From zero to a watched stack in 3 minutes

1. Sign in with GitHub. One click, OAuth only — we request repo read access so the deep-scan can detect your stack.
2. Add your first project. Click + New Project, paste a repo — name, domain, stack, hosting, DB and payment provider are auto-detected from the repo files and README.
3. Let the probes run. SSL, RDAP domain expiry and heartbeat checks run automatically. The Chaos Index sums it all up.
4. (Optional) Connect analytics. 🔐 Analytics Vault → paste a Cloudflare / GA4 / Plausible key — live traffic appears on the cards.
5. (Optional) Set alerts. Alerts → add rules like domain expires in 30d and get a Telegram/Discord ping.

What the Free plan includes

5 projects, unlimited probes, full deep-scan, GitHub import, alert rules. No credit card, no trial timer.

New to vibe-coding? Start with the standalone Vibe-Coding Glossary — it includes a copyable starter prompt for your first project.

Adding projects

Every card is one side project. Add manually or paste a GitHub repo URL — the importer fills what it can:

• Deep-scan reads the repo file tree: wrangler.toml → Cloudflare, vercel.json → Vercel, CNAME → your domain, package.json → framework, DB, ORM and payment provider.
• README scan finds your live URL and mentions of payments (Polar, Lemon Squeezy, Stripe…), databases (Supabase, Neon, Turso…), auth (Clerk, Auth.js…), email (Resend, Loops, SendGrid…) and analytics.
• Python backends are detected too: requirements.txt / pyproject.toml → FastAPI, Django or Flask.
• Env hints: .env.example variables (SUPABASE_URL, RESEND_API_KEY…) surface as suggestions — config that only lives in env vars must be confirmed manually.
• Every detection carries a role tag (frontend · hosting · backend · db · payments · analytics · auth · email) — the pipeline on your card shows what runs where.
• Heartbeat: each card has a snitch URL — add one line to your cron job and uptime monitoring is wired.

Editing & deleting

Use Edit on any card to fix details (the probe telemetry never gets overwritten). Deleting asks twice — we know how easy it is to fat-finger a card at 2 AM.

How the Analytics Vault Works

Frankenstack automatically aggregates 30-day visitor counts and pageviews across all your side projects using read-only API credentials. Keys are stored server-side in your private D1 SQLite vault, never exposed to clients, and never shared. We pull only anonymous aggregated totals — zero cookies, zero PII, zero tracking scripts injected into your users' browsers.

Tiers

Lifetime Deal — $59

All Stack Lord features forever, all v1.1 & v1.2 updates included, limited to the first 100 vibecoders. Sold via Lemon Squeezy (merchant of record — they handle VAT, invoicing and fraud for you).

Activating a purchase

1. Buy on the Lemon Squeezy checkout (redirected back with a welcome toast).
2. Either paste your license key (from the receipt) in the sidebar claim box, or claim by the email you used at checkout.
3. Plan upgrades instantly — limits, badges and the sidebar label update.

Push your own numbers into the cockpit

Every project has a private Ingest Key. Without it, /api/ingest/… and /api/ping/… return 401 — nobody can fake your MRR or your heartbeats.

1. Revenue & costs (POST /api/ingest/:projectId)

curl -X POST "https://frankenstack.app/api/ingest/YOUR_PROJECT_ID" \
  -H "Authorization: Bearer fsk_YOUR_INGEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{"mrr": 450, "infra_cost": 5.5, "status": "ok"}'

Accepted fields: mrr, infra_cost, status, plus token fields below. Run it from a daily cron, a payment-provider webhook, or your AI agent.

2. Heartbeat ("still alive") (POST /api/ping/:projectId/:jobName)

# daily cron (crontab, GH Action, or platform scheduler):
curl -X POST "https://frankenstack.app/api/ping/YOUR_PROJECT_ID/daily-job?key=fsk_YOUR_INGEST_KEY"

If the ping stops arriving, the Heartbeat Gap alert fires — the Dead Man's Snitch pattern: silence is the signal.

3. AI token burn (POST /api/ingest/:projectId/tokens)

curl -X POST "https://frankenstack.app/api/ingest/YOUR_PROJECT_ID/tokens" \
  -H "Authorization: Bearer fsk_YOUR_INGEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tokens_in": 1200, "tokens_out": 450, "model": "gpt-4o", "provider": "openai"}'

Auth & errors

• Send the key as Authorization: Bearer fsk_… (recommended) or ?key=fsk_… in the URL.
• 401 Ingest key not set → generate one in the project modal.
• 401 Invalid ingest key → wrong or rotated key; regenerate and update your cron.
• The key is shown only to the project owner and never on the public Wall or badges.

Alert rules

Each rule watches one metric on one project:

• domain_days — warn before a domain lapses (default: 30 days)
• uptime_below — uptime% crossing a threshold
• heartbeat_gap — cron/heartbeat missed
• errors_above — 24h error count
• visitors_drop — traffic collapse (early warning your launch flopped 😅)
• ai_burn_above — 24h AI token spend goes over a dollar limit (e.g. $15). This alerts you; it doesn't stop the spending
• ai_balance_below — provider credit balance drops below dollar threshold

Channels

Discord webhook or Telegram bot — channels are account-level: every project alerts to the same channels. Use Send test alert to verify delivery. The edge cron evaluates rules every 5 minutes; a 30-minute cooldown prevents alert storms per project.

