Prompt to app releases, May 2026: a commit-level log from inside one tool
Most write-ups about what shipped this month in the prompt-to-app category are ranking lists assembled from press releases. This is the opposite. It is a chronological log of every meaningful change shipped at mk0r, one tool in this category, between May 1 and May 9, 2026. Each item names the file on disk and the commit you can verify it in. The last section places the slice in the broader category trend for the month.
In the first 9 days of May 2026, mk0r shipped the following:
- A scheduler MCP server so the in-VM agent can register Cloud Scheduler cron jobs without leaving the sandbox.
- A provisioning MCP server that lazily allocates a per-app Neon Postgres database and a Resend audience only when the current task needs them.
- An anonymous-user turn gate. Started at 2 turns on May 7, raised to 6 turns on May 8 after telemetry on staging.
- Replacement of the 21-day free trial with a subscription paywall on custom-domain publishing. Build and iterate stay free.
- Persistence of pending prompts across the sign-in redirect. Type, sign in, the prompt is still there.
- Mobile preview gating (no iframe mount until Vite is serving) and a string of mobile bottom-bar tap-noise fixes.
- Per-session locks to fix concurrent session-resolve races, and full inbound and outbound email logging.
Sources: git log on this repo (160 commits May 1 to May 9), the on-disk MCP files under docker/e2b/files/opt/, the agent API endpoints under src/app/api/agent/.
Why a release log instead of a ranking
A ranking tells you what an editor read on a launch page. A release log tells you what a maintainer decided was worth typing into a commit message at 11 PM. The two converge eventually, but in the short window of a single month they tell very different stories. The category was busy in May 2026: more autonomy for the in-app agent, less friction at the user's entry, and more honest billing gates that fire when a real cost begins. We wrote the log instead of the ranking because the log is the piece nobody else is going to write about us, and writing it forces us to be specific.
Today is May 9. Nine days into the month. The log is short on purpose. We will keep adding to it through the rest of May, week by week. If you bookmark this page and come back on June 1, the shape will be the same and the items will be more numerous.
Week of May 5: scheduling lands
The biggest change of the week was the scheduler. A prompt-to-app tool that can build a daily-digest UI but cannot actually run anything daily is a strange shape: the agent generates a route, the route compiles, and then it sits there. On May 5 we wired a full scheduling primitive in. The agent now has a tool it can call to register a cron job, and Cloud Scheduler does the firing.
The architecture is small enough to draw on a napkin: a JSON-RPC MCP server inside the VM talks to a Next.js API route on mk0r.com, which talks to Cloud Scheduler, which calls back into another API route that runs the job in the user's VM sandbox.
The May 5 scheduler architecture
Where to read it
The MCP server is docker/e2b/files/opt/scheduler-mcp.js (263 lines). It reads /run/mk0r-session.json to get the session key for the project, and posts every tool call to /api/agent/schedules on mk0r.com. The runner that actually executes a job inside a user sandbox lives at src/lib/scheduler-runner.ts (103 lines). The agent prompt is told to use the new MCP at commit 78abf0d5 in src/core/vm-claude-md.ts.
The anchor fact, copy-pasteable
If you only verify one claim on this page, verify this one. Open scheduler-mcp.js at line 5 and you will see const CREDS_PATH = "/run/mk0r-session.json". Open it at line 48 and you will see const url = apiBase + "/api/agent/schedules". That is the entire authentication and routing story for every scheduling tool the agent gets. No environment leak, no long-lived credentials inside the VM, no API key in plain text.
Week of May 7: anon turn gate, paywall flip, mobile gating
Three changes in the same week, all about the boundary between free and paid and between anonymous and signed in. Read in order: build is free, iterate is free, publishing to a custom domain is paid; an anonymous user gets a generous handful of turns before the sign-in step is asked for; nothing about the mobile preview is allowed to render before it is actually ready.
The previous gate was billing-shaped. A 21-day free trial that asked for a card up front. We removed it on May 7. The current gate is value-shaped: an anonymous user gets enough turns to see the agent do its thing, and only then is asked to sign in to keep going. The number of turns moved from 2 to 6 in one day after staging telemetry showed the smaller number was interrupting the first iteration cycle.
Week of May 8: lazy provisioning
The eager provisioning path created a Neon database and a Resend audience for every session, including anonymous ones that may never come back. That was a lot of free-tier capacity going to sessions that did not need it. The provisioning MCP at docker/e2b/files/opt/provisioning-mcp.js (279 lines) lets the agent provision on demand. The refactor in src/core/freestyle.ts (commit c954413f) defers the call until the running task actually needs a database or an email sender. The agent can still get them; it just has to ask. The new endpoint is src/app/api/agent/provision/route.ts.
The full release log, May 1 to May 9
Every shipped item with the file you can open and the commit you can blame. Bento because each item carries weight, not because the page needed a grid.
