What ClickMVP generates under the hood
Not boilerplate. Not a prototype. Production-grade code with Clean Architecture, SOLID principles, and three layers of automated tests.
Not boilerplate. Not a prototype. Production-grade code with Clean Architecture, SOLID principles, and three layers of automated tests.
Principles
Every generated module follows the same contract. No shortcuts, no magic strings, no coupled layers.
Four layers with strict boundaries. Domain holds entities and value objects. Application holds use cases and DTOs. Infrastructure implements repositories with Prisma. HTTP handles routes and controllers. Use cases never import Prisma directly — only repository interfaces.
Each class has one reason to change (SRP). New behaviors are added via composition, not modification (OCP). Repository interfaces are segregated per entity (ISP). All dependencies point inward — infrastructure depends on domain, never the reverse (DIP).
Three layers generated per entity. Unit tests validate use case logic with mocked repositories. Integration tests run against a real database with Prisma. E2E tests hit the HTTP endpoints and verify complete request/response cycles.
Role-based access control with granular permissions per entity and action. Full audit trail logging who created and modified every record. File attachments via S3. Transactional emails via SMTP or AWS SES. Multi-language admin interface in PT, EN, and ES.
Generated Stacks
Backend and frontend generated independently. Each one is a standalone project you can open, run, and customize.
AI-Ready Output
Every generated project ships with context files so Claude, Cursor, and Copilot can extend the code correctly — following the same architecture, conventions, and domain model.
Architecture rules, layer conventions, naming patterns, aliases, and step-by-step recipes for adding fields, entities, and business rules. Auto-loaded by Claude Code.
Same context formatted for Cursor (.cursorrules), GitHub Copilot (.github/copilot-instructions.md), and OpenAI agents. One source of truth, multiple targets.
Full domain catalog in natural language — every entity, every field (type, required, format), every relationship. Your AI reads this instead of 50 source files.
Exact extension recipes specific to the generated project: add a field, add an entity, add a use case, add RBAC for a new resource, add a relationship. Not generic — based on the actual code.
MCP Server
ClickMVP exposes a Model Context Protocol server with 4 tools. Connect it to Claude Desktop, Claude Code, Cursor, or VS Code Copilot and generate code via natural language.
Browse available domains — ERP, startups, and industry verticals. Filter by source (erp or misc).
Inspect entities within a module — names, labels, field counts, and cross-module references.
Full schema of any entity — field names, types, validations, foreign keys, and select options.
Generate backend or frontend as a ready-to-run ZIP file. Supports project_id for feature flags integration.
Optional Features
Toggle enterprise features per project. Each one adds the corresponding code to backend and frontend.
| Feature | What it generates | Requires |
|---|---|---|
| Role-based Permissions | Guards, roles, permissions per entity × action, admin UI for role management | — |
| Audit Trail | Automatic logging of create/update/delete with user, timestamp, and changes | — |
| File Attachments | Upload per record, S3 storage, pre-signed URLs, file list UI | AWS S3 |
| Transactional Email | Email service, templates, send on events (create, status change) | SMTP / AWS SES |
| Multi-language Interface | Admin UI with language selector, translation files for PT, EN, ES | — |
Under the Hood
Code is generated by templates, not by AI prompts. That's why it always compiles, always follows the same architecture, and never hallucinates.
~100 files generated in under 2 seconds. Lambda execution peaks at 200–300 MB memory. Cost per generation: ~$0.000008.
Same input → same output. Always. No temperature, no randomness, no "retry until it compiles". Template-based generation guarantees consistency.
Security
Every generated application ships with a hardened security layer — no configuration required. These are not guidelines; they are generated code.
Short-lived access tokens (15 min) paired with refresh tokens (7 days). Token type is verified on every request — refresh tokens cannot be used as access tokens.
Global limit of 300 requests/minute per IP. Auth endpoints (login, register, verify-email, forgot-password) are capped at 10 requests per 15 minutes — blocking credential stuffing and brute force attacks.
Passwords are never stored in plain text. bcrypt with cost factor 10 is applied at registration and when changing passwords. Comparison uses constant-time to prevent timing attacks.
Email verification codes expire in 15 minutes and are invalidated after 5 failed attempts — preventing exhaustive search of the 6-digit space. Each resend replaces the previous code.
CORS is locked to the project's own domain, not open to all origins. Development environments additionally allow localhost. Credentials are enabled only for allowed origins.
HTTP security headers are applied globally: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security (HSTS), and more — protecting against clickjacking, MIME sniffing, and protocol downgrade attacks.
All database access goes through Prisma — no raw queries, no string concatenation. Sort fields are validated against an entity-specific whitelist before being passed to the ORM, preventing arbitrary field injection from query parameters.
Every endpoint validates its payload with a typed Zod schema — body, query parameters, and path params. Unknown fields are stripped. Validation errors return 422 with field-level detail, never a 500.
File uploads go directly from the browser to S3 using short-lived presigned URLs. The backend never handles file bytes — eliminating upload-based attack surface and reducing server memory pressure.
Unhandled errors return a generic 500 message — no stack traces, file paths, or internal state leaked to the client. Domain errors (401, 403, 404, 422) return structured JSON with a typed error code.
Roadmap
ClickMVP is actively evolving. Here's where we're headed.
Clean Architecture, SOLID, RBAC, audit, S3, email, i18n, automated tests
Clean Architecture, typed API clients, data tables, forms, i18n, Playwright tests
4 tools: list_modules, list_tables, list_fields, generate_app — works with Claude, Cursor, Copilot
CLAUDE.md, AGENTS.md, DOMAIN.md, RECIPES.md generated with every project
React Native and/or Flutter stack generation with the same Clean Architecture principles
Spring Boot (Java/Kotlin), Laravel (PHP), Django (Python), NestJS — the most popular backend frameworks
AWS Lambda + API Gateway, Cloudflare Workers — deploy-ready serverless architectures from the same data models