ARCHITECTURE
A thin client in front of one engine.
Nucleora is a hosted application. The interface you work in, in a browser at
app.nucleora.org or in the desktop app, draws the screen and does no
computation. Each calculation travels over HTTPS to api.nucleora.org, a
Cloudflare Worker that checks who you are, and from there to the 1,609-route Flask
application and its 422-module Python design engine on Google Cloud Run. Every figure on
this page was measured from the repository, and the command that measured it is printed
beside it.
DATA FLOW
Four layers, two network hops.
Layer 1 is on your device and holds nothing worth taking. Layers 2 to 4 are Nucleora's servers. Your sequences cross the network twice per calculation, once to the gateway and once to the engine, both over HTTPS. The dashed path leaves Nucleora's servers for a named public database, and only the features that are lookups take it.
MEASUREMENTS
Every number, and how to re-measure it.
These counts grow as the application grows, so the command matters more
than the figure. Routes and blueprints come from Flask's own URL map after
import server; everything else is a file count in the repository.
| What | Where | Measured | Command |
|---|---|---|---|
| Flask routes | server.py | 1,609 | len(list(app.url_map.iter_rules())) after import server |
| — of which under /api/ | server.py | 1,605 | same, filtered on rule.startswith('/api/') |
| — distinct /api/ paths | server.py | 1,589 | unique rule strings under /api/ (_internal/qa/claims_register.py) |
| Flask blueprints | server.py + engine/api_*.py | 74 | len(app.blueprints) |
| server.py length | server.py | 4,097 lines | wc -l server.py |
| Engine modules | engine/ | 422 | ls engine/*.py | wc -l |
| — of which blueprints | engine/api_*.py | 73 | ls engine/api_*.py | wc -l |
| Front-end JS modules | static/ | 253 | ls static/*.js | wc -l |
| — of which workspace modules | static/ws_*.js | 141 | ls static/ws_*.js | wc -l |
| Workspace views | static/index.html | 38 | grep -o 'data-view="[a-z0-9_-]*"' static/index.html | sort -u | wc -l |
| Tool rail registrations | data/cad_tools_rail_inventory.json | 433 | railItemCount — of which distinctDestinations = 428; 5 keys are registered twice |
| Codon table files | data/codon_tables/ | 45 | ls data/codon_tables | wc -l — 39 species tables, 5 codon-pair files, 1 README |
| Reference + runtime data entries | data/ | 30 | ls data | wc -l |
| Declared Python dependencies | requirements.txt | 14 | grep -vE '^\s*#|^\s*$' requirements.txt | wc -l |
| Application version | VERSION | 0.11.0 | cat VERSION |
The repository README quotes lower figures for several of these rows because it was written at an earlier revision. The table above is the current measurement. Re-run the commands rather than trusting either text.
REQUEST TRACE
One mRNA design, end to end.
This is the real call chain for the main mRNA design route, read from
server.py and the engine modules it calls. Six steps inside one server process. The only network legs are the HTTPS hops that bring the request to it.
The browser posts the antigen sequence and the construct options as JSON over HTTPS to api.nucleora.org, which checks the session and forwards the request to the engine on Cloud Run.
Non-standard residues and internal stops are rejected with HTTP 400 and an error_kind of nonstandard_residue, before anything is assembled — rather than silently stripped.
Codon-optimizes the ORF against the selected organism's table from data/codon_tables/, then assembles 5′ UTR, Kozak, signal peptide, CDS, C-terminal tag, 3′ UTR, stop codons and poly(A) into one construct.
Folds the construct through the ViennaRNA library in the server build and returns the QC scorecard. When ViennaRNA is absent the panel reports it as unavailable instead of substituting another method.
Serializes the finished construct to FASTA and GenBank in the same response.
One response object carrying the sequence, the QC report and both export formats. The gateway returns it and the front end renders it.
BOUNDARY
What runs where.
Stating this precisely matters more than making it sound reassuring. Design runs on Nucleora's servers. Lookups are lookups, and they go to named public endpoints from those servers, not from your device.
Computed by the engine on Cloud Run
- Codon optimization and CAI against the 39 species tables in
data/codon_tables/ - mRNA and DNA construct assembly, annotation, plasmid and sequence maps
- Restriction analysis over Biopython's REBASE set
- Primer thermodynamics (in-house SantaLucia nearest-neighbour)
- RNA secondary structure through the ViennaRNA library in the server build
- IVT simulation, yield modelling, virtual gel, in-silico PCR
- FASTA, GenBank, GFF3 and SBOL export; the provenance citation registry
- Saved projects, stored by
storage.nucleora.orgin Cloudflare D1
Named endpoints, per action
eutils.ncbi.nlm.nih.gov— sequence and record retrievalrest.uniprot.org— protein records- Ensembl REST — genome and transcript lookup
files.rcsb.org— PDB structure filesalphafold.ebi.ac.uk— model lookup by UniProt accessionapi.esmatlas.com— Meta's ESMFold, the one route that sends a protein sequence to a third party
QUESTIONS — FAQ
Common questions.
In engine/, on Nucleora's servers: the Flask application and the engine run as one Python process on Google Cloud Run, behind the Cloudflare gateway at api.nucleora.org. Your browser or the desktop app only draws the results. The engine is 429 modules paired as <domain>.py (computation) and api_<domain>.py (Flask blueprint), and it imports without Flask — from engine import mrna, structure works in a plain Python session. Folding runs through the ViennaRNA library linked into that process, not a separate web service.
No. Every calculation runs on Nucleora's servers, so the application needs a connection to api.nucleora.org. The free calculators on the Tools pages are the exception: they run in your browser once the page has loaded.
Cloudflare and Google Cloud carry and compute every request, as Nucleora's infrastructure providers. Beyond them, a lookup sends the query you typed to the named public endpoint, from Nucleora's server. Protein structure is the one place a sequence can be sent to a third-party database: engine/enzyme_lab_structure.py tries the AlphaFold database first (a lookup by UniProt accession, so no sequence is uploaded), and only for sequences with no accession does it post to Meta's public ESMFold endpoint at api.esmatlas.com. Every result records which tier produced it — method: alphafold_db_lookup or method: esmfold_api. The LIMS export sends a payload only to an endpoint and key you configure yourself.
The server's GET /api/health returns an optional_dependencies block with a live availability flag for openpyxl, Biopython, matplotlib, ViennaRNA and primer3, plus a count of how many are missing. Panels that depend on a missing library say so rather than returning a number computed a different way.
No. engine/design_misc3_primers.py computes melting temperature, hairpin and heterodimer in-house with SantaLucia nearest-neighbour parameters and does not import primer3. primer3-py is declared in requirements.txt behind a platform marker that excludes it on arm64 with Python 3.10 or newer, so it is absent from this repository's environment; it remains available elsewhere as a labelled second opinion.
Seven engine/compliance_*.py computation modules (ls engine/compliance_*.py | wc -l) with three api_compliance_*.py blueprints over them, covering an audit-documentation store, a CAPA tracker, a deviation log, and a regulatory planner with IBC and CMC components. These are design and record-keeping aids. They are not a validated Part 11 system and this page makes no such claim; validation is the operator's responsibility.
TRY IT
Paste a sequence. See the checks fire.
This page's analyzer runs in your browser — no data leaves this page. It is a demonstration of the checks, not the application itself.
NEXT