Turn a product idea into a real, public, working app on a $0 stack, guided step by step by Claude Code. Built for the people who imagine products, not only the people who code them.
You can describe your product in a deck, a spec, or a Figma prototype. People nod. Then nothing happens, because nobody has used it.
A real URL is different. Your stakeholder opens it on their phone in the lift. A customer signs up and the sign-up is actually saved. Your team stops debating what it might feel like. You learn in an afternoon what a quarter of meetings wouldn't tell you.
The gap between the idea and that link used to be "find an engineer, find a budget." mvp-stack closes it. You describe what you want in your own words; Claude picks the technology, walks you through setup one step at a time, designs it so it doesn't look machine-made, makes it work on a phone, and puts it online. Hosting cost: $0.
| You are a... | You get |
|---|---|
| Product designer | Your design as a living product, not a click-through. Real forms, real data, real phone behaviour, on a link you can put in a portfolio or a user test |
| Product owner / manager | A working MVP to put in front of customers and stakeholders before asking for a team. Evidence instead of a roadmap slide |
| Technical / business analyst | A way to prove a requirement or workflow actually holds up, with real data flowing through it, instead of another diagram |
| Solution architect | A fast, honest proof of concept: the stack choice is explained, the limits and exit paths are stated, and nothing is locked in by accident |
| Engineer | The same thing, faster, with the hand-holding switched off. It notices and gets terse |
What you need: Claude Code, free accounts on the platforms it picks, and a willingness to paste a few commands into a terminal. You don't need to know what they mean beforehand. For every step that's yours, it tells you where to type it, what will happen (usually "a browser tab opens, click Authorize"), and what success looks like. One step at a time.
Building it for your employer? It raises the questions you'd rather hear now than in front of your director: whether real company data belongs on an outside service (it'll offer sample data instead), who should own the accounts, whether that API key from IT is yours to reuse, and whether your laptop will even let you install things. It flags, suggests the low-risk path, and respects your call.
You, in your own words:
"I want a waitlist page for my app idea, and a simple screen where I can see who signed up. I'd like to charge for it eventually. I've never deployed anything."
Claude, with mvp-stack loaded:
"You'll end up with a link you can send to anyone, and sign-ups that are really saved. Two quick questions: roughly where are your first users, and is a free account with no credit card a must?
Since you plan to charge later, I'd skip Vercel's free tier (it's for non-commercial projects only) and use Supabase for storing sign-ups (a Postgres database, with login built in) and Cloudflare to host the pages. Both are free for commercial use with no card. The one thing to know: Supabase pauses a project nobody visits for a week, so I'll add a small keep-alive.
First step is yours: open a new terminal tab and run
npx supabase login. A browser tab will open; click Authorize, then tell me when you're back."
Later, when you try to help by pasting a password into the chat, it stops you, explains why in one sentence, and gives you a safer one-line alternative. That part is condensed from the pressure tests this plugin is developed against.
In a Claude Code session:
/plugin marketplace add johnnycuongn/mvp-stack-plugin
/plugin install mvp-stack@mvp-stack
Then just talk to it. No special commands:
| Say this | And it will |
|---|---|
| "I have an idea for an app that lets dog walkers share availability. Help me get a first version online." | Ask at most three plain questions, recommend one setup (plus a runner-up), and tell you in product terms what it costs and the first limit you'd hit |
| "Here's my Figma export / my prototype folder. Make it real and put it online." | Read what you have first, keep your design, and add only the missing pieces: storage, login, hosting |
| "Make it look like a real product, and make sure it works on a phone." | Pull the Hallmark design skill, build every screen phone-first, and actually check it at phone widths |
| "What stack should I use? I want to charge for it." (architects, engineers) | The same, with the real terms, the free-tier caps, the lock-in, and the exit path |
| "Is this safe to share / make public?" | Audit the project for leaked passwords and keys before anyone else sees it |
Terminal install, updating, and requirements
claude plugin marketplace add johnnycuongn/mvp-stack-plugin
claude plugin install mvp-stack@mvp-stack --scope user # all your projectsUpdate: claude plugin marketplace update mvp-stack, then claude plugin update mvp-stack@mvp-stack.
Requirements: git, Node.js LTS, and Python 3.8+ (python3, or py -3 on Windows) for the
helper scripts, which use only the standard library. Developed and tested on macOS; the scripts are
written to run on Linux and Windows too (Turso's CLI needs WSL on Windows). If something breaks on
your OS, that's a bug: please open an issue.
Each step is explained as you go, in plain language with the real term alongside, so you can follow along now and search for help later.
1. Checks your machine. doctor.py reports which tools, platform CLIs, and MCP servers you
have, plus the exact install and login command for whatever's missing. It reads no credentials.
2. Picks one stack, honestly. Six vetted $0 options. You get a recommendation, not a menu, with the biggest tradeoff and what breaks first up front: Supabase pauses after a week idle; Vercel Hobby is non-commercial only; Firebase needs a credit card the moment you want Functions.
3. Connects MCP servers, scoped down. OAuth where offered. One project, read-only or a dev branch first. It knows which servers can spend your money (Vercel's can deploy to production and buy domains) and confirms before anything that does.
4. Places API keys without anyone seeing them. From the vendor's CLI through a pipe, from a hidden prompt in your own terminal, or generated on the spot. Never through the chat, never in shell history, never in a committed file.
5. Designs it, mobile-first and installable. Pulls the Hallmark design skill into your project so the UI doesn't look AI-generated. Every screen is built phone-first and then actually checked at 320, 375, 768, and 1280 px. "It's responsive" is a claim; a screenshot is evidence. In the same pass it becomes a Progressive Web App: visitors can add your link to their home screen and it opens full-screen like an app, with a designed offline page and a service worker that never caches private data or serves yesterday's build.
