Open Builder
Open-source, Lovable-style AutoApp

Ship full-stack apps at the speed of conversation

Describe what you want. The agent activates security-reviewed blocks, writes only the domain code, and proves every change with a real build. You walk away with standard React + TypeScript you fully own — never a no-code cage.

Start building See the Plant Pal demo
autoapp-platform.vercel.app/builder
Project
apps/scaffold/
Chat
Add a plants page
Generated PlantsPage.tsx
Preview
src/pages/PlantsPage.tsx ✓
16 reusable blocks, human-reviewed once
5 step agent loop, no black boxes
$0 to run on Vercel + Supabase free tiers
100% standard code you export and own

The agent loop

Every prompt runs the same five steps

No one-shot guesswork. Each turn parses intent, gathers context, plans a change set, builds it, and folds the result back in — so output stays consistent and reviewable.

01

Spec

Turn a plain-English prompt into concrete intent, constraints, and scope boundaries.

02

Context

Snapshot the file tree, block manifest, and recent chat — bounded, never the whole repo.

03

Plan

Classify the work: activate a block, configure it, or generate a feature. Preview diffs first.

04

Build

Apply patches behind a TypeScript + Vite gate. Broken builds never reach the preview.

05

Preview

The live preview updates. Your feedback starts the next cycle — iterate until it ships.

Runtime architecture

Two tiers, one public key, zero trust in the browser

Generated apps talk straight to Supabase over a public key. A blue client zone is guarded by Row Level Security; a red server zone holds every secret. Authorization lives in the database, not in hope.

Blue zone · client React SPA bundled, runs in browser Publishable anon key public by design RLS + storage policies decide every row Supabase managed layer PostgREST Auth API Storage API Edge functions red zone · secrets Data PostgreSQL RLS enforced

Frozen blocks

Reuse the hard parts, generate only what's yours

Auth, storage, admin, and RLS are reviewed once and frozen. The agent flips them on with deterministic recipes and spends its tokens on your actual product.

Auth & RLS

Supabase Auth, JWT sessions, and Row Level Security on every user-owned table by default.

Block registry

Deterministic recipes flip a block from stub to enabled — no LLM ever rewrites security-critical wiring.

Edge functions

Secrets stay server-side. AI calls, admin metrics, and privileged writes run in the Deno red zone.

Admin dashboard

Tabs appear as blocks turn on — Users, Storage, AI usage — all gated behind RBAC.

Plant Pal demo

A full reference app: upload a photo, get an AI health check, and browse history — end to end.

Free-tier deploy

Runs on Vercel Hobby + Supabase free. Export the scaffold as a standalone repo whenever you like.

Why choose this platform

The ownership of code, the speed of no-code

This Platform

  • Real React + TypeScript you export to GitHub
  • RLS-first security, reviewed once and frozen
  • Every change gated by a real build
  • Full-stack: database, auth, storage, edge functions
  • No vendor lock-in, no proprietary runtime

Typical no-code

  • Opaque blocks you can't inspect or export
  • Authorization bolted on, if at all
  • Broken states ship silently
  • Front-end only, or a closed backend
  • Your project lives and dies on their platform

Tech stack

Boring, standard, and entirely yours

No bespoke framework to learn. It's the stack you already know — just scaffolded well.

  • React + Vite + TypeScript + Tailwind
  • shadcn/ui components copied into the repo
  • Supabase Postgres, Auth, Storage, Edge Functions
  • pnpm monorepo orchestrated with Turborepo
lovable.blocks.json
{
  "blocks": {
    "auth": { "state": "enabled" },
    "storage": { "state": "enabled" },
    "ai": { "state": "enabled" },
    "rbac": { "state": "enabled" }
  }
}

FAQ

Questions, answered

Is this production-ready?

It's a proof-of-concept that mirrors Lovable's architecture. The blocks and RLS patterns are real and reviewable, but you should human-review generated RLS policies before shipping anything sensitive.

What do I actually own?

Everything. The output is standard React + TypeScript in your repo. Run pnpm export:scaffold to lift it out as a standalone project — no runtime dependency on the platform.

How does block activation work?

Cross-cutting infrastructure is frozen. When you ask for "login," the planner runs a deterministic recipe that flips the auth block from stub to enabled. Shared schema migrations are deployed centrally — no LLM or tenant sandbox mutates auth internals.

What does it cost to host?

Nothing to start. The default target is Vercel Hobby plus the Supabase free tier. Expect cold starts and occasional project pauses — fine for demos and internal tools.

Can I use my own AI provider?

Yes. The AI gateway runs in mock mode until you set a secret in Supabase, then routes real calls through an edge function so keys never reach the browser.

Describe it. Watch it build.

Open the builder, type what you want, and get real source code back — with a live preview and no lock-in.

Open the Builder Explore Plant Pal source