Makeble — AI web builder
You describe an app in plain language; Makeble generates the Next.js code, deploys it, and shows you a live preview. I built the whole machine — which is exactly why I know how AI-written code breaks.
- Scope
- 44.7K lines · 358 commits, solo
- Pipeline
- Prompt → code → live deploy
- Status
- Live demo online
The problem
AI can write code. The hard part is everything around that: streaming it safely into a real project, validating what the model returns, deploying every change, and charging for tokens without ever giving away more than was paid for.
Makeble is that whole loop, built end to end by one person: generation, validation, deployment, billing.
What's inside
The four systems that carry the product:
Streaming AI code generation
Claude streams code into the project file by file; the client parses the stream, security-validates the output, and applies it to the file store — with undo history.
Deploy-per-prompt previews
Every prompt pushes the project to Vercel as a preview deployment; the editor polls until it's live. Generated code runs on its own origin, never on mine — a decision that closed a whole class of security holes.
A real security model
Per-route CSRF checks, Zod-bounded request bodies, DB-backed rate limits, idempotent writes, and AI output validated before a single file is touched.
Token-metered billing
Stripe-driven tiers, with tokens reserved atomically before streaming and reconciled after — usage limits are enforced server-side, not politely requested.
Why it matters
What it proves matters more than what it earns:
- A working prompt-to-production pipeline — generation, validation, deploy, billing — built solo.
- Hebrew-first with full RTL: the entire shell flips direction, not just the text.
- It's why “hardening AI-generated code” on this site isn't a slogan — I've watched AI code fail from the builder's side of the machine.
Stack
Next.js App Router, Drizzle ORM on Postgres, NextAuth, Stripe, and the Anthropic SDK. Personal project — the live demo is linked from the card.
Does this sound like your app?
Every engagement here started the same way: an app already live, and a problem someone decided to stop living with. The audit is the low-risk way to start — read-only access, a written report, a prioritized fix list.