Not boilerplate. Not a prototype. Production-grade code with Clean Architecture, SOLID principles, and three layers of automated tests.
Try Free, Generate Your First ProjectPrinciples
Every generated module follows the same contract. No shortcuts, no magic strings, no coupled layers.
Four layers with strict boundaries. Domain holds entities and value objects. Application holds use cases and DTOs. Infrastructure implements repositories with Prisma. HTTP handles routes and controllers. Use cases never import Prisma directly, only repository interfaces.
Each class has one reason to change (SRP). New behaviors are added via composition, not modification (OCP). Repository interfaces are segregated per entity (ISP). All dependencies point inward, infrastructure depends on domain, never the reverse (DIP).
Three layers generated per entity. Unit tests validate use case logic with mocked repositories. Integration tests run against a real database with Prisma. E2E tests hit the HTTP endpoints and verify complete request/response cycles.
Role-based access control with granular permissions per entity and action. Full audit trail logging who created and modified every record. File attachments via S3. Transactional emails via SMTP or AWS SES. Multi-language admin interface in PT, EN, and ES.
Generated Stacks
Backend and frontend generated independently. Each one is a standalone project you can open, run, and customize.
AI-Ready Output
Every generated project ships with context files so Claude, Cursor, and Copilot can extend the code correctly, following the same architecture, conventions, and domain model. Pick the format your workflow uses, including Spec Kit and AWS Kiro.
Architecture rules, layer conventions, naming patterns, aliases, and step-by-step recipes for adding fields, entities, and business rules. Auto-loaded by Claude Code.
Same context formatted for Cursor (.cursorrules), GitHub Copilot (.github/copilot-instructions.md), and OpenAI agents. One source of truth, multiple targets.
Specifications in the Spec Kit format, faithful to the canonical structure for backend and frontend, ready for a spec-driven workflow.
Steering and specs in the AWS Kiro format, so your agent picks up the project with the same architecture and conventions.
Optional Features
Toggle enterprise features per project. Each one adds the corresponding code to backend and frontend.
| Feature | What it generates | Requires |
|---|---|---|
| Role-based Permissions | Guards, roles, permissions per entity × action, admin UI for role management | · |
| Audit Trail | Automatic logging of create/update/delete with user, timestamp, and changes | · |
| File Attachments | Upload per record, S3 storage, pre-signed URLs, file list UI | AWS S3 |
| Transactional Email | Email service, templates, send on events (create, status change) | SMTP / AWS SES |
| Multi-language Interface | Admin UI with language selector, translation files for PT, EN, ES | · |
Under the Hood
The AI helps you shape the data model. The code itself is rendered by Jinja2 templates, not written token by token by a model, so it always compiles and always follows the same architecture.
100–1,500 files generated in 2–3 seconds. Lambda execution under 512 MB memory.
Same input → same output. Always. No temperature, no randomness, no "retry until it compiles". Template-based generation guarantees consistency.
Security
Every generated application ships with a hardened security layer, no configuration required. These are not guidelines; they are generated code.
Short-lived access tokens (15 min) paired with refresh tokens (7 days). Token type is verified on every request, refresh tokens cannot be used as access tokens.
Global limit of 300 requests/minute per IP. Auth endpoints (login, register, verify-email, forgot-password) are capped at 10 requests per 15 minutes, blocking credential stuffing and brute force attacks.
Passwords are never stored in plain text. bcrypt with cost factor 10 is applied at registration and when changing passwords. Comparison uses constant-time to prevent timing attacks.
Email verification codes expire in 15 minutes and are invalidated after 5 failed attempts, preventing exhaustive search of the 6-digit space. Each resend replaces the previous code.
CORS is locked to the project's own domain, not open to all origins. Development environments additionally allow localhost. Credentials are enabled only for allowed origins.
HTTP security headers are applied globally: X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security (HSTS), and more, protecting against clickjacking, MIME sniffing, and protocol downgrade attacks.
All database access goes through Prisma, no raw queries, no string concatenation. Sort fields are validated against an entity-specific whitelist before being passed to the ORM, preventing arbitrary field injection from query parameters.
Every endpoint validates its payload with a typed Zod schema, body, query parameters, and path params. Unknown fields are stripped. Validation errors return 422 with field-level detail, never a 500.
File uploads go directly from the browser to S3 using short-lived presigned URLs. The backend never handles file bytes, eliminating upload-based attack surface and reducing server memory pressure.
Unhandled errors return a generic 500 message, no stack traces, file paths, or internal state leaked to the client. Domain errors (401, 403, 404, 422) return structured JSON with a typed error code.
Roadmap
ClickMVP is actively evolving. Here's where we're headed.
Clean Architecture, SOLID, RBAC, audit, S3, email, i18n, automated tests
Clean Architecture, typed API clients, data tables, forms, i18n, Playwright tests
CLAUDE.md, AGENTS.md, Spec Kit, AWS Kiro generated with every project
React Native and/or Flutter stack generation with the same Clean Architecture principles
Spring Boot (Java/Kotlin), Laravel (PHP), Django (Python), NestJS, the most popular backend frameworks
AWS Lambda + API Gateway, Cloudflare Workers, deploy-ready serverless architectures from the same data models