Frequently asked questions
67 straight answers about AI, no-code, and automation — for the rest of us. Each one is pulled from a full guide on the blog, linked below.
Agents: What They Are, Why You Need Them, and How They Work
- What is an AI agent in this newer sense?
- An agent used to be a long-running process that called tools you wrote by hand. In the newer sense, the agent is given an actual computer or sandbox where it can run commands itself, mostly through Bash, to do the work. You hand it a task and it figures out the steps on its own machine.
- Why do agents use Bash and old Linux tools?
- Once an agent has a computer, the fastest way to get real work done is the pile of small, focused Unix tools already installed on it, like grep, sed, awk, find, and ffprobe, plus Python. It glues them together with pipes instead of needing a custom tool written for every single job.
- What does a managed agent service give me that I would otherwise build myself?
- Sessions with history, a dashboard to watch runs live, shared memory across runs, sub-agents, a vault for secrets, connectors and MCP support, and batch processing. The genuinely hard part it handles is the wiring: events, timing, and race conditions between steps.
- Can you trust a non-deterministic agent?
- Not blindly. You use evaluations. You lock down the prompt, tools, context, and model, then test that combination across enough real examples to measure how consistent it is and what it costs. Then you pick the cheapest model that still passes.
- Do I need a RAG pipeline to process files with an agent?
- Often no. You can hand the agent a zip file or a large CSV and it will use Bash to open it and Python to parse it, with no separate ingestion or RAG pipeline for the simple cases. For a lot of file work the old command-line tools are enough.
- Where does the agent actually run, on my computer or in the cloud?
- In the cloud, on the managed service's sandbox, separate from wherever you host your website. Your site can call out to the agent through the web, a chat request, or a scheduled job, and the heavy work happens on that remote computer, not on yours.
Keep It Green: Testing Zapier SDK Code Without Hitting the Real API
- How do I test code that calls an external API without hitting the API?
- Intercept the network underneath your code. Every call goes out over HTTP eventually, so a tool like MSW (Mock Service Worker) can catch that request and answer it with canned data. Your code does not change and does not know it is being tested. No key, no real call, no flakiness.
- Why not just let the test call the real API?
- Because then it is not really a test of your code. It needs a real key, it costs a real call and can hit rate limits, it is slow, and it goes red when the network or the service has a bad moment. None of that means your code is broken, so it makes your checks lie to you.
- What is MSW and why use it over wrapping the SDK?
- MSW, Mock Service Worker, intercepts outbound HTTP requests and returns responses you define. You use it over wrapping the SDK when you do not want to restructure your code for testability. You mock at the network boundary that every call shares, so the code can stay exactly as the AI wrote it.
- How do I make sure a test never sneaks a real API call through?
- Turn on MSW's onUnhandledRequest set to error. If your code hits any endpoint you did not mock, the test fails and prints the exact URL it tried to reach. That way nothing escapes to the real network, and you get a list of every call your code actually makes.
- How do I get my AI to always write tests this way?
- Put the rule in your CLAUDE.md or a reusable skill. State that tests must never hit real APIs, must intercept HTTP with MSW, and must fail on any un-mocked request. The AI reads that file on every task, so it writes tests that way without you asking each time.
Green Means Ship: CI/CD for Vibe Coders Who Are Sick of Things Breaking
- What is CI/CD in plain terms?
- CI, continuous integration, means every time your code changes an automation runs your checks and tells you if something broke. CD, continuous delivery, means once those checks pass it deploys the change for you. Together they take the boring, error-prone parts of shipping and hand them to a script that refuses to ship anything broken.
- What is a regression and how does CI/CD help?
- A regression is when something that used to work breaks because of a new change. It is common when you vibe-code because you and the AI move fast and rewrite big chunks at once. CI catches regressions by running your tests on every change, so you find out before it goes live instead of after a user does.
- Do I still have to run database migrations by hand?
- No. A migration is the file that changes your database's shape, like adding a column. You put it in the same pull request as the code that needs it, and a GitHub Action runs it automatically when the change merges. Nothing manual, and re-runs are safe because it only applies migrations the database has not seen yet.
- Do I need a separate production branch or a deploy button?
- No. Your main branch is the live site. When code lands on main, it is live. The host watches main and redeploys on every merge, so there is no deploy button to click and no separate production copy to push to.
- How do I keep API keys out of my code when the pipeline needs them?
- Store them as GitHub Actions secrets and let the workflow hand them to the deploy. In this setup the Anthropic key gets written into Supabase Vault during the deploy and never lives in the repo. Anything named VITE_ is public by design because it ships to the browser, so real secrets never go there.
- Is it safe to let an AI open pull requests in my repo?
