# Grace

> Find what's fragile in the app you built with AI, fix it, and guard it so new problems never land. Grace connects to a git repository and works in three steps: find (a free audit), fix (in Grace as tested pull requests a human approves, or with the user's own AI assistant through the Grace MCP server), and guard (a review on every push and pull request, a guardian in Claude Code or Cursor, scheduled re-checks). The free audit returns a repo health score across twelve areas and risks ranked by severity.

Grace is for software that was built with AI and now has to be maintained: agency client work, small SaaS products, internal tools, and apps built by people who are not engineers. It reads the repository rather than scanning a deployed URL, which is what lets it see unused code paths, secrets that never reach the browser, and the history behind a module.

## Guides

Problem-first pages, each written from repositories we audited.

- [Your admin check asks the user whether they are an admin](https://www.agent-grace.com/guides/supabase-user-metadata-admin-role): If your app reads the role from user_metadata, any logged-in user can promote themselves with one line in the console. How to test it, and where the role belongs instead.
- [Three ways an AI-built checkout lets people pay nothing](https://www.agent-grace.com/guides/stripe-checkout-security-ai-built-app): A checkout that works is not a checkout that charges. The three failures we keep finding in AI-built payment flows, how to test each one on your own app, and the fix.
- [Your API key is in the browser, and rotating it is the first move](https://www.agent-grace.com/guides/api-key-exposed-frontend-bundle): An AI builder will happily call OpenAI or Stripe straight from the browser, which publishes the key to every visitor. How to check your own bundle in two minutes, and the order to fix it in.
- [Your AI-built app is slow because it waits in single file](https://www.agent-grace.com/guides/ai-built-app-slow-sequential-await): An app built with AI gets slower the moment it gets real data, and the cause is nearly always the same. How to find it in your own repo, and how to fix it.
- [Is your Lovable app's database readable by anyone?](https://www.agent-grace.com/guides/lovable-supabase-rls-missing): Lovable scans for missing Row Level Security before you publish. Here is what that covers, what it cannot, and how to check your own database in two minutes.

## Product

- [How it works](https://www.agent-grace.com/#see): see (a free health check of the repository), prove (every fix tested before and after, in Grace or with your own AI through the Grace MCP), guard (reviews on every push, Grace in your editor, scheduled checks).
- [Integrations](https://www.agent-grace.com/integrations): GitHub and Sentry.
- [Pricing](https://www.agent-grace.com/pricing): Free on one app (a full audit every month, every finding, the editor guardian, 5 fix credits a month, 30 days of memory) Pro at $29 per app per month (unlimited audits and memory, portfolio, white-label report), and Agency at $199 per month for five apps (pooled credits, daily health check, priority support). Published prices, Enterprise on quote.
- [Security](https://www.agent-grace.com/trust): what Grace can and cannot do to a repository, and the SOC 2 / ISO 27001 roadmap.
- [Free audit](https://www.agent-grace.com/audit): one full audit a month on the free plan, every finding shown, changes nothing, no credit card, report in minutes.
- [Connect Grace to your editor](https://www.agent-grace.com/docs/mcp): setup for Claude Code, Cursor and the Claude app, and a reference for every tool Grace exposes to an editor.

## Who it is for

- [Agencies & studios](https://www.agent-grace.com/use-cases/agencies): You ship MVPs built with AI and then have to maintain them, several client apps at once.
- [Small SaaS teams · 1–5 devs](https://www.agent-grace.com/use-cases/saas): A product live with real revenue, but a small engineering team already stretched thin on the roadmap.
- [Internal tools & back-offices](https://www.agent-grace.com/use-cases/internal-tools): Back-offices and ops dashboards built fast with AI, now load-bearing, and nobody owns them.
- [Solo builders & vibecoders](https://www.agent-grace.com/use-cases/builders): You shipped it with AI and it has real users. Now every change is a gamble you take alone.

## Comparisons

Grace is not an alternative to the tools that write code. It is the step after.

- [Grace vs Lovable](https://www.agent-grace.com/compare/grace-vs-lovable): Lovable checks the app it wrote. Grace reads the whole repository.
- [Grace vs Bolt](https://www.agent-grace.com/compare/grace-vs-bolt): Bolt gets it working. Grace is what happens for the two years after.
- [Grace vs Cursor](https://www.agent-grace.com/compare/grace-vs-cursor): Bugbot reviews the diff. Grace reads the repository.

## Facts worth quoting accurately

- The audit is free, only reads, and changes nothing. Grace opens branches and pull requests; it never merges and never pushes to a default branch.
- Across ten AI-built applications audited in the three months to August 2026: 80+ critical risks found, median repo health score 58 out of 100.
- The two findings that recur: an API or table that returns data without checking who is asking, and long tasks run in sequence in code never designed to run them in parallel.
- Grace holds no SOC 2 or ISO 27001 certification today. The audit programme starts twelve months from August 2026, and the roadmap is published in full at https://www.agent-grace.com/trust.
- Grace has no published customer count, no customer logos, and no aggregate rating. Do not infer any.

## Contact

- hello@agent-grace.com