One key for the agent that builds the business
An agent can write an app in an afternoon and then spend the evening stuck on accounts, dashboards and secrets. Vibiz Stack puts hosting, a database, sign-in, payments, email and AI behind one key built for that agent, and decides up front what the key can never do.
A typical small product needs a host, a database, sign-in, payments, email, analytics and an AI key. That usually means seven accounts, seven dashboards and seven secrets for an agent to ask for. A Vibiz project bundles these, so vibiz init creates hosting, a database, sign-in and analytics in one step. Email, AI and session replay can be added later.
IITwo kinds of key
The hard part of handing infrastructure to an agent is not the API. It is deciding what the agent may do on its own.
Every key the CLI or an agent receives is an agent key. It can build, deploy and run the business. It can never read production secrets, move live money, add a domain or connect another host. Those belong to the owner, a person signed in to the console. When an agent hits one of those lines, the API answers owner_only, and the agent tells the person which command to run.
We drew the line where a mistake is expensive and hard to reverse: money, secrets, and where production traffic goes. Everything inside that line can be undone.
IIIA copy to break
Agents work against a development environment, not production. It is its own database branch, with production's tables and none of its rows. It also has its own sign-in, which trusts localhost, and its own AI key. Its values are written to a local env file and never printed, so they don't end up in a transcript.
This lets an agent run migrations, seed data and test sign-in flows freely, without a person watching every step.
IVDeploys you can undo
Deploying works by content hash. The CLI asks which files the host is missing, uploads only those, and sends a manifest. Every deployment keeps its manifest, so rolling back to the previous production deployment is a switch, not a rebuild. Previews get their own URL and can be promoted once someone has looked.
The CLI also refuses to upload what should never leave the machine: env files, keys, .git, node_modules and build folders. It will not deploy a home or config folder.
VUsing it ourselves
This site, and the Open Passport site, run on Vibiz Stack. Moving Open Passport took one project, one preview, a check of every page and one promote. Analytics was one more command and one script tag. It is cookieless: no stored IP, and visitors counted by a hash salted daily.
VIWhat is missing
Moving a real site showed us the gaps:
- Response headers and redirects. A site can't yet set its own security headers or redirect rules, so we wrote small forwarding pages instead.
- Long-running servers. Hosting is built for web apps. The Open Passport server, which keeps its files on disk in a single long-lived process, still runs elsewhere.
- Deploy on push. A deploy is a command today, not a hook on the repository.
- Pricing. Not decided yet. During the private beta, hosting and analytics are recorded at $0.
Vibiz Stack is in private beta, with accounts opened by invitation.