whisk.run
Your agent can build it. Whisk makes it safe to run your business on.
Point your AI agent at one link. It ships a working app for your team — database, sign-in, file storage, the lot — on a platform that checks its work the way a good engineer would: nothing leaks, nothing breaks quietly, nobody sees what they shouldn't.
leave requests and lets me approve them.
That message is the entire setup. No forms, no config. Your agent signs you up with your work email and gets building.
How it goes
Say what you need.
Your agent reads Whisk's published Standard, starts from a working template — never a blank page — and iterates on live previews in seconds, as many rounds as it takes.
Whisk checks everything.
Every deploy runs the Gauntlet. Security holes block it outright. Sloppy work — permission rules that don't hold, tests that wouldn't catch a real bug — goes back to your agent as exact fix instructions, until it passes. No exceptions, no "looks fine to me."
You approve one thing.
Before anyone can see data, Whisk tells you in plain English exactly who could see what — "everyone at Acme can read leave requests — 214 existing records" — and waits. Sixty seconds, once. Then it's live.
Then it's real software
Your team opens yourapp.acme.whisk.page and signs in with their work email. That's the whole rollout. Every change is reversible in one step — data included. Every app exports completely, any time, to files you own. And the trust page in every app's footer shows exactly who can see what — it can't be wrong, because it's generated from the live rules, not written by anyone.
Don't take the agent's word for it
Agents are brilliant and overconfident. So Whisk never grades homework by asking the student. Before an app with roles goes live, Whisk seeds fake employees and directs your agent to break in with them. It grades the attempt from its own logs — not from your agent's report. By the time your agent says "done," Whisk has already checked.
What it catches
- A manager-only page the whole company could technically read → blocked before it ever went live.
- Tests that pass but wouldn't catch a real bug → sent back, with the exact tests to add.
- A function quietly calling an outside service it never declared → blocked.
- "Just add a notes field" that would silently delete old data → held for your OK, snapshot taken first.
For whoever pays
Private by default — a new app denies everyone until you approve access. Apps and their data export on demand. Ownership transfers when people move on. The apps your team comes to depend on automatically get stricter change controls. No lock-in, by design.
Works with any agent
Claude Code, or anything that can make a web request. Whisk teaches your agent as it goes — every response says where it is and what to do next — so there's nothing to install and nothing that goes out of date.
Paste the link. Ship something real.
whisk.run →