> For the complete documentation index, see [llms.txt](https://docs.buzzy.buzz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.buzzy.buzz/developing-and-extending-buzzy/developing-and-extending-buzzy.md).

# Overview

Use this page when your app needs more than standard screens, fields, and actions. Buzzy can be extended and governed through code widgets, functions, constants, REST APIs, MCP, Tests, Security Review, toolkits, cookbooks, and widgets.

## Choose the Right Extension Point

| Need                                                                          | Use                                                                                  |
| ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Custom UI, charts, maps, advanced filters, file managers, or embedded tools   | [Code widget](/the-building-blocks/code-widget-custom-code.md)                       |
| Server-side logic, external APIs, webhooks, AI calls, or sensitive processing | [Buzzy Functions & Constants](/the-building-blocks/buzzy-functions-and-constants.md) |
| External systems reading or updating Buzzy app data                           | [Buzzy REST API](/developing-and-extending-buzzy/buzzy-rest-api.md)                  |
| AI assistants interacting with an existing app as tools                       | [Buzzy Custom MCP](/the-building-blocks/mcp/buzzy-custom-mcp.md)                     |
| An AI agent building, adapting, or testing the app itself                     | [Buzzy Builder MCP](/the-building-blocks/mcp/buzzy-builder-mcp.md)                   |
| Repeatable workflow checks and regression confidence                          | [Tests](/the-building-blocks/release-tests.md)                                       |
| Permission, Private Data, and sensitive-data review before release            | [Security Review](/the-building-blocks/security-review.md)                           |
| Shared UI layouts, app patterns, widgets, and reusable AI build guidance      | [Toolkits, Cookbooks & Widgets](/the-building-blocks/toolkits-and-cookbooks.md)      |
| Future in-app agent workflows                                                 | [Buzzy Agents](/developing-and-extending-buzzy/buzzy-agents-coming-soon.md)          |

For a side-by-side comparison of code widgets, Async API, REST API, Node.js client, Buzzy Functions, and Custom MCP, see [API and Extension Surfaces](/developing-and-extending-buzzy/api-and-extension-surfaces.md).

## Recommended Build Order

1. Model the core app first: brief, flows, data, screens, and permissions.
2. Use approved toolkits and cookbooks where they exist so the app follows shared layout, workflow, and governance patterns.
3. Add code widgets only where standard Buzzy components are not enough.
4. Move secrets and reusable configuration into constants.
5. Put external calls and privileged logic in Buzzy Functions.
6. Use REST API or Custom MCP only after the app's access rules are clear.
7. Run Security Review for apps with sensitive data, role-based access, APIs, MCP exposure, or external integrations.
8. Create Tests for the critical paths you need to trust before publishing or promoting the app.

## Agent-Assisted Development

Agents such as Codex or Claude Code are useful for planning, writing code-widget internals, drafting Buzzy Functions, and running Playwright or browser-based checks. For app-building work, connect them through [Buzzy Builder MCP](/the-building-blocks/mcp/buzzy-builder-mcp.md) so they work with Buzzy artifacts rather than guessing from screenshots or prompts alone.

For code widgets and functions, ask the agent to keep the runtime contract explicit:

* which table, screen, row, or action invokes it
* which fields or constants it depends on
* which errors users should see
* how it should be tested

## Governed Extension Workflows

New extension work should be reviewed in the same context as the app definition:

* **Brief**: confirm the app intent, roles, data, external functions, and security posture are still accurate.
* **Toolkits and cookbooks**: use approved shared patterns before inventing app-specific structure.
* **Security Review**: check Private Data, datatable permissions, field-level access, and external exposure.
* **Tests**: capture repeatable checks for the workflows most likely to break or create risk.

## Coming Soon

Buzzy Agents are coming soon. Until dedicated docs are available, use [Buzzy Agents](/developing-and-extending-buzzy/buzzy-agents-coming-soon.md) as the placeholder page and use Builder MCP for agent-assisted app building and Buzzy Functions for app-side automation.

## Example Paths

* For complete apps and templates, see [Examples by Use Case](/the-building-blocks/examples.md).
* For custom UI, start with [Code Widget Examples](/the-building-blocks/code-widget-custom-code/examples.md).
* For choosing between APIs and extension points, start with [API and Extension Surfaces](/developing-and-extending-buzzy/api-and-extension-surfaces.md).
* For server-side integrations, start with [Buzzy Functions & Constants examples](/the-building-blocks/buzzy-functions-and-constants/examples.md).
* For external systems, start with [Common API Examples](/developing-and-extending-buzzy/buzzy-rest-api/rest-api/common-api-examples.md).
* For release confidence, start with [Tests](/the-building-blocks/release-tests.md).
* For sensitive apps, start with [Security Review](/the-building-blocks/security-review.md).