Atlas / MCP servers / jonradoff / LastSaaS

LastSaaSCAUTION

Name: LastSaaS
Author: jonradoff

mcp/jonradoff/lastsaas

MCP server by jonradoff · ai agents · go · golang · Audited 2026-10-07

SaaS boilerplate/starter-kit in Go+React with Stripe integration, multi-tenant support, comprehensive features and AI-agent ready

Verdict

CAUTION

Grade

Trust score

87 /100

Exposed tools

—

Transport

stdio

License

MIT

Stars

173

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](https://github.com/jonradoff/lastsaas/actions/workflows/ci.yml) [](https://codecov.io/gh/jonradoff/lastsaas) [](https://goreportcard.com/report/github.com/jonradoff/lastsaas)

The last SaaS boilerplate you'll ever need.

LastSaaS is a complete, production-ready SaaS foundation built entirely through conversation with Claude Code. It gives you multi-tenant account management, authentication, role-based access control, white-label branding, Stripe billing, API keys, outgoing webhooks, a full admin interface, system health monitoring, credit-based usage tracking, and product analytics with telemetry — everything you need to launch a SaaS business, ready to customize for your specific product.

The bottleneck for building software isn't engineering capacity anymore — it's imagination. LastSaaS proves it: a single person with a clear vision and an AI agent can stand up what used to require a team and months of work. And because it was built with Claude Code, the codebase is fork-ready for agentic engineering — point an AI agent at it and keep building your product through conversation.

[Project Page](https://metavert.io/lastsaas)

Why LastSaaS Exists

Every SaaS product needs the same boring foundation: user accounts, teams, roles, authentication, admin dashboards, billing, usage limits, branding, webhooks, API keys. Historically, building that foundation meant weeks of plumbing before you could write a single line of your actual product.

LastSaaS eliminates that. Fork it, point an AI agent at it, and start building your product on top of a foundation that already handles:

Multi-tenant isolation with role-based access
JWT authenticat

Read from source at commit 4681db5b6a5dOBSERVED · 2026-10-07

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add frontend --env LASTSAAS_API_KEY=${LASTSAAS_API_KEY} