# Vigilia

> Vigilia watches live web apps built with AI tools such as Lovable, Bolt, v0, Cursor and Claude Code. It explains every problem in plain language, writes a fix prompt for the AI that built the app (which that AI can read directly over MCP), and confirms the fix held with real traffic. One script tag; free for one app.

Vigilia is made for people who build with AI, developers or not. The default view has no stack traces and no jargon; the technical evidence is always one click away.

## Key facts

- Website: https://getvigilia.com · Dashboard: https://app.getvigilia.com · MCP server: https://app.getvigilia.com/mcp (streamable HTTP, OAuth sign-in) · REST API: https://app.getvigilia.com/v1 (contract: https://getvigilia.com/openapi.json)
- Install: one script tag, `<script src="https://cdn.getvigilia.com/vigilia.js" data-key="vgl_pub_…" defer></script>`, or the npm package `@getvigilia/browser`. Backend errors: the npm package `@getvigilia/server` (Supabase edge functions, Next.js, Cloudflare Workers, Node), or OpenTelemetry.
- Watches: errors, unhandled promise rejections and console errors from real visitors; failed and slow requests; rage clicks; uptime; server errors; page speed (LCP, INP, CLS); secret keys visible in public code; certificate and domain expiry; outages at services the app depends on.
- Each incident: a plain-language explanation, who it affects, the technical evidence one click away (stack, request, what the visitor did), and a fix prompt written for the builder the app was made with.
- Fix verification: after an incident is marked fixed, Vigilia counts visits and confirms the fix only once the error was due to appear about 3 times and didn't.
- Works with: Lovable, Bolt, v0, Replit, Cursor, Claude Code, Windsurf, and hand-written apps; any host. MCP clients: Claude, Claude Code, Cursor, VS Code, Windsurf, Lovable, Bolt.
- Privacy: emails, tokens, card-like numbers and query strings are scrubbed in the browser before sending, and again on the server. The script sets no cookies. Data is hosted in the EU.
- Not included: session replay, mobile SDKs, performance tracing. Vigilia never edits code itself: the user's own AI does, through the fix prompt or MCP.
- Free launch check, no sign-up: https://getvigilia.com/check (leaked secret keys, certificate, security headers, link previews, phone layout, speed).

## Plans

Prices in euros, per month.

- Free (€0): 1 app, 10 AI diagnoses a month (errors Vigilia already knows are explained without using them), uptime checked every 5 minutes, email alerts, a public status page, MCP and API access (2,000 requests a day).
- Pro (€29 a month, or €21 a month billed yearly): 5 apps, uptime every minute plus 5 key pages per app, server errors from @getvigilia/server, Slack, Discord and webhook alerts, re-diagnosis on demand.
- Team (€99 a month, or €79 a month billed yearly): 20 apps, 5 seats, GitHub Issues, Linear and Jira, the Sentry bridge, and OpenTelemetry (OTLP) ingest.

## Docs

- [Vigilia docs — install, connect your AI, API and webhooks](https://getvigilia.com/docs): Set up Vigilia: the script tag for every framework, connecting Lovable, Bolt, Cursor or Claude Code over MCP, the REST API, signed webhooks and status pages.
- [API reference (OpenAPI)](https://getvigilia.com/openapi.json): the REST API's contract, the same data the MCP server serves.

