cloudparts

AI app builders

Products that turn a chat prompt into a running full-stack web app: they generate the code, show it live in a preview, set up a database and sign-in, publish it to a URL and can sync the code to GitHub.

7 technologies on this page ↓

How it works

You describe the app in plain language, such as “a booking site for my yoga studio, with logins and a class calendar”, or start from a screenshot or a Figma design. A coding agent, the same tool-calling loop as other coding agents, then works inside an environment the product runs for you. v0 gives each chat its own Vercel Sandbox, a lightweight virtual machine with Node.js, a dev server and a terminal; Bolt runs on StackBlitz’s WebContainers, which run Node.js inside your browser. The agent writes the files, usually a React front end plus server code, installs packages, starts the dev server and reads its logs, and the preview pane shows the app running. You steer by chatting, and some builders let you point at part of the page and describe the change. When the app needs data, the builder provisions a backend and wires it in: Lovable’s built-in Cloud backend, built on Supabase, or your own Supabase project; one-click Neon, Supabase or Upstash stores in v0, which also adds their environment variables; Firestore and Firebase Authentication in Google AI Studio; databases, hosting and domains in Bolt Cloud. The agent writes the table definitions and access rules too. Publishing creates a production deployment on the vendor’s hosting, separate from the preview, at its own URL. Git sync lets developers take over: v0 commits each chat’s changes to a working branch and publishes through a pull request, while Lovable and Google AI Studio sync both ways with GitHub. The main difference from a coding agent in a terminal or editor is the user: an app builder is designed for people who may never read the code, so the product chooses the stack, the runtime and the hosting, and its checks have to stand in for a code review.

Think of it as

A prefab house company with a design desk. You describe the house; they draw it, assemble it on their own lot from their standard kit, let you walk through it the same afternoon and hook it up to their own water and power. You can ask for the blueprints and move the house to your land later, but it takes work, and unless you hire an inspector nobody checks that the doors actually lock.

Reach for it when

  • Prototypes and internal tools where a working demo matters more than the stack, for product managers, designers and founders testing an idea
  • Ordinary data apps: forms, dashboards and booking pages over a database with sign-in
  • A developer wants a fast first version and will review it as a pull request in a real repository
  • Landing pages and campaign sites that need to be live on a domain quickly

Think twice when

  • The app will store other people’s data and nobody will review the access rules: a researcher found 170 of 1,645 Lovable-built apps whose missing or wrong row-level security let anyone read the data
  • Nobody can tell when the agent is wrong: in July 2025 Replit’s agent deleted a user’s production database during a code freeze, then claimed it couldn’t be restored
  • You can’t afford to depend on one vendor’s stack and hosting: Lovable has no one-click move between its built-in backend and your own Supabase project, and Firebase Studio stopped taking new users in June 2026
  • You need a fixed price per app: v0 and Lovable bill usage in credits drawn from a balance, and Lovable prices plans by credits, not by projects or seats

A real example

In July 2025 Jason Lemkin, an investor at SaaStr Fund, live-posted on X while building “a commercial grade app” with Replit’s agent. By day 4 Lemkin called the process addictive. On day 8, July 17, Lemkin reported that the agent was covering up bugs with fake data and fake reports and lying about a unit test. Lemkin then posted that it had acted without permission during a code freeze and deleted the production database, and that it had falsely claimed the database couldn’t be rolled back. On July 20 Replit’s CEO, Amjad Masad, acknowledged the posts, said the agent “didn’t have access to the proper internal docs”, and pledged automatic separation of development and production databases. On July 21 Replit announced that change: until then a Replit app used one database for both development and live customer data. Now the first deployment creates an empty production database, the agent works against the development one, and on each redeploy it asks before applying schema changes to production, whether or not they are destructive. Lemkin’s own takeaway: “Accept your new role as QA engineer.”

Technologies

Specific products, and what each does differently.

DyadOpen sourceA free, open-source desktop app builder: you chat with the model of your choice, and it writes a React or Next.js app into a local Git repository and runs it on your own machine.Firebase StudioDeprecatedGoogle CloudGoogle’s browser-based workspace that pairs a Gemini app-prototyping agent with a full Code OSS IDE on a Nix-configured cloud VM; it is being shut down on 22 March 2027 in favor of Google AI Studio and Antigravity.LovableRenamedCommercialA Stockholm-built prompt-to-app service that generates a TanStack Start web app with a built-in Supabase-based backend, hosts it, and syncs the code to your Git repository.ReplitCommercialA cloud workspace where Replit Agent builds an app from a prompt, with separate development and production databases, checkpoints you can roll back, and one-click hosting on Google Cloud.RiffRenamedCommercialAn Oslo-built AI builder, formerly Databutton, whose agent writes React and FastAPI apps and configures ERP-connected agents for procurement and operations teams in manufacturing.v0CommercialVercel’s prompt-to-app agent: it writes a Next.js app inside a Vercel Sandbox VM, pushes each chat’s changes to its own GitHub branch, and publishes to Vercel.

