For people who are not engineers
Deploy a vibe-coded app
You described a tool to an AI, it built one, and it works. Now colleagues want to use it. This page explains in plain terms what happens when you put it on Brod, what is taken care of for you, and the few things that are still your job.
Put this on Brod as team-rota. Keep it private for now.
deploy_app
Done. It is at https://team-rota.acme.brod.sh (version 1). Only you and your workspace admins can open it.
What "deploying" means here
Right now your app lives on your computer. Deploying copies it to a server so it has a web address that works when your laptop is closed.
The hard part is usually everything around that: who can open the address, how they log in, where the data is saved, and where passwords for other services are kept. Brod handles those parts. You do not set up a server. The AI that built the app (in Claude, Claude Code, Cursor, Codex or another tool that supports MCP) sends the app to Brod and gets the address back.
Connect your AI tool once
Do this one time, then ask for deploys in plain words.
Add the connector
In the Claude app on the web or desktop: open Settings, then Connectors, then Add custom connector. Name it Brod, paste this address, add it, press Connect and sign in when the browser opens:
https://brod.sh/mcpOther tools
Follow the page for Claude Code, Cursor or Codex.
Ask in plain words
For example: "Put this on Brod as team-rota. Keep it private for now." The AI calls
deploy_appand gives you the address, as in the conversation at the top of this page.
What happens to your app
It gets its own HTTPS address.
Nobody else's app shares its data.
It starts private.
Only you and your workspace admins can open it. Anyone else who tries sees "App not found", as if nothing were there.
People sign in with Brod, not with your app.
They get a sign-in link by email, and one sign-in covers every app in the workspace. When someone is removed from the workspace, they lose access to every app on their next click.
Saved data goes into the app's own database.
This only works if the app has a small server part. Your AI can add one; the technical page has the instructions to paste.
What is safe by default
The usual worries, and what Brod does about each.
| Worry | What Brod does |
|---|---|
| "The AI might share it with everyone." | It cannot on its own. Opening the app to more people, or inviting someone, gives the AI a link that you have to open and confirm. |
| "My API key is in the code." | Ask the AI to move it into a secret. Secrets are stored encrypted and cannot be read back, by you or by the AI. |
| "A change will break it for everyone." | Once the app is live, the AI's changes go to a separate staging address first. You try them, then say "publish". |
| "I can't undo a bad change." | Every version is kept. Ask the AI to roll back and the previous version is live on the next page load. |
| "I don't know what happened." | Every deploy, access change and refusal is recorded in the app's log, and the AI can read it with get_logs. |
What is still your job
Brod controls who gets in. It does not check what the app does once someone is inside. A few things to know:
- Roles only work if the app uses them. Brod tells the app whether a person is an owner, editor or viewer. If the app shows everyone an Edit button and the server never checks the role, a viewer can still change things. Ask the AI to enforce roles on the server side.
- Staging uses the real data. The staging copy reads and writes the same database as the live app. Test with care.
- Rolling back restores the code, not the data. If a bad version deleted rows, going back to the old version does not bring them back.
- Choose the narrowest sharing that works. Named people or a group is safer than the whole workspace, and the whole workspace is safer than a password link.
Before you share it, the guide to taking a vibe-coded app to production covers the steps in order, and securing AI-generated apps explains the common mistakes in the code itself.
If Brod says it cannot run your app
Brod runs web pages plus small server code written in JavaScript.
What will not run as it is
If your AI built a Python app, a container, or something that runs jobs on a timer or sends email, it will not run here as it is.
What to ask for
Ask the AI to rebuild the server part as one JavaScript
fetchhandler; for a small team tool that is usually quick.If a deploy fails a check
The version that was already live keeps working.
Questions
Do I need to know how to code?
No, but you need an AI tool that can connect to Brod over MCP, and you have to read and confirm the sharing links it gives you.
Can people outside my company use it?
Yes, if you choose. You can invite someone as a guest to one app, or give the app a password so people can open it without an account. On brod.sh, a new free workspace has to wait 24 hours before using a password or making an app public.
Who else on my team can change my app?
People with the builder or admin role in the workspace can deploy and manage apps. Members use the apps shared with them, and guests only see the apps they were given.
Can I stop it without deleting it?
Yes. Ask the AI to pause it. Visitors see that the owner has paused the app, and paused apps do not count toward your plan's running apps.
Keep reading
- Vibe coding to productionHow to productionize a vibe-coded internal tool: data, sign-in, secrets, versions and rollback, logs and ownership, plus the limits of running it on Brod.
- Secure AI-generated appsThe security problems AI-generated internal apps share (hardcoded keys, no auth, open data, risky agent edits) and how running them on Brod closes each one by default.
- AI-generated appWhat an AI-generated app needs to run on Brod: static files plus optional JavaScript server code, size limits, staging, access, secrets, and what does not fit.
- Secure a vibe-coded appA checklist for securing an app built with an AI coding agent: secrets, sign-in, access, roles, staging, logs, outbound hosts, and what is still left to you.