- Yes, when it goes through the same checks you do. The AI works on its own branch and opens a pull request, and that pull request has to pass typecheck, lint, test, and build before it can merge. The trust is in the checks, not in who wrote the code.
Build Your Application from Inside the Application 🤯
- How does dragging a feature card build the code?
- When you drag a card to Approved, a Supabase edge function triggers a GitHub Actions workflow. The action writes the code on a new branch, runs the full test suite, and opens a pull request. You review it and merge, and merging to main deploys it. The drag is the only manual trigger.
- Do you need to be a developer to run this?
- You review and approve pull requests while the AI writes the code. You do set the pipeline up once from the starter kit and wire two secrets, so some comfort with the tools helps. After that, building a feature is drag, review, merge. When something goes sideways, you describe the problem to the AI and let it get you unstuck.
- Where do the API keys and secrets live?
- Not in the codebase. The Anthropic API key is stored as a GitHub Actions secret, where the workflows read it at run time. Other secrets the app needs, like a GitHub token, live in the Supabase vault, encrypted. Neither is ever committed to git.
- What is DORA and why does it matter here?
- DORA (DevOps Research and Assessment) is the standard research on software delivery performance. Its core point is that you do not need to be perfect: aim to deploy on demand and recover quickly rather than avoid every failure. A modest failure rate that you fix fast still counts as elite. This pipeline lands near that target by default.
- Does deploying this way cause downtime?
- No. The new version does not go live until it is built and passing, and it does not take down the running one while it builds, so you get effectively zero-downtime deploys with no special setup. Because each feature is its own branch, you can also point a separate environment at a branch to preview it live.
Thoughts on using Supabase Edge Functions in SupaNet.io
- What is a Supabase edge function?
- A small piece of server code that runs on Supabase's infrastructure instead of a server you manage. Each function is a folder with an entry file, written in TypeScript on a Deno runtime, and once deployed it is served at its own URL. You add an endpoint by adding a folder, not by wiring up more routing and auth.
- Do Supabase edge functions replace your whole backend?
- No. You still write the feature logic, and there is plenty of it. What the platform absorbs is the undifferentiated 60 to 70 percent of a typical backend: routing, auth, authorization, realtime, storage, secrets, and cron. Those become configuration and declarative rules instead of code you own and debug. The app itself is still yours to build.
- What is Row-Level Security (RLS) and why does it matter?
- Row-Level Security is a Postgres feature, not a Supabase one, though Supabase makes it easy to use. You write one rule per table (for example, a row is visible if you own it or it is shared with your workspace) and Postgres applies it like a WHERE clause on every query, from any client. It is default-deny: until you write a policy, the API returns nothing. It matters because authorization moves from checks scattered across every endpoint to a single rule the database enforces, which removes the highest-severity bug class: a missed permission check leaking data.
- Are you locked into Supabase if you build on edge functions?
- Not really. Supabase is open source and self-hostable: Postgres, auth, storage, the edge-functions runtime, and the secrets Vault are all in the open-source stack, and the functions run on any Deno-compatible platform. The real trade is convenience versus control. The hosted platform's managed secrets, one-command deploys, and cron just work, while self-hosting means running that operational layer yourself. Which conveniences carry over changes over time, so check the current docs before depending on it.
- How do you deploy Supabase edge functions?
- You can deploy through the Supabase dashboard, the CLI, or MCP. In my setup deployment runs through GitHub Actions, so shipping a function is automated: I push and the action deploys it. One thing to know is that functions deploy on a separate path from the frontend, so it is its own step rather than riding along with the frontend deploy.
Make Your Own Headless Browser (And Let Any AI Use It)
- What is a headless browser and why would an AI need one?
- A headless browser is a real web browser (Chromium, here) running on a server with no window on screen. An AI needs one because a lot of the web only shows up after JavaScript runs, or after you log in. A plain web request just grabs the raw HTML shell and misses all of that. A headless browser actually loads the page like a person would, so the AI sees what you'd see.
- Why build your own instead of using a hosted browser service?
- Hosted services are great and I'd happily use one. I built my own for three reasons: it stays logged in to the sites I care about across restarts, it's mine end to end so I control the cost, and — the big one — I can point any AI system at it, especially by wrapping it as an MCP tool that every agent I build can share.
- How do you keep a headless browser logged in after it restarts?
- Store the browser profile — cookies and local storage — on a persistent disk (a Railway Volume in my case) and point the browser at that folder each time it launches. When the service restarts, it reads the same profile back and you're still logged in. The key detail is shutting the browser down cleanly on exit so the profile gets saved before the process dies.
- How does an AI actually drive the browser?
- Two ways. You can send a list of exact steps — go here, click that, fill this, give me the Markdown. Or you can send a plain-English goal like 'collect every product across all the pages' and let the AI decide the steps itself, looping until it's done. Both come back over a simple HTTP call, so any tool that can make a web request can use it.