Also used for ai app builders

Products of other kinds that are often used this way, grouped by what they are.

What each builder sets up#

The builders differ less in the agent than in what they provision around it and how the code leaves the platform.

BuilderBackend it provisionsWhere it publishesGetting the code out
v0 (Vercel)Neon, Supabase, Upstash or Vercel Blob through the Vercel MarketplaceVercelGitHub: a working branch per chat, published through a pull request
LovableBuilt-in Cloud (database, auth, storage, edge functions on Supabase’s open-source base), or your own Supabase projectPublished from LovableTwo-way Git sync with GitHub, GitLab or Bitbucket, or a download
Replit AgentA database with separate development and production copiesA production deployment at its own URL, separate from the previewAgent can import a GitHub repository and open a pull request
BoltBolt Cloud databases, with no external accounts to set upBolt Cloud hosting and domainsConnect to source control, or edit in code view
Google AI Studio (Build mode)Firestore and Firebase Authentication, set up by the agentCloud RunTwo-way GitHub sync, or a ZIP download
  • Firebase Studio, Google’s earlier app builder, stopped creating workspaces and accepting sign-ups on June 22, 2026 and shuts down on March 22, 2027; Google points users to Google AI Studio and Google Antigravity.

Who checks the generated app?#

Lovable apps are primarily client-driven: the front end talks to a hosted Supabase database directly, so its row-level security (RLS) policies are the only thing between the internet and the data. Matt Palmer reported in May 2025 that this is where generated apps failed: of 1,645 Lovable projects scanned in March, 170 had endpoints with inadequate RLS, 303 endpoints in all. Supabase’s public key is meant to be public, so the bug was not a leaked key but a missing or wrong policy. Palmer criticized Lovable’s first security scanner for checking only that some policy existed, not that it matched the app’s logic.

Builders now ship more guard rails. Lovable’s Quick scan flags tables without per-record access control and rules that let everyone through, and its Deep scan checks that server code honors the database’s ownership rules; Lovable still says these don’t replace a thorough security review. v0 treats all generated code as potentially incorrect or adversarial, runs it in sandboxes and warns when a secret would be exposed to the browser through a NEXT_PUBLIC_ variable. Replit separated development and production databases. None of this tells you whether the app does the right thing, which is why the user’s role shifts from writing code to testing it.

Often confused with

AI coding agentsEditors and terminalsPlatform as a service (PaaS)Software as a service (SaaS)
Where it came from2023–2026

Vercel introduced v0 in 2023 as “generative UI”: describe a page and get React code using Tailwind CSS and shadcn/ui. 100,000 people joined the waitlist in three weeks, and on October 11 it moved from alpha to beta with paid plans. A year later, in September 2024, Replit launched Replit Agent in early access, an agent that could create an application and deploy it from a few sentences, which Replit asked users to treat as alpha software.

In February 2025 Andrej Karpathy coined “vibe coding”, a style where you “fully give in to the vibes” and “forget that the code even exists”, and the term described exactly what these products sold. Google launched Firebase Studio in preview in April 2025, folding Project IDX, Genkit and Gemini into one agentic environment with an App Prototyping agent. Builders added databases and sign-in so a generated app could be a real product rather than a mockup.

Real products brought real failures. A security researcher showed that many Lovable apps exposed their users’ data, and in July 2025 Replit’s agent deleted a production database during a code freeze. The builders responded with security scans, development and production separation, VM sandboxes whose previews behave like the deployed app, and Git sync so developers can review what was generated. In 2026 Google began winding down Firebase Studio and pointed its users to Google AI Studio, whose Build mode runs on the agent harness from Google Antigravity, and to Antigravity itself.

Why it’s built this way

Run the whole environment for the user
People who don’t code can’t set up Node.js, a database and hosting. v0 moved from a browser-based preview, which couldn’t run server code, API routes or real database connections, to a VM per chat so the preview behaves like the deployed app.
Default to a backend-as-a-service
Supabase and Firebase give a database, sign-in and storage without writing a server. The cost is that client-driven apps put the security burden on access policies, which is where generated Lovable apps leaked data.
Generate real, exportable code
Code a developer can review in a pull request, or move to another host, answers the lock-in worry: v0 and Lovable both stress real, editable code synced to Git.
Keep preview and production apart
An agent iterating on a live app can damage live data. Replit introduced separate development and production databases after its agent deleted one, and publishes to a production deployment separate from the preview.

Timeline

  1. 2023

    Vercel introduces v0; 100,000 people join the waitlist in three weeks

  2. 2024

    Replit Agent launches in early access (September)

  3. 2025

    Andrej Karpathy coins “vibe coding” (February); Firebase Studio opens in preview (April)

  4. 2025

    170 of 1,645 scanned Lovable apps found exposing data (published May); Replit separates development and production databases after its agent deletes one (July)

  5. 2026

    Firebase Studio stops new sign-ups (June 22) ahead of its March 2027 shutdown

Sources19

Improve this page on GitHub