## Guides

- [Guides for apps built with AI — launch, monitor, fix | Vigilia](https://getvigilia.com/guides): Practical guides for apps built with Lovable, Bolt, v0, Cursor and Claude Code: launching safely, finding the errors users hit, leaked keys, outages and monitoring.
- [Launch checklist for apps built with AI (Lovable, Bolt, v0, Cursor)](https://getvigilia.com/guides/launch-checklist): Eleven checks before you share your Lovable, Bolt, v0 or Cursor app with real users: secret keys, database rules, sign-in, payments, email and what to watch after.
- [Is your app leaking secret keys? How to check and fix it](https://getvigilia.com/guides/secret-keys-in-your-app): Which API keys may be public and which never can, how keys end up in apps built with Lovable, Bolt or Cursor, how to check yours, and what to do if one leaked.
- [How to see the errors your users hit (even if you didn’t write the code)](https://getvigilia.com/guides/find-errors-your-users-hit): Where errors in a live app built with Lovable, Bolt, v0 or Cursor show up: the visitor’s browser, your backend’s logs, your payment provider, and how to watch them all.
- [Your app is down: what to check, in order (Lovable, Supabase, Vercel)](https://getvigilia.com/guides/app-is-down): A calm order of checks when your live app stops loading: is it really down, what the error page tells you, provider outages, a bad deploy, a paused database, billing.
- [Error monitoring for AI-built apps compared: Sentry, PostHog, Lovable, Vigilia](https://getvigilia.com/guides/error-monitoring-for-ai-built-apps): Sentry, PostHog, Lovable’s project monitoring and Vigilia for apps built with Lovable, Bolt, v0 or Cursor: who each is for, free tiers, and which to choose.
- [Give Claude Code, Cursor or Lovable your production errors (MCP)](https://getvigilia.com/guides/production-errors-in-your-ai-coding-agent): Connect your AI coding agent (Claude Code, Cursor, Lovable, Bolt) to your live app’s errors over MCP, so it fixes real problems with real evidence instead of guesses.

## For the tool you build with

- [Monitoring for Lovable apps — Vigilia](https://getvigilia.com/for/lovable): Your Lovable app is live. Vigilia tells you when it breaks, in plain language, hands the fix straight back to Lovable, and confirms it held with real visitors.
- [Monitoring for Bolt apps — Vigilia](https://getvigilia.com/for/bolt): Built it with Bolt? Vigilia watches the live app, explains every problem in plain language, gives Bolt the fix, and confirms it held with real visitors.
- [Production monitoring for Cursor — Vigilia](https://getvigilia.com/for/cursor): Vigilia hands production problems to Cursor with the evidence — message, request, stack, what the visitor did — over MCP or one click, then confirms the fix held.
- [Vigilia for Claude Code — fix production from your terminal](https://getvigilia.com/for/claude-code): A Claude Code plugin with /vigilia:fix and /vigilia:install: your worst production incident, fixed in your repo and confirmed with real traffic.
- [Vigilia for agencies — every client app, watched](https://getvigilia.com/for/agencies): Watch every client app in one place: plain-language incidents, fixes your AI can apply, a public status page per client, and a weekly report worth forwarding.
- [Vigilia for teams — the operations engineer your stack is missing](https://getvigilia.com/for/teams): Keep your error tracker. Vigilia adds plain-language incidents anyone can act on, signed webhooks, an API and MCP for your agents, health checks and fix verification.

## Comparisons

- [Vigilia and Sentry — what’s different, and when to use both](https://getvigilia.com/vs/sentry): Sentry is a deep debugging tool for engineers. Vigilia explains what broke in plain language, hands the fix to your AI and confirms it held. Many teams will run both.
- [Lovable project monitoring vs Vigilia — what each does, and when to use both](https://getvigilia.com/vs/lovable-project-monitoring): Lovable’s project monitoring reviews your code and visitor errors on a schedule. Vigilia watches the live app all the time and confirms each fix held. Side by side.