Scheduler MCP for the in-VM agent
docker/e2b/files/opt/scheduler-mcp.js (263 lines). The agent can now create, update, and run cron jobs on Cloud Scheduler from inside the sandbox by posting to /api/agent/schedules with a session key read from /run/mk0r-session.json. Shipped 2026-05-05 (commits ba35cbd1, 4696977c, 87e72b41).
Provisioning MCP and lazy backends
docker/e2b/files/opt/provisioning-mcp.js (279 lines). Replaces the eager-provision path that allocated a Neon Postgres and Resend audience on every session. Now the agent provisions only when the current task asks for it. Shipped 2026-05-08 (commits 80b6e91a, c954413f, 4742aa26).
Anonymous turn gate: 2, then 6
src/app/api/chat/route.ts. A non-signed-in visitor can build for N turns before the gate fires. We started at N=2 on 2026-05-07, raised to 6 on 2026-05-08 after staging traffic showed the gate was interrupting the first iteration cycle.
Publishing paywall replaces 21-day trial
src/lib/stripe-server.ts no longer carries TRIAL_DAYS. The publish modal now has a paywall step that resumes the publish flow after Stripe returns. Shipped 2026-05-07 (commits 917617c4, 91101c27, 2adf6e08, e8d97037).
Pending prompts persist across sign-in
Type a prompt while anonymous, hit the sign-in redirect, come back signed in, the prompt is still there ready to send. Shipped 2026-05-08 (commit a8c023d2).
Mobile preview gating and tap-noise fix
previewReady state plus health-polled iframe mount means the preview no longer shows up before Vite is serving on :5173. The mobile bottom bar no longer registers same-pane tap noise that was dismissing overlays unintentionally. Shipped 2026-05-07 to 2026-05-08 (commits 9da08692, 760888bf, 09041146, 47c33351).
Per-session locks on session resolve
src/core/session-resolver.ts. Two parallel requests trying to resolve the same session no longer race. Shipped 2026-05-05 (commit d541b8de).
Inbound and outbound email logging
Every Resend send and every parsed inbound reply is now logged to the project's database with thread linkage. Shipped 2026-05-05 (commit 630ccd7a).
What we tried and reverted
Two threads of churn deserve naming because they are the part a release log usually hides. The Firebase auth flow churned all day on May 8: popup, then redirect, then redirect with proxy rewrites, then setting authDomain to the current host (which triggered redirect_uri_mismatch from Google), then reverting authDomain to the canonical Firebase host, then ending the day on popup again. The lesson, written into project memory after the fact, is to keep authDomain on firebaseapp.com regardless of which host the app is served from. The other thread is the anonymous turn gate going from 2 to 6 in 24 hours. We could have gone slower, but the cost of the wrong number was visible in staging traffic the same morning we shipped it, so we shipped the new number the next morning.
If a release log only shows the wins, it is not really a log. Both reverts are in git log and both are reflected in the file headers of src/firebase/auth-provider.tsx today.
How this fits the broader category in May 2026
The pattern across prompt-to-app tools this month is roughly the same shape, even if the specifics vary. More autonomy at the agent layer (more MCP-style tools the agent can call, instead of more chat boilerplate). Less friction at the entry (fewer signup walls in front of the first build). Tighter mobile preview behavior (do not show the user a broken iframe). And honest billing gates that fire when a real cost begins, not at the front door.
We will not pretend to know exactly which competitor shipped what on which day. We do know the category-level direction because we read the release notes and play with the products ourselves. If you want a sourced map of the wider category, the two best aggregators we use are an LLM-release tracker at llm-stats.com and a vendor-release tracker at releasebot.io. Neither of those is mk0r-specific, and both update faster than any single tool's changelog.
Things this log will probably contain by May 31
We are bad at predicting our own roadmap, so this is short. Realistic candidates for the next three weeks: a saved-prompts primitive so the agent can recall earlier turns without rebuilding context; a per-app analytics surface (PostHog is already wired, the UI is not); the second iteration of the scheduler to support pause and resume; better handling of the slow first paint on the mobile preview when Vite is still booting; and a lot more typing into the publishing flow. The entries above will land here with their commit references when they ship, or they will not land at all and that will be its own data point.
Want a live tour of any item in the May log?
Pick a row from the bento above. We will open the file in the appmaker repo together, walk you through what changed, and try the feature in a live mk0r session on the call.
Frequently asked questions
Why is this written from one tool's vantage point instead of as a ranking?
Because rankings written from press releases tell you very little about how a tool actually behaves. A commit-level log tells you what its maker decided was worth shipping in a given week, in what order, and what they backed out of. That is the part you cannot fake. The trade-off is honest: this page is one tool's slice of May 2026, not the whole category. The closing section names a few category-wide patterns we think the slice fits, but if you want a 10-tool comparison sheet, this is not that page.
