Kitto^x - A framework for creating data-driven web applications with Delphi and HTMX

Latest Version 4.0.7 - 08 May 2026

Kitto^x allows to create Rich Internet Applications based on a data model that can be mapped onto any database. The client-side part uses HTMX (through webbroker technology) to create a fully AJAX application, allowing you to build standard and advanced data-manipulating forms in a fraction of the time.

Kitto^x is aimed at Delphi developers that need to create web or mobile applications without delving into the intricacies of HTML, CSS or Javascript, yet it allows access to the bare metal if required.

Kitto^x includes a database-agnostic data-access layer, allowing to create applications that work on any database engine and port applications between database engines.

A Kitto^x application is described as a set of easily maintained YAML files, keeping definitions abstract and declarative and allowing for future extensions. Business rules are enforced either declaratively or through small javascript fragments on the client, or in Delphi code on the server.

---

Full documentation

• Documentation site with 50+ pages
• Pages for all controllers, filters, data concepts, how-to guides, FAQ
• Three example applications: HelloKitto, TasKitto, KEmployee

---

Enterprise Edition

Beyond the Apache 2.0 Core, Kitto^x ships with Enterprise modules and developer tools under commercial license:

• Enterprise components — interactive Charts (Chart.js), Calendars (EventCalendar), Google Maps with geocoding and markers, Dashboards and FlexPanels — all driven by YAML metadata, no client-side coding required.

• KIDE^x — the visual IDE for designing Kitto^x applications. Tree-based YAML editor with RTTI-based property discovery, database reverse engineering (FireDAC / DBExpress / ADO), a New Project Wizard that scaffolds complete apps for up to 4 deployment modes (Standalone .exe / Desktop .exe / ISAPI .dll / Apache .dll), and an integrated HTTP server for live preview. Ships with a RAD Studio design-time package (KittoXIDE.bpl) that integrates the same wizard under File > New > Other > KittoX Projects and adds a YAML syntax highlighter to the IDE editor.

• MCP-KittoX — standalone Model Context Protocol server (MCPKittoX.exe) that exposes KIDE^x functionality to AI agents (Claude Desktop / Code, Codex, LM Studio, any MCP-compatible client). Agents can scaffold complete Kitto^x apps and reverse-engineer Models from a live database conversationally; metadata validation, locale refresh and view scaffolding tools are on the next-phases roadmap. Bundled with KIDE^x: a single OnGuard registration unlocks both.

Contact Ethea for commercial license details, or see the Enterprise Edition page on the documentation site.

---

Licensing

Kitto^x uses an Open Core licensing model:

• Core (List, Form, Wizard, FlexPanel, routing, database, auth): Apache 2.0 — free for any use, commercial or non-commercial.

• Enterprise Modules (Chart, Calendar, GoogleMap, Dashboard): AGPL-3.0 for open-source applications, or Ethea Commercial License for closed-source applications. Please contact Ethea for detailed informations about commercial license.

• KIDEX (Visual IDE): commercial license only.

See the Licensing page and Enterprise Edition for full details.

Start here for further information.

Visit this site for online demos.

---

Release Notes

08 May 2026: ver. 4.0.7 Beta

• Controller/AutoOpen and Controller/PagingTools based on model's IsLarge flag
• A Reference field whose target Model has IsLarge: True renders as a searchable lookup popup

JWT / ACL hardening

• Auth: JWT no longer emits the legacy <AppName> session-id cookie nor kx_db — the JWT sid and db claims carry the same info
• Server-side ACL enforcement on every HandleKX* route (view/data/save/delete/form/lookup/blob/upload/tool/detail*/wizard)
• New auth gate in DoHandleRequest returns 404 on protected routes for unauthenticated requests (public views excluded)
• Toolbar Add/Edit/Delete/Dup stay disabled for ACL-denied users
• Per-thread JWT context cache uses TObjectDictionary<TThreadID, ...>

