placeholder and installs nothing, so upgrading means merging, not bumping (L-08). If the end state was going to be a fork you maintain, starting from your own repository means every convention in it is one you chose.

The second win is everything this framework does not have. There is no authentication, tenancy or RBAC, and an actor header is an assertion rather than an identity (L-01). Persistence is Node's built-in SQLite; PostgreSQL is not implemented (L-02). Import, export, dedupe, merge, bulk edit, saved views and global search do not exist, and none of them has a milestone (L-06). No email, calendar or marketing adapter sends anything to anyone (L-05). Nothing is scheduled, delayed or recurring, because there is no scheduler and no queue (L-04). If those are the hard parts of what you are building — and for plenty of CRMs they are the entire thing — starting here has not reduced your work; you write them once on either path.

The third win is the first week. A form, a table and a list against a database you already run is a day of work, with no manifest, no policy version and no migration convention standing between you and a working screen. This framework starts paying on the second commercial rule, not on the first screen, and if there is never a second commercial rule it does not start paying at all.

Where this is different

What you stop writing is the machinery around the record rather than the record itself. A module manifest becomes a migration, a service, a REST resource, an SDK method and Admin screens with no page code (C-01), and generated modules then evolve through explicit revisions, a checked-in state file and append-only named migrations, so history is added to rather than rewritten (C-19). The fifth object costs roughly what the first one did, which is the opposite of how a hand-rolled CRM ages.

The parts a bespoke CRM reaches last are here first. Commercial policy is deterministic code rather than a model's judgement: a renewal at or above the threshold stops and waits for a named human (C-03), and a test asserts that an agent cannot make that decision on the human's behalf, so the boundary is a property of the system rather than a promise in a README (C-04). Every mutation goes through a module service or a named workflow and leaves an audit event and a step-level trace behind it (C-16). None of that is hard to write once. It is hard to write consistently, in every path, under deadline — which is the failure mode the from-scratch CRM actually has, and it shows up as archaeology eighteen months later when someone asks who approved a discount and under which rule.

The dependency surface is deliberately close to nothing: Node 22 and a checkout, no build step, no bundler, no framework underneath your framework (C-17). And one command composes the starter's whole application from manifests, drives it end to end, and then prints the things its own inspector says it cannot see (C-22). That last part is the tell — the machinery is built to be interrogated by a coding agent and reviewed by a human, which is a different design goal from the one a hand-rolled CRM is usually optimising for.

How to choose

Build it yourself if the CRM is a form, a list and a few statuses; if the hard part is authentication, tenancy or billing; if you need PostgreSQL on day one; if import, export and search are the feature list rather than an afterthought; or if real customer data goes in immediately, because it cannot go in here yet (L-09).

Start from this framework if the process is the product — stages, approvals, discount policy, obligations, handovers — and someone will ask in six months why a number was what it was. It fits when a coding agent is doing most of the typing and you want the output as reviewable source with conventions the agent can read back, and when you would otherwise be deriving approvals, audit and trace by hand for the third time. You keep the repository either way; the question is only whether the first thousand lines in it are yours or the framework's.

What this comparison does not cover

No time or cost estimate, and no build-rate figure. The agent build benchmark is designed and published but has not been run, so no Successful Agent Build Rate exists and any number quoted for this project is not ours (L-03). Nothing on this page says an agent finishes faster here, because that has not been measured.

No comparison to any specific starter, template or boilerplate. This page compares against the empty repository, not against a named project — the dated competitor research the rest of this cluster reads carries facts about other software, and this entry needs none of them, so it uses none.

Nothing about production posture or hosting. There is no hosted CRM, no free tier and no account; the output is an application in your repository that you run (L-07). The comparison assumes you are the one deploying it, and says nothing about how.

The evidence this page rests on

Claims and limitations are printed from site/claims.json word for word. Job statuses come from docs/benchmarks/jobs.json; a job with no page of its own is listed with its status rather than linked.