What is the scheduler MCP and why does it matter for prompt-to-app?
It is a small JSON-RPC server (docker/e2b/files/opt/scheduler-mcp.js, 263 lines) that the in-VM coding agent can call to create, update, list, and run cron jobs for the user's app, all without leaving the sandbox. It reads /run/mk0r-session.json for credentials and posts to /api/agent/schedules. Why it matters: a real app usually has at least one recurring thing (a daily email, a price refresh, a stale-data cleanup). Until this shipped, the agent could write the code for the job but not register it anywhere. Now the prompt 'send me a digest at 9am' actually wires Cloud Scheduler. The pattern (give the agent an MCP that talks to your own backend) is showing up across the category this month.
What does 'lazy provisioning' mean and how is it different from the previous behavior?
Until May 8, every new session pre-allocated a Neon Postgres database and a Resend audience whether you needed them or not, on the theory that the agent should have everything ready. Anonymous sessions hit that path too, which was wasteful. The May 8 changes (commit 80b6e91a for the MCP, c954413f for the refactor, 4742aa26 to allow it for anonymous sessions) flipped that to lazy: the agent calls the provisioning MCP only when its current task actually needs a database or an email sender. The before/after is in src/core/freestyle.ts and the new endpoint is src/app/api/agent/provision/route.ts.
Why move from a 21-day free trial to a subscription paywall on publishing?
The trial gated the wrong thing. Anyone could open mk0r.com and build something instantly with no account, which is the point of the product. The trial only kicked in when the user wanted to publish to their own custom domain, and 21 days of trial there was both more friction (a credit card up front) and slower revenue. On May 7 we removed TRIAL_DAYS from src/lib/stripe-server.ts, deleted the old trial-required page, added /subscription-required, and made the publish modal show a paywall step that resumes the publish flow after Stripe checkout returns. Build and iterate stay free. Publishing to a custom domain is the paid step.
The anonymous turn gate started at 2 turns and ended the week at 6. What happened?
We shipped the gate on May 7 (commit 77ed8be6) at 2 turns because that is enough for a non-signed-in user to see the product do its thing. The next day (May 8, commit 9f9063e6) we raised it to 6 because the staging telemetry showed the prompt-to-sign-in step was firing before the user had really seen anything load. Six turns lines up better with the typical first iteration cycle (initial generation, two or three quick edits, one polish pass). It will probably move again.
What broke and what did you back out of in early May?
The Firebase auth flow churned on May 8. We tried popup, then redirect, then redirect with proxy rewrites, then setting authDomain to the current host (which produced a redirect_uri_mismatch from Google), then reverting authDomain back to the canonical Firebase host, then ending the day on popup again. The relevant commits are in chronological order from 1bd8c2ff through 9f9063e6 if you want to read the day. The takeaway, recorded in CLAUDE.md, is to keep authDomain on firebaseapp.com regardless of host. The provisional sign-in lesson: an anonymous-friendly product needs the sign-in step to be invisible until the user has reason to care, and the best UX gates fire on the second-to-fifth turn of value.
How do I verify any of these dates and commit SHAs myself?
If you have a clone of the appmaker repository, run git log --since 2026-05-01 --until 2026-05-09 --oneline. The 160 commits include the feature work referenced on this page plus content updates. The two MCP servers are on disk under docker/e2b/files/opt/. The agent endpoints are under src/app/api/agent/. Each item in the log on this page names the file you can open and the commit message we tagged it with.
Is this page going to be updated through the rest of May 2026?
Yes. The dateModified field in the JSON-LD will roll forward as the rest of the month ships. We plan to add a section every Friday with the week's commits. If a feature ships and you are reading this on a date past the dateModified, that feature will be in a later revision. The shape (one section per week, with commit references) will not change.
What is mk0r and why is it the source of this log?
mk0r is a prompt-to-app tool. You open mk0r.com, type what you want, and a coding agent inside a real Debian VM builds it for you while you watch. There is no signup wall in front of building. Publishing the result on a custom domain is a paid step. Source is at /Users/matthewdi/appmaker on the maintainer's machine and the public page lives at https://mk0r.com. The reason this log exists is that we found it more useful to write what we actually shipped than to write yet another ranking of competitors.
From the same series
Other deep notes from the appmaker repo
The pre-warmed VM approach (April 2026)
What was already in the box before May happened. The toolchain layer the scheduler MCP plugs into.
Sentence to HTML app maker
The mode of mk0r that needs no provisioning at all. Useful context for why lazy provisioning matters.
Claude Opus 4.7 mobile prototype
The model the agent runs against. Pairs with the May log because the new MCPs only work because the agent can call tools reliably.
Open mk0r and try anything in the log. No account, no setup, no code.
Open a session