AI Token & Burn Rate Protection

Vibecoders building AI-powered apps risk rogue scrapers or prompt loops burning through hundreds of dollars in OpenAI, Anthropic, or OpenRouter credits while asleep. The AI Token Sentinel tracks rolling 24-hour spend, queries provider balances, and sends instant alerts to Discord and Telegram when spend jumps. It warns you; it doesn't stop the spending.

1. Webhook Ingest (POST /api/ingest/:projectId/tokens)

Call this from your server or API route after generating an LLM response:

curl -X POST "https://frankenstack.app/api/ingest/YOUR_PROJECT_ID/tokens" \
  -H "Authorization: Bearer fsk_YOUR_INGEST_KEY" \
  -H "Content-Type: application/json" \
  -d '{"tokens_in": 1200, "tokens_out": 450, "model": "gpt-4o", "provider": "openai"}'

await fetch(`https://frankenstack.app/api/ingest/${projectId}/tokens`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' },
  body: JSON.stringify({
    tokens_in: completion.usage.prompt_tokens,
    tokens_out: completion.usage.completion_tokens,
    model: 'gpt-4o',
    provider: 'openai'
  })
});

import urllib.request, json
req = urllib.request.Request(
    f"https://frankenstack.app/api/ingest/{project_id}/tokens",
    data=json.dumps({
        "tokens_in": resp.usage.prompt_tokens,
        "tokens_out": resp.usage.completion_tokens,
        "model": "claude-3-5-sonnet",
        "provider": "anthropic"
    }).encode("utf-8"),
    headers={"Content-Type": "application/json"}
)
urllib.request.urlopen(req, timeout=3)

2. Automated Model Pricing

Passing model auto-applies standard pricing rates for GPT-4o, GPT-4o-mini, Claude 3.5 Sonnet, Claude 3 Haiku, and popular open-source models. You can also pass cost_usd explicitly if you calculate costs yourself.

3. Spend Alerts

If 24h rolling spend crosses the default $15.00 limit (or your custom rule threshold in the Alert Center), an emergency alarm fires to Discord and Telegram with a 1-hour anti-spam cooldown. Alerts don't stop the spending, so set a limit at your AI provider as well.

4. AI Assistant MCP Tool

Your AI assistants in Claude Desktop and Cursor can query token spend on demand:

• get_ai_sentinel — 24h spend, token counts, balance, and alert status per project or account-wide.

Query your stack from Claude, ChatGPT & Cursor

Frankenstack ships a native Model Context Protocol server at https://frankenstack.app/mcp — point any MCP client at it and your AI assistant can answer questions like "which domain expires next?" or "summarize my stack health" from live data.

Connecting (2 steps)

1. Open the 🤖 MCP button in the header → Copy token for MCP (your session token — plan-gated: paid tiers & LTD).
2. Add the connector in your client:
   • Claude Desktop / Claude Code: claude mcp add --transport http frankenstack https://frankenstack.app/mcp --header "Authorization: Bearer <token>"
   • Cursor: MCP settings → Add server → URL + header field.
   • Claude.ai (web): Settings → Connectors → Add custom connector → paste the URL. If the form has a headers field, put Authorization: Bearer <token> in it.

Available tools (read-only)

• list_projects — every card, status + category
• get_stack — hosting, DB, payments, pipeline per project
• get_heartbeats — last ping per project
• get_ssl_status — certificate validity + expiry
• get_alerts — your alert rules & thresholds (reported on demand — automated firing is on the roadmap)
• get_metrics — visitors, MRR, revenue 30d
• get_ai_sentinel — 24h AI token volume, spend & credit balance
• get_wall_summary — one-paragraph stack health brief

Your token: how it's generated & how long it lasts

• Generated on sign-in. Every login (GitHub OAuth) creates a fresh session token: two cryptographically random UUIDs joined into a 64-character string (~256 bits of entropy — not guessable, not derived from your email or GitHub profile).
• Tied to your account only. The token is stored against your user ID server-side. Every MCP call resolves the token back to you, and all queries are filtered with WHERE user_id = ? — no user can ever see another user's projects, metrics or tokens.
• Valid for 30 days. After that it expires automatically and API/MCP calls return 401 — just sign in again and copy the fresh token (10 seconds with the 🤖 MCP button).
• Stays signed in between visits. The token lives in your browser (localStorage), so you don't log in per visit — the app keeps you signed in for 30 days. Sign-out is an explicit, rare action.
• Sign-out revokes for real. Signing out deletes the session server-side as well — any copy of the token (including an MCP client's) becomes worthless immediately. A new sign-in generates a fresh token; old ones are not re-used.
• One paste per device. You don't re-enter the token per chat: paste it once into each MCP client's config (Claude Desktop, Cursor, custom connector) and the client sends it automatically. Repeat only when it expires or when you wire up a new device.