Firebase that runs in your browser

Pyric is Firestore, Auth, Realtime Database, Storage, and the Security Rules engine, implemented in TypeScript and running inside your app. In the browser, that means the page itself. The whole backend executes in the tab. In Node, it is the process your tests run in. Your code keeps its ordinary firebase/* imports. During development they resolve to Pyric. In production they resolve to Firebase. Nothing in your source changes.

That is the whole trick, and it starts with one command.

npm install -D @pyric/cli
npx pyric dev

No account. No cloud project. No emulator, no Java, no port to babysit. You have a local Firebase stack before your coffee is warm. Pyric records comparisons with production Firebase in its conformance reference, including documented divergences, unsupported APIs, and areas that have not been verified.

Build the app, prove the rules, ship the same code

You build your app with five service workflows: sign in and manage users, store and query data, sync realtime data, store files, and receive messages. Every local operation produces a Security Rules verdict you can inspect.

Then you ship. With the development resolver inactive, the same canonical imports load real Firebase. Before anything goes live, replay a captured session against the candidate Security Rules and learn which operations would change verdict. Pyric produces those local artifacts; firebase-tools or the Firebase Console deploys them.

Your agent works the same backend

The backend is local state with a tool surface, so a coding agent can work on it the way you do. Point Claude Code, Cursor, or any MCP client at the sandbox and the agent can seed data, run queries, simulate a rules verdict before writing, and check its own work. Nothing it does leaves your machine. Everything it does is inspectable, live, in the same event stream you watch.

It focuses on the hard parts

Firebase development has hard parts, and they are not the parts the manuals dwell on. Rules that pass locally and fail in production. A denial with no explanation. Query shapes that quietly demand indexes. Limits that are real but written down nowhere.

Pyric was built by working those parts until they gave, and what was learned is in the product. The rules linter carries the exact limits of the production compiler. The standard library ships rule modules verified against the real engine, including rate limiting and cross-document checks that most rulesets never attempt. The event stream exists because a bare permission-denied is not an answer. None of this asks for your trust. Run it, break a rule on purpose, and read the verdict.

Where to go next

Start with the quickstart. If you came here for rules, go straight to prove your rules protect the app.