Claims

  • C-01 Write a module manifest; the agent turns it into a migration, a service, a REST resource, an SDK method and Admin screens — with no page code.

    LimitGenerated CRUD only. The factory does not generate workflows or approvals for a custom object — that is still handwritten (JTBD-06, partially supported).

  • C-03 Commercial policy is deterministic code, not a model's judgement: a renewal at or above the threshold stops and waits for a named human.

    LimitProven for the built-in renewal object and its single value threshold. A general policy engine over arbitrary custom objects does not exist.

  • C-04 The agent cannot approve on the human's behalf. A test asserts the refusal, so the boundary is a property of the system rather than a promise in a README.

    LimitThe actor is asserted, not authenticated: there is no auth, tenancy or RBAC, and an actor header is not identity. This holds a boundary against an honest agent, not against an attacker with network access.

  • C-16 Every mutation goes through a module service or a named workflow, and leaves an audit event and a step-level trace behind it.

    LimitAudit records what the process did under an asserted actor. It is not a tamper-evident or externally attestable log, and it is not a compliance control.

  • C-17 Zero third-party runtime dependencies. Node 22 and a checkout — no build step, no bundler, no framework underneath your framework.

    LimitDevelopment dependencies and the eventual PostgreSQL adapter are separate questions. Having no runtime dependencies is a property of the framework, not of whatever you add on top of it.

  • C-19 Generated modules evolve without rewriting history: explicit revisions, a checked-in state file and append-only named migrations.

    LimitThe view is source-only: what the checked-in revisions and migrations say is knowable; what a particular database has actually applied is not.

  • C-22 One command composes the whole thing and then inspects it: 70 modules, 6 packages, 41 resources, 56 actions, 7 policies and 5 providers, applied from manifests and driven end to end — then it prints the eleven things the inspector says it cannot see.

    LimitIt composes the starter's application, not yours, and it runs entirely locally against SQLite with no authentication. The counts describe what that starter applies; a different composition gives different numbers. Wall-clock time varies by machine and is deliberately not claimed.

Limitations

  • L-01 No authentication, tenancy or RBAC. The server is local-development-only. An actor header is an assertion, not an identity. Do not expose it to a network.
  • L-02 SQLite only. Persistence is Node's built-in SQLite adapter. PostgreSQL is on the Production Spine track and is not implemented.
  • L-03 The build benchmark has not been run. The protocol is designed and published; no Successful Agent Build Rate exists yet. Any number you see quoted for this project is not ours.
  • L-04 No scheduler, no task engine, no reminders. One follow-up Task is created inside lead qualification. There is no recurring work, no delayed workflow, no queue — so nothing fires on a renewal notice period either.
  • L-05 No email, calendar or marketing integrations. An in-memory notification provider contract exists. No adapter sends anything to anyone.
  • L-06 No import, export, dedupe, merge, bulk edit, saved views or global search. Table stakes in every commercial CRM, and none of them has a milestone yet. This is recorded deliberately rather than left for you to discover.
  • L-07 This is a framework, not a product you sign up for. There is no hosted CRM, no free tier and no account. The output is an application in your repository that you run.
  • L-08 Ownership today means copying source, not installing a dependency. There is a project bootstrap and there is no published package, and the two are different facts. The repository's bootstrap command scaffolds a project that boots, reports `valid` from `app inspect` and exits 0 from `project doctor`, offline and with no install — run from a checkout of this repository. The package published under the reserved npm name is still an empty 0.0.1 placeholder, so the `npm create` route installs nothing until a human publishes it. Either way the framework is vendored into the project rather than depended on by version: you own the result outright, and upgrading means merging, not bumping.
  • L-09 You cannot put real customer data in this yet. A CRM is a personal-data system by definition, and this one has no authentication, no tenancy, no export and no erasure path — so there is no way to service a data-subject access or deletion request with it. Data governance is designed and unimplemented. The one thing that does hold today: lead scoring is deterministic, versioned and explainable, not a model's judgement about a person.

Jobs it covers