SBL Toolbox · Free MCP server
Check your AI-built app before launch, inside Claude or ChatGPT.
Add Check and Launch to your AI assistant and describe your app. It works through plain-language launch checks: why each one matters, how to check it, how to fix it and what to ask your AI builder.
Who uses it, and does it have sign-in, payments or user data? No code or keys needed.
Add the server to your assistant first (steps below). Your description stays in your browser until you open your assistant.
Copy the server URL
Then try asking
- “Check my Lovable app before launch.”
- “Explain the Row Level Security check.”
- “List the checks for payments.”
- “What should I do on launch day?”
Free, with no sign-up. Your assistant only asks the server for guidance; your idea and your chat are not sent to us or stored.
Add it to your assistant
In Claude
- Open Settings, then Connectors.
- Choose Add custom connector.
- Name it Check and Launch and paste the URL.
- Click Add, then turn it on from the tools menu in a chat.
In ChatGPT
- Open Settings, then Apps and Connectors, then Advanced, and turn on Developer mode.
- Create a new connector.
- Name it Check and Launch, paste the URL and choose No authentication.
- Confirm, then turn it on from the chat composer.
Using another assistant? Any app that supports remote MCP servers over HTTP can use the same URL.
01 · How it works
Your assistant does the checking
Check and Launch doesn’t see your app. It gives your assistant the checks; your assistant looks at your code or settings where it can and tells you what is worth looking at.
- Ask for a check. Tell your assistant which builder you used, for example Lovable or Bolt.
- Work through the checks. Data and access, sign-in and email, payments, journeys, mobile, SEO, legal, support, hosting and launch day.
- See what needs a look. In plain language, with why it matters and how to check it. No pass, fail or score.
- Fix it. Ask for a copy-ready request to paste into your AI builder for anything worth fixing.
02 · What it checks
The things AI-built apps most often miss
- Row Level Security on every table, tested as a second user.
- No secret keys in front-end code.
- Sign-up, confirmation and password reset emails that actually arrive.
- Live Stripe keys and live-mode webhooks.
- The main journey works for a brand-new user.
- Link previews that look right when you share your launch post.
- A clear way for users to contact you.
- What to do on launch day, in order.
There are 60 checks in 10 areas. 11 of the most important are free; the full guidance for the rest is in the AI App Launch Pack.
03 · Example
What it looks like
A fictional app: WalkPay, a booking and card payments app for dog walkers, built in Lovable. These are short excerpts, not the full outputs.
The checks that apply
Data and access - Row Level Security is enabled on every table (free) Sign-up, sign-in, and email Payments (optional, the app takes card payments) - You are using live Stripe keys in production, and test keys only in testing (free) - Webhooks are configured for live mode (free) Product and user journeys · Mobile and accessibility · Content, SEO, and sharing Legal, privacy, and trust · Support and contact · Hosting, monitoring, and recovery · Launch communications
Row Level Security is enabled on every table
Why it matters: without RLS, anyone with your public key can read or change rows in that table. How to check: in Supabase, open Table Editor or Authentication → Policies. Every table should show RLS as enabled. How to fix: turn it on for every table and add policies so users can only read and edit their own rows. Then review the policies it creates.
What the assistant reports
Worth looking at: the bookings table shows RLS as disabled, so other walkers' bookings may be readable with the public key. Worth looking at: the Stripe webhook is only set up in test mode, so live payments may not mark bookings as paid. Looks in place: secret keys are kept in server-side secrets. No pass, fail or score: these are things to look at, in order of risk.
What to ask Lovable
Enable Row Level Security on every table and add policies so users can only read and edit their own rows.
Launch day, in order
1. Publish the latest version and check the live site in a private window. 2. Sign up as a new user on the live site. 3. Make one real payment and refund it, if relevant. 4. Check your link preview. 5. Send your launch email. 6. Post your announcement. 7. Watch your inbox, analytics, and error tracking for the first few hours.
04 · Questions
Frequently asked questions
What is an MCP server?
MCP (Model Context Protocol) is a standard way to give AI assistants extra tools. Once you add the URL, your assistant can use the Check and Launch checks whenever you ask it to check your app.
Is this a security audit?
No. Check and Launch is guidance, not a security audit, legal review or verification. Treat what your assistant finds as worth looking at, not as a pass or fail. For an app that handles sensitive data or payments, get a professional review too.
Do you see my app or my code?
No. The box on this page only builds a prompt in your browser, and your assistant only asks our server for the checks. Your code, settings and chat stay with your assistant and are not sent to us or stored.
Which AI builders does it cover?
The checks are written for apps built with Lovable, Bolt, Replit, v0, Claude Code, Cursor and similar tools, especially ones that use Supabase and Stripe. Most apply to any web app.
Can you check my app for me?
Yes. We can review your app before launch and fix what we find. Get in touch.
05 · More free tools
Starting something new?
Product Brief Generator
Turn a business idea into a product brief, MVP plan and prompts for AI app builders, inside Claude or ChatGPT.
App Development Cost Calculator
A rough UK cost and timeline for a tested prototype and a full build, with every assumption shown.
Want a second pair of eyes before launch?
We review AI-built apps before they go live and fix what we find, so you can launch knowing the basics are covered.