- What's the point of wrapping it as an MCP?
- MCP is the plug that lets AI clients — Claude Desktop, Cursor, your own agents — discover and call a tool. Wrap the browser's HTTP API as one MCP tool and suddenly every AI you build can 'see the web' without you rebuilding that plumbing each time. One browser, shared by all of them.
Evals: How to Stop Guessing Whether Your AI Actually Works
- What is an eval for an AI prompt?
- An eval is a written test suite for your AI: a list of test questions plus a plain-English description of what a good answer looks like (a rubric). A tool like promptfoo runs every question against your prompt and shows you exactly which ones pass and fail, so you catch problems before your users do.
- Do I need to know how to code to run evals?
- No. You write a spec file — a plain-English brief describing the goal, your data, and what a good answer looks like — and a tool like Claude Code generates the prompt, the test questions, and the promptfoo test suite from it. Your job is deciding what good means; the AI does the fiddly parts.
- How do I run AI evals without paying for every test?
- Two levers: use a cheaper model as the grading judge (like Claude Haiku), or point the judge at a model running locally on your own machine with a free app like LM Studio. In promptfoo that is one small config block pointing at localhost. Iterate for free with the local judge, then do a final run with a stronger cloud judge before you ship.
Tools, Skills, and MCP — When to Use Which (Without the Headache)
- What's the difference between tools, MCP, and skills?
- A tool is a single action the agent can take, like searching the web or sending an email. MCP is a standard way to connect your agent to live external systems so those tools are available. A skill is a set of plain-text instructions that teaches the agent how to do a task the same way every time. MCP gives capabilities, skills give workflows, tools are the actual things it calls.
- Did Agent Skills replace MCP?
- No. Skills replaced MCP for some over-engineered cases, but MCP did not go away — it found its proper scope. Both adoption curves rose together. Skills are the guidance layer and don't execute anything themselves; MCP is the connectivity layer underneath. They solve different problems.
- When should I build a skill instead of using an MCP?
- Reach for a skill when the problem is consistency — you want a task done the same way every time, like your commit message format or a report procedure. Reach for MCP when the problem is connectivity — the agent needs to reach a live system like a database, GitHub, or your CRM.
- Do I need to be a developer to write a skill?
- No. A skill is just a markdown file with plain-English instructions and some required metadata (a name and description). A non-technical person can read, edit, or create one — or ask an AI to generate it.
Vibe Coding With Confidence
- Is a vibe coded site safe to put online?
- It depends on what it does. A static HTML file you host on a service like Railway and put Cloudflare in front of is pretty safe. The more your app does — logins, a database, saving people's data — the bigger the surface to think about. Nothing is unhackable, but you can be sensible about it.
- How do I host something I vibe coded without a lot of setup?
- Push your code to a GitHub repo, point a host like Railway at that repo, and it deploys on every push. You get HTTPS for free. You can add your own domain through something like Cloudflare after that.
- Do I have to learn GitHub to vibe code?
- Not deeply. Conceptually it's just where your code lives so a host can pick it up and deploy it. The AI can handle most of the GitHub steps for you — it helps to understand what it's doing, but you don't need to be an expert.
- How do I keep a user's data private in a vibe coded app?
- Use a real auth system (never roll your own) and turn on row level security in your database so people can only see their own rows. Supabase makes this approachable. Also be careful what you expose to the public-facing front end — anything prefixed for the browser is visible to users.
- Can my vibe coded app talk to other services without me wiring up all the credentials?
- Yes — this is where an SDK like Zapier's helps. It handles the integration and credential side so your app (or an agent you host) can sync with things like Google Tasks without you managing all the auth plumbing yourself.
How to Get Your Site Found — and Cited — by AI
- What is GEO and how is it different from SEO?
- SEO is about ranking in Google's list of blue links. GEO — generative engine optimization — is about being found and cited when someone asks an AI assistant like ChatGPT, Perplexity, or Claude. Same goal, new front door: you want the AI to find your content, trust it, and quote you with a link back.
- Do I need to be technical to set this up?
- No. Most of it is a few small text files and some behind-the-scenes labels on your pages. I described what I wanted and let AI do the building — my job was deciding what mattered. You can ask any capable AI assistant to add these to your site.
- What is an llms.txt file?
- Think of it as a menu written for AI — a clean, plain-text list of everything on your site, with a short description and a link for each page. It helps an answer engine quickly find the right page instead of guessing from your raw HTML.
- How do I get an AI engine to attribute content to me by name?
