// the find
mikehasa/golive-skill
Take your agent-built product live: hosting, database, domain, email, payments — on your own accounts. Open-source Agent Skill + zero-dependency Node CLI: detect → plan → approve → apply → verify. No GoLive account, backend or telemetry.
An Agent Skill (plus a zero-dependency Node CLI) that lets Claude Code or Codex provision real infrastructure for a vibe-coded app — hosting, DB, DNS, email, test-mode payments — using your own provider accounts instead of a hosted SaaS. It's for developers who've had an agent build an app and don't want to hand-hold it through Vercel/Supabase/Stripe dashboards one by one.
The approval model is actually designed, not just claimed: apply refuses without a specific plan id plus --yes, re-validates that plan's identity before writing (so a changed config invalidates a stale approval), and gates DNS/destructive/live-money actions behind separate --confirm flags. No hosted backend or telemetry — credentials and state stay local, which matters for a tool you're trusting with real account access. The VALIDATION.md split between 'live-tested' and 'mock-covered' is unusually disciplined for an alpha; most projects this new would just claim the feature works. Teardown only deletes resources it can prove it created (ownership proofs) and re-reads the provider afterward to confirm, rather than trusting its own state file.
The actual live-tested matrix is thin — two hosts, two databases, and most other 'supported' providers are guided best-effort flows with no verification guarantee, which is a big gap between the README's scope and what's been exercised. Credentials are stored in a plaintext file at 0600 outside the repo, not an OS keychain — a real liability for something meant to hold Stripe/Supabase keys. Rollback, a core safety feature for a tool writing to production, only works on Netlify because Vercel exposes no read of what's actually live — so half the supported hosts get a degraded safety net. The README itself is a 1000+ line changelog of hedges and caveats rather than documentation, which makes it hard to tell what you're actually getting without reading the source.