IDE / wizard

• New RAD Studio IDE plugin gallery: KittoXIDE.bpl registers 4 entries under File > New > Other > KittoX Projects (Standalone .exe / Desktop .exe / ISAPI .dll / Apache .dll)
• Three paths to scaffold a new app: KIDEX standalone, the new IDE gallery, and MCP-KittoX project_create_app
• New project default: Auth: TextFile with a ready-to-use Home/FileAuthenticator.txt (admin/admin demo accounts) so the generated app authenticates out of the box, no users table required. JWT envelope kept as default. AccessControl default switched to Null to avoid deny-all post-login on a brand-new project. DB.FD.yaml template now sets ODBCAdvanced: TrustServerCertificate=yes so SQL Server ODBC Driver 17/18 connects on first try
• Model Wizard Beautify names option now also handles DB names with spaces (Northwind-style: Quarterly Orders → QuarterlyOrders, Sales by Category → SalesByCategory); the original name is preserved in PhysicalName for the SQL layer

MCP-KittoX

• New tool models_create_from_db — the headless equivalent of the Model Wizard. AI agents (Claude Desktop, Claude Code, Codex, …) can reverse-engineer Models from a database connection conversationally: defaults to dry_run: true (preview only); pass dry_run: false to commit. Output is byte-identical to what the visual wizard writes
• 9 tools now implemented (was 8)
• Better error reporting from MCP tools: errors are now propagated verbatim to the JSON-RPC client (class name + message) instead of being replaced by a generic fallback

Setup / tooling

• Setup installer ships MCPKittoX.exe alongside KIDEX.exe sharing OnGuard license
• Tools/SetVersion.ps1 now also bumps the 12 dprojs of the 3 official examples (HelloKitto, TasKitto, KEmployee — 4 deployment variants each), and inserts <VerInfo_Release> and other VerInfo tags when the .dproj has them stripped (Delphi removes VerInfo tags whose value is 0)

01 May 2026: ver. 4.0.6 Beta

• New Auth: JWT wrapper authenticator (signed kx_token cookie, sliding expiration, programmatic key registration)
• New AccessControl: JWT reading grants from kx_acl claim snapshotted at login, with optional DB fallback
• Updated examples to JWT Auth (TasKitto / HelloKitto / KEmployee)
• Updated TasKitto example with three-tier ACL (admin / user / viewer)
• Multi-database support on TasKitto and HelloKitto: SQL Server / PostgreSQL / Firebird
• Cross-dialect macros: %DB.TRUE% / %DB.FALSE%, %DB.DATEDIFF, %DB.DATETIME_FROM
• Login form with optional "Environment" combo for multi-database apps (Auth/DatabaseChoices)
• Native boolean types on the three sample DBs (BIT / BOOLEAN); Firebird setup is now SQL-script-only
• Firebird Activity Dashboard views translated from the SQL Server originals
• TasKitto SQL Server DDL split (tables / views in separate scripts because of T-SQL batch rules)
• New Tools/SetVersion.ps1: one-shot version bump across constant, dproj, README and Inno Setup
• New Projects/BuildAllPackagesD{10_4,11,12,13}.ps1 wrappers: rebuild Core + Enterprise per Delphi version
• YAML metadata files included in every .dproj (visible in Project Manager, KIDEX highlighting)
• EF.Logger.TextFile active out-of-the-box for the standalone Indy hosts

23 Apr 2026: ver. 4.0.5 Beta

Architectural refactor: DB connection ownership unified in TKConfig

• New public API TKConfig.DatabaseFor(Name)
• CreateDBConnection moved from public to protected
• New public API TKConfig.CreateStandaloneDBConnection(Name)
• ClearDatabase and DestroyInstance now clear both** FDatabase and FDatabases
• InDBConnection / InDBTransaction helpers

22 Apr 2026: ver. 4.0.4 Beta

• Manual column resize in grids
• Tooltip on truncated grid cells (only when actually truncated)
• Fix: in-memory lookup popup closing on resize
• Tooltip on TreePanel menu nodes
• Multi-column sort in grids
• Multi-page form validation
• Edit-mode accent border for combobox and other non-text-editable fields
• SunEditor readonly rendering
• Checkbox styled like other form inputs
• DetailTables Style (Tabs/Bottom/Popup)
• Added CSS .disabled class