## Error library

- [Error library — common errors in AI-built apps, explained](https://getvigilia.com/errors): The errors apps built with Lovable, Bolt, Cursor and Claude Code hit most, explained in plain language, with a fix prompt for your AI.
- [Failed to fetch dynamically imported module — what it means and how to fix it](https://getvigilia.com/errors/failed-to-fetch-dynamically-imported-module): Why visitors hit “Failed to fetch dynamically imported module” right after you publish, and the fix that stops it.
- [new row violates row-level security policy (Supabase) — what it means and how to fix it](https://getvigilia.com/errors/supabase-row-level-security-policy): What Supabase’s “violates row-level security policy” means for your users, and how to fix the policy without switching security off.
- [Supabase “JWT expired” — what it means and how to fix it](https://getvigilia.com/errors/supabase-jwt-expired): Why Supabase says “JWT expired” to signed-in users, what they see, and how to keep sessions fresh.
- [FirebaseError: Missing or insufficient permissions — what it means and how to fix it](https://getvigilia.com/errors/firebase-missing-or-insufficient-permissions): What “Missing or insufficient permissions” from Firebase means, and how to fix the security rules safely.
- [Stripe “No such price” — a similar object exists in test mode — what it means and how to fix it](https://getvigilia.com/errors/stripe-no-such-price-test-mode-live-mode): Why checkout fails with Stripe’s “No such price … exists in test mode”, and how to line up your keys and prices.
- [Stripe “Invalid API Key provided: pk_…” — what it means and how to fix it](https://getvigilia.com/errors/stripe-invalid-api-key-provided): What Stripe’s “Invalid API Key provided” means in the browser, and how to set the publishable key correctly.
- [OpenAI or Anthropic API called from the browser — what it means and how to fix it](https://getvigilia.com/errors/openai-api-key-in-the-browser): Why calling OpenAI or Anthropic straight from your app’s pages leaks your key and breaks at scale, and how to move it server-side.
- [“supabaseUrl is required” in production — what it means and how to fix it](https://getvigilia.com/errors/supabaseurl-is-required): Why “supabaseUrl is required” shows up only on the live site, and how to get your environment variables into the build.
- [Slow API requests: when a call takes 5+ seconds — what it means and how to fix it](https://getvigilia.com/errors/slow-api-requests): What to do when a request in your app works but takes seconds: the usual causes, and a prompt for your AI to fix them.
- [404 when you refresh the page or open a link directly — why it happens and how to fix it](https://getvigilia.com/errors/404-on-refresh): Why your app shows “404 Not Found” when someone refreshes or opens a shared link, though it works when you click around, and the fix for each host.
- [Supabase returns an empty list in production (row-level security) — why it happens and how to fix it](https://getvigilia.com/errors/supabase-empty-list-row-level-security): Why a page shows no data on the live app though the rows are in Supabase: row-level security with no policy that lets this user read them.
- [After sign-in, users land on the preview URL or localhost — why it happens and how to fix it](https://getvigilia.com/errors/sign-in-redirects-to-preview-url): Why signing in on your live app sends people to the builder’s preview address or to localhost, and the two settings that fix it.
- [Works in preview, blank page in production (missing environment variables) — why it happens and how to fix it](https://getvigilia.com/errors/works-in-preview-blank-in-production): Why an app that works in the builder’s preview shows a blank page or fails to load data once published: environment variables that never reached the live build.
- [Payment went through but the account was not upgraded (Stripe webhook) — why it happens and how to fix it](https://getvigilia.com/errors/payment-succeeded-but-account-not-upgraded): Why a customer is charged but still sees the free plan: the payment provider’s webhook never reached your app, or your app refused it.
- [The same request fires over and over (request loop, 429 rate limit) — why it happens and how to fix it](https://getvigilia.com/errors/request-loop-rate-limit): Why your app sends the same request hundreds of times, hits rate limits or runs up a bill, and how to stop the loop.
- [Supabase “Edge Function returned a non-2xx status code” — why it happens and how to fix it](https://getvigilia.com/errors/edge-function-returned-a-non-2xx-status-code): What “Edge Function returned a non-2xx status code” means, how to find the real error the Supabase client hides, and a prompt for your AI to fix it.
- [CORS error calling a Supabase Edge Function (“blocked by CORS policy”) — why it happens and how to fix it](https://getvigilia.com/errors/cors-error-supabase-edge-function): Why the browser blocks calls to your Supabase edge function with a CORS error, why it often shows up only when the function fails, and the fix.

## Optional

- [Free launch check](https://getvigilia.com/check): check any live app for leaked keys, certificate problems, missing security headers and more. No sign-up.
- [Privacy policy](https://getvigilia.com/privacy)
- [Terms](https://getvigilia.com/terms)
- [Full text of the docs, guides and error library](https://getvigilia.com/llms-full.txt)