How Citare Was Vibe-Coded with Claude Code: Stack, Pricing and Costs

Citare shipped in 12 days. It has about 76,000 lines of TypeScript, 130 pages and 83 API routes (the server endpoints an app calls). Its builder, Ravi, says he has no traditional coding background. He built it with Claude Code, Anthropic's AI coding agent, on a plan costing $100–200 a month.

Citare is one of three live SaaS products he built this way. The other two are Prism, an AI gateway, and BatchWise, an Indian compliance marketplace. Together they total about 107,000 lines of code, according to his May 2026 review.

Revenue and user numbers are not public. This post is about the stack: what he used, what it costs, and who did what.

The stack, layer by layer

Here is what the review discloses. Where it does not say which product uses which service, the table says so.

The standout layer is MCP, the Model Context Protocol. It is a standard way to plug tools into an AI agent. With it, Claude Code does not just write code. It can deploy to Vercel, change the database and check GitHub itself.

Monthly cost

The disclosed cost is the AI plan. Ravi started on Anthropic's Max plan at $100 a month (5x usage). During Citare's 12-day sprint he moved to Max at $200 a month (20x usage). He argues that, at that price, Claude Code is cheaper than hiring any engineer.

By my own rough estimate, six customers on the $35 Pulse plan would cover the $200 AI bill. That is a low bar for break-even on tooling, though it ignores hosting and your own time.

Hosting, database and API costs are not disclosed. With four cloud providers in play, they are worth watching. Free tiers across several clouds can hide real costs until traffic arrives.

Why these choices

The review compares tools directly. His main reason for Claude is tool use. He found Claude better at running commands, watching the result and adjusting. His one-line verdict: "If I could only keep one tool in my stack, this is it."

He is fair about the alternatives. He found Gemini, used through Antigravity, about twice as fast for trivial edits. He says Cursor wins as an everyday code editor if you type code yourself. He also says GitHub Copilot is now outclassed. With GPT, a basic landing page took him a week.

The review does not explain why he picked Supabase or each host. My read: these are services with official MCP servers, so the agent can operate them directly. That is an inference, not his stated reason.

What the AI wrote vs what the human did

Claude Code wrote the code and ran the commands. Ravi's job was direction and memory.

Two files do a lot of work. CLAUDE.md is a short index that tells the agent where things live. what-i-did.md is a running log. Every feature shipped, bug fixed or decision made gets a one-line, timestamped entry. That gives each new session the context the last one had.

He is honest about the weak spots:

• Over-eagerness. The model sometimes starts executing before the plan is fully discussed.
• Loops. When reality disagrees with the model, it can keep retrying the same failing approach.
• No tab completion. It is not an IDE-style autocomplete tool.

The lesson for non-coders: your job shifts from typing code to steering. Plan first, keep a log, and step in when the agent repeats itself.

Pricing

Citare's public pricing, as of September 2026:

• Free: $0, 1 project, 50 keyword lookups a month.
• Pulse: $35/month, up to 3 projects, 14-day trial, no card needed.
• Pro: $119/month, up to 10 projects, MCP server and REST API.
• Agency: $299/month, up to 50 projects, white-label.
• Enterprise: custom, with SSO.
• Studio Concierge: a $600/month managed-service add-on.

Annual plans save 20%. Cancellation takes effect at the end of the billing cycle.

If you vibe-code this

A multi-cloud SaaS with an API, an MCP server and an AI agent holding cloud access has a wide surface. Check these:

1. Scope your agent's MCP access. An agent connected to Gmail, AWS and your database can do real damage if tricked. See MCP security tools and prompt injection.
2. Hash customer API keys. Store only a hash, and show the key once. The snippet below does this.
3. Keep secrets out of the repo. Four clouds mean four sets of credentials. See environment variables.
4. Turn on Row Level Security (RLS). It stops one customer's project data leaking to another. See Supabase RLS for vibe coders.
5. Rate-limit the public API. See API rate limiting.

import crypto from "crypto";

export function createApiKey() {
  const key = "ck_" + crypto.randomBytes(32).toString("base64url");
  return { key, hash: hashApiKey(key) }; // show `key` once, store only `hash`
}

export function hashApiKey(key: string) {
  return crypto.createHash("sha256").update(key).digest("hex");
}

Running an AI agent with access to your clouds and want the permissions and API keys reviewed? Email me at [email protected] for a security audit.

Key takeaway

Citare's stack is ordinary: TypeScript, Supabase and mainstream hosts. What is unusual is the setup around it. MCP servers let Claude Code operate the whole stack, and two text files keep it on track.

More case studies: vibe-coded apps making money. Before you launch: the vibe coding security guide.

Sources

• https://rikuq.com/blog/tools/claude-code-review/
• https://www.citare.ai/pricing
• https://citare.ai