- Tell it who you are. Link your real profiles — LinkedIn, YouTube, GitHub, your newsletter — in your site's behind-the-scenes data so engines can recognize you as a known person and credit your work to you, not just to an anonymous page.
I moved my site's chat to Cloudflare — and let the AI build it
- Do I need to be technical to add an AI chat to my website?
- Not really anymore. The hard parts — the server, the streaming, the security wrapper — can be built by describing what you want to an AI. Your real job is the decisions: set a spending cap, lock it to your own domain, and keep it simple. The AI brings the speed; you bring the judgment.
- How do I keep an AI chatbot from running up a huge bill?
- Put limits in front of it. Use a per-person rate limit, a hard daily cap that stops all spending once it is hit, and a monthly spending limit set in your AI provider's dashboard. Those three together give you a bounded worst case instead of a surprise invoice.
- Can someone copy my chatbot and use it on their own site with my AI key?
- Not if you lock it down. Reject any request that is not coming from your own domain, and require a quick bot check (like Cloudflare Turnstile) on every message. That stops bots and stops people from lifting your widget onto their page to spend your credits.
- Do I need a vector database (RAG) for a chat that answers from my blog?
- Usually not to start. For a few hundred posts you can bundle a simple list of titles, summaries, and links and hand it to the model — it fits. Only reach for a vector database if your answers turn out too vague, and let that be a measured decision rather than a guess.
The careful way to add AI chat to your website
- How do I add a chatbot to my website without risking a huge bill?
- Use a setup that enforces a hard cost cap for you. When you hit your plan limit the chat simply stops responding instead of running up an open-ended bill. Setting that cap before you go live is the single most important step.
- Can someone copy my chat embed and use my AI on their own site?
- Not if you add a domain lock to the embed. Even if someone pastes your script tag onto their own page, it does nothing for them — the chat only works on the domains you allow.
- Do I need to be a developer to set this up safely?
- No. This careful version uses Zapier Chat, Tables, and a Zap to make your GitHub content chattable, and the two guardrails — the cost cap and the domain lock — take about ten minutes total.
Stop Copy-Pasting Reports: Let AI Handle Your Project Management Busywork
- How can I stop manually writing the same status reports every day?
- Build an automation that pulls from your project management tool and writes the reports for you — a detailed morning task list for the team, a polished weekly summary for leadership, and an end-of-day review of what is waiting. Each audience gets its own format, generated automatically.
- Do I need a separate automation for each report format?
- No. One system can produce several outputs from the same source data — the building team's detailed list, leadership's summary, and the end-of-day blocked-items report — each formatted for its audience.
- What does automating my reports actually save me?
- Hours every week of copy-paste grind, plus the mental load of reformatting the same information for different people. The reports just show up, written, formatted, and delivered.
Quick Dive: How to Use Split & Aggregate Nodes in n8n
- What do the Split and Aggregate nodes do in n8n?
- Split breaks an array or result into individual, loopable items. Aggregate combines multiple items back into a single payload you can send forward. They are the pair you reach for whenever you are working with lists of data.
- Why would I aggregate data before sending it to an AI model?
- So you call the model once instead of many times. Instead of hitting ChatGPT five separate times, aggregate the items and send them in one request — like asking it to summarize all your task items at once. It is cheaper and cleaner.
- When should I use Split versus Aggregate?
- Use Split when you need to loop over items one at a time and process each result individually. Use Aggregate when you need to bundle many items into one payload to send onward. Most real workflows use both together.
NOCODE Getting Started With N8N
- Do I need to know how to code to build automations with n8n?
- No, and that is the whole point. n8n is a no-code platform where you connect visual blocks. If you are an expert in your field but not in Python or JavaScript, you can still build the solutions you need.
- What are the basic building blocks of an n8n workflow?
- Three of them: triggers (what starts the workflow, like a new email, a sale, a form submission, or a schedule), flows (the brain that pulls and processes your data), and outputs (the action, like sending an email, posting to Slack, or updating a database).
- What can I automate with n8n as a beginner?
- Everyday repetitive work: pull data from a Google Sheet, update your CRM, manage tasks in Notion, let AI analyze information, then send a custom email or Slack message. Start with one task you are tired of doing by hand and build from there.
Coding Assistant With N8N and GitHub
- How can I get automated help reviewing my pull requests?
- Trigger an n8n workflow from a GitHub pull request that opens issues on that PR — catching the things you forget, like SEO or row-level security, and even running browser-based QA before you merge.
- What kinds of checks can this PR workflow run?
- Whatever you build as tools. The post includes a security workflow and an SEO workflow as examples, plus browser-use QA. Each one is a building block you can mix into the main workflow.
- Do I have to build this from scratch?
- No. There is a shared Gist with the main workflow and the example tools for security and SEO, so you can start from a working template and adapt it to your repo.