6. Deploys, then audits the project for leaked credentials before calling it done.
7. Hands it over in plain language: your public link, who can see it, what it costs today and the first thing that would change that, what's real versus placeholder, and how to change something tomorrow ("open this folder in Claude Code and say what you want different").
Putting something online means handling passwords and API keys, and the classic first-timer mistake is leaking one: into a chat, into a public code repository, into the page itself. Engineers learn this the hard way. You shouldn't have to. Think of a public key as the street address of your house and a secret key as the front-door key: one belongs on a business card, the other doesn't. mvp-stack knows which is which and handles them so you never have to:
- The agent never reads
.env*files, never runs a command whose output is a secret without piping it somewhere safe, and never asks you to paste a key into chat. - You run logins and type dashboard-only keys, at a hidden prompt, in your own terminal.
- MCP servers get one project, read-only first. Production deploys, deletes, and purchases are confirmed with you even when the token would allow them.
- If a secret leaks anyway, it says so plainly and has you rotate it. It doesn't quietly carry on.
For the technically curious: two things most guides get wrong
.claudeignore does nothing. Plenty of tutorials tell you to create one. Claude Code doesn't
read it. The supported control is a deny rule in .claude/settings.json, which this plugin sets up:
{ "permissions": { "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./.dev.vars)", "Read(./**/*.pem)"] } }Innocent-looking commands print passwords. neon projects create includes the full connection
string in its output by default. An agent that runs it has just put your database password in the
transcript. (This plugin's own first draft had that bug. A pressure test caught it; the skill now
requires --no-secrets.) When a skill here says "never run this bare", that's why.
Full policy: secrets.md · MCP and CLI setup for every
platform: machine-setup.md
You don't need Claude for these. Zero dependencies, --help on all of them.
python3 skills/mvp-stack/scripts/audit_secrets.py ~/code/my-appCRITICAL (3):
src/leak.ts:1 Secret behind a public env prefix [NEXT_PUBLIC_STRIPE_SECRET_KEY]
this prefix bundles the value into browser JavaScript
src/pay.ts:1 Stripe/Clerk secret key [sk_l•••• (32 chars)]
credential material hard-coded in a file
src/admin.ts:1 Supabase service_role JWT [eyJh•••• (130 chars)]
credential material hard-coded in a file
It never opens your real env files, shows at most four characters of anything it finds, and can
tell a Supabase anon key (public, fine) from a service_role key (incident) by decoding the token.
| Script | What it does |
|---|---|
doctor.py |
Is this machine ready? Tools, CLIs, MCP connections, design skill. Reads no credentials |
detect_stack.py |
What is this repo? Framework, ORM, host, auth, and env var names, never values |
audit_secrets.py |
Is this repo safe to push? Tracked env files, hard-coded keys, client-side service_role, public-prefixed secrets |
put_secret.py |
Put a key in a git-ignored env file via hidden prompt, pipe, or generator. Refuses if git would commit the file |
Thirteen skills. They load on their own when relevant, or call one directly: /mvp-stack:neon.
Prefer a command? /mvp-stack:init starts the same flow as /mvp-stack:mvp-stack.
Before it designs your data model (the database schema) or picks colours and type, it asks how hands-on you want to be: walk me through it, I decide, you check, or you decide. Skip the question by just telling it (a table list, a brand colour, a Figma link, "make it look good").
| Skills | |
|---|---|
| Start here | mvp-stack: stack selection, repo audit, machine setup, secrets, design |
| Hosting | vercel · cloudflare · firebase |
| Data | neon · supabase · turso · convex |
| Auth | clerk · better-auth |
| Extras | upstash (Redis, rate limiting, vectors) · bedrock (LLMs on AWS, and when to use something else) · tauri (a Mac/Windows/Linux desktop app around the same frontend, when the PWA isn't enough) |
The six stacks it chooses from
| Stack | Free for commercial use? | First thing that breaks | |
|---|---|---|---|
| A | Next.js on Vercel + Neon + Better Auth/Clerk | No (Vercel Pro, $20/mo) | The commercial-use rule |
| B | All-Cloudflare: Workers + D1 + R2 + KV | Yes, no card | 100k requests/day |
| C | Supabase + static host | Yes, no card | 1-week inactivity pause |
| D | Firebase | Yes, but card needed for Functions/Storage | Needing server-side code |
| E | Astro/SvelteKit on Cloudflare + Turso | Yes, no card | Workers daily cap |
| F | Convex + frontend host | Yes, no card | 1M function calls/month |
Full specs, caps, and exit paths: stacks.md
Skills are prompts, and prompts fail quietly. So each change here is run against a fresh agent with no context, under pressure to skip the rule: a deadline, a user offering to paste a key, a user saying "don't bother with mobile." The agent uses the skill on a real task and reports every place it had to guess. Those reports have caught a password leak in this plugin's own instructions, a pipe that would silently store an empty secret, and preview deploys that shipped with no database.
Platform facts (free-tier caps, MCP endpoints, CLI commands) were checked against vendor docs in September 2026. Vendors change them. The skills tell Claude to say when a figure was checked and to re-verify before you build on a specific cap.
Issues and PRs are welcome, especially:
- a free-tier number or MCP command that's gone stale (link the vendor doc)
- a bug on Linux or Windows
- a platform you'd want added
Keep scripts standard-library only and cross-platform, and never put a real credential in an example, even an expired one.
Design is delegated to Hallmark (MIT, by Together AI), installed on demand, never bundled, and only after Claude tells you.