23 Apr 2026: ver. 4.0.3 Beta

• Editing-mode field borders
• Form toolbar anchoring
• DateTime field fixes
• Fixed KittoEmailSenderSrvc
• Grid keyboard navigation
• SunEditor theming and resize
• Dialog focus
• DetailTables Style (Tabs/Bottom/Popup)
• ExportExcel / ExportFlexCel
• Fixed Date/time filters SQL conversion
• Date/time filter trigger
• Error dialog consistency
• Controller: Window restored backward-compatibility

19 Apr 2026: ver. 4.0.2 Beta

• Simplified Apache/IIS deployment: static resources served internally, no RewriteRule needed
• New deployment mode: Windows Service + reverse proxy (nginx/Apache/IIS) with install/uninstall scripts
• Fixed ViewMode to EditMode save bug in master-detail forms
• Implemented Apply*Rules event chain (EditRecord, NewRecord, Duplicate, AfterShowEditWindow)
• Master-detail: "Confirm" button (save-cache) and "Save All" only visible in ViewMode
• HTTP error feedback (htmx:responseError) with Retry/Reset dialog
• Updated Italian localization (.po/.mo) with all KittoX strings
• Extensive documentation updates (deploy, proxy, localization, form state machine, routing)
• Added DDL and DML script for Example databases

09 Apr 2026: ver. 4.0.1 Beta

• Fixed Field Rules client-side (ForceUpperCase, ForceCamelCaps, MinValue/MaxValue)
• Fixed PackageGroup
• Fixed modal lookup for Reference fields
• Fixed Example for Apache modules

07 Apr 2026: ver. 4.0.0 Beta (first public release)

First public release of Kitto^x, the fourth generation of the Kitto framework. Complete rewrite of the client-side from ExtJS to HTMX + AlpineJS + TemplatePro, with a new modular server architecture.

Architecture

• HTMX + AlpineJS client: server-generated HTML fragments with partial page updates via AJAX. No heavy JavaScript framework.
• Attribute-Based Routing (RTTI): URL routing via Delphi custom attributes, inspired by MARS/WiRL. Resource classes register in initialization sections; the framework discovers them via RTTI. Dependency injection for request context ([TKXContext]). Dynamic JS/CSS injection via TKXScriptRegistry.
• Open Core licensing: Core (Apache 2.0), Enterprise modules (AGPL-3.0 / Commercial), KIDEX (Commercial only). Separate packages: KittoXCore.dpk and KittoXEnterprise.dpk.
• Server-Side Store: persistent in-session data stores with record state tracking (rsNew, rsClean, rsDirty, rsDeleted), transactional master-detail saving (INSERT/UPDATE/DELETE in a single DB transaction), blob lazy-loading, and store lifecycle management (save/cancel/close/timeout).

Controllers

• List (grid with CRUD toolbar, server-side paging, sorting, column layouts, row colors, grouping)
• GroupingList (collapsible group headers)
• Form (data-aware editing with field pages, detail tabs, ViewMode/EditMode state machine)
• Wizard (multi-step data-aware with Back/Next/Finish, per-step validation)
• BorderPanel, TabPanel, FlexPanel, TreePanel, TilePanel, HtmlPanel, StatusBar, ToolBar
• Enterprise: ChartPanel (Chart.js), CalendarPanel (EventCalendar), GoogleMap (Google Maps JS API), Dashboard (auto-refresh)
• Card View: List controller with TemplateFileName for custom HTML card layouts with full CRUD
• Desktop Embedded Mode: KittoX app inside a WebView2 (TEdgeBrowser) VCL window

Data & Database

• Database agnostic: pluggable via FireDAC (preferred), DBExpress, ADO
• Master-detail transactional save: master + all detail stores persisted in one transaction
• Detail CRUD in memory: add/edit/delete detail records without DB round-trips until final Save All
• Record state after Load: records loaded from DB correctly marked as rsClean
• Server-Side Store cache: blob lazy-load from session store, store released on save/cancel/close/timeout

Forms & Editing

• Form State Machine: ViewMode (Edit / Save All / Close) and EditMode (Save / Cancel) with CSS-based button toggling
• Save-cache endpoint: saves master to memory without DB persistence, enables Save All workflow
• Detail tables: lazy-loaded tabs, auto-built views, FK pre-fill on Add, transactional cascading save
• Unified Editor Factory (Kitto.Html.Editors): centralized HTML input generation shared between Form and FilterPanel
• Help button: configurable via Defaults/Help/HRef in Config.yaml, appears in forms (first button) and list toolbar (after Refresh)

Mobile Support

• Automatic mobile detection: user agent + screen size cookie
• Fullscreen dialogs on mobile: IsModal + Maximized forced for all fragment views/forms via AdjustControllerForContext
• Panel properties: IsModal (dialog overlay), Maximized (fullscreen viewport), AllowClose (X button and Close button)
• Width/Height getters: return 0 when Maximized is True (original values preserved for restore)
• kxApp.openView: single JS function for view opening from menus (TreePanel and TilePanel use identical logic)
• body.kx-mobile CSS class: forces dialog and login fullscreen on mobile devices
• TilePanel: tile-based menu controller for mobile home pages, with touch support (role="button", touch-action: manipulation)
• Home view selection: HomeTinyView (phone), HomeSmallView (tablet), HomeView (desktop)

UI & UX

• Toast notifications: shown after save ("Data saved") and delete ("Data deleted"), auto-dismiss 3 seconds
• Error handling: DB errors (EEFDBError) non-fatal with clean messages (driver prefixes stripped). Session-level errors trigger reload.
• Draggable dialogs: all message boxes and error dialogs draggable by title bar via kxMakeDraggable
• Refresh button: in CRUD toolbar (visible by default, hidden with PreventRefreshing or on read-only controllers)
• Column sorting: click to sort ascending, click again for descending, sort arrows via CSS pseudo-elements
• Double-click to open: automatic edit/view form from grid rows
• Session lost detection: fatal error dialog with reload on server restart
• Timeout handling: configurable AjaxTimeout for both HTMX and fetch channels, Retry/Reset dialog

Filters

• Filter Panel with: FreeSearch, List, DynaList, ButtonList, DynaButtonList
• DateSearch, TimeSearch, DateTimeSearch, NumericSearch, BooleanSearch
• Layout with ColumnBreak and LabelWidth

Custom Layouts

• Custom Layout for Grid and Form
• Grid Layout with Column position, alignment
• Form Layout "multipage", with collapsible regions

Authentication & Access Control

• Pluggable authenticators: DB, DBCrypt, TextFile, DBServer, OSDB, Null
• Pluggable access controllers: DB, Null
• BCrypt password hashing, Google OTP (TOTP) two-factor authentication, QR code generation
• Session abstraction: IKXSessionProvider with TKXCookieSessionProvider (JWT-ready for future)

Tools

• CSV export (ExportCSVTool), Excel export via ADO (ExportExcelTool), SQL tool, file download/upload
• FlexCel integration (commercial, Enterprise edition)
• ReportBuilder integration (commercial, Enterprise edition)
• DebenuQuickPDF for PDF merging

Deployment

• Standalone (VCL desktop or Windows service with embedded Indy HTTP server)
• Desktop Embedded (WebView2 inside VCL window)
• Console (headless server)
• IIS (ISAPI DLL via WebBroker)
• Apache (module via WebBroker)

KIDEX (Visual IDE — Enterprise)

• RTTI-based property discovery (replaced 215 MetadataTemplate YAML files)
• 6 custom YAML attributes: YamlNode, YamlRequiredNode, YamlContainer, YamlSubNode, YamlChildType, YamlEnumValue
• SVG icon support (Material Design Icons)
• Database reverse engineering (model creation from DB schema)
• Project wizard, validators, tree editors

Examples

• HelloKitto: simple party/invitation manager (Parties, Girls, Dolls, Invitations)
• TasKitto: activity tracking with dashboard, charts, calendar, projects, customers
• KEmployee: employee/customer management with master-detail, card views

Supported Delphi Versions

Available from Delphi 10.4 to Latest (Win32 or Win64 platforms).

Related links: www.embarcadero.com - https://learndelphi.org