One route works today · two are designed

Getting the manifest to whatever builds it.

A brief your assistant can act on, handed over in the simplest way that works. What is not built yet is marked as not built.

The rule that shapes everything here

Vibe Builders never holds a credential of yours.

There is no field on this site that asks for a token, a key or a password, and there is no database behind it to put one in. The manifest tells you which scope each service wants; you grant it on the vendor’s own screen, to your own assistant, on your own machine.

This is not restraint, it is architecture. A site that stores other people’s GitHub and Stripe credentials is a target worth attacking. This one is deliberately boring to break into, because there is nothing inside it to take.

Copy and paste

Works today, with every assistant

The manifest page has a button that copies the whole brief as plain text: every account, its exact scope, the free allowance, and the checks the finished build has to pass. Paste it into Claude Code, Cursor, a Jarvis of your own, or a text file. Nothing about this depends on us being clever.

It is deliberately the primary route rather than a fallback. A plain-text brief works in an assistant that does not exist yet, which no integration can claim.

Your own agent endpoint

Designed · not built

If you run your own assistant with a daemon on your machine, this site would hand it the manifest directly: you paste the endpoint it listens on and a one-time pairing code, and the browser talks to your machine rather than to a server here.

Not shipped, and the reason is written down rather than vague: allowing a browser to open a socket to an address a visitor typed means widening this site's content security policy to permit any host. That trade buys a convenience and sells a protection, so the endpoint gets proxied through this origin instead — and that proxy is real work, not a checkbox.

Sign in with Google, and keep your manifests

Designed · not built

An account would remember your manifests across devices and let a hosted assistant fetch them without a copy-paste. Google sign-in, because it is the account you already have and it means there is no password here for anyone to steal.

There is no database attached to this site yet, and adding accounts means adding row-level security, session cookies scoped properly, and a rate limit on the sign-in path. Those arrive together or not at all — half of them is worse than none, because it looks finished.

What to tell your assistant when you paste it

The copied brief already ends with three instructions, because they are the three that get skipped when an assistant is left to its own judgement:

Ask for each credential as you need it.
Not all at once at the start, and never written into the repository.
Git-ignore .env and .env.* in the first commit.
Added later, it does not un-commit anything — and a secret that was ever pushed has to be rotated, not deleted.
Do not invent a testimonial, a metric, or an address.
An empty section that says it is empty is worth more than a plausible fiction.

Get the brief first. The handover is the easy part.

Describe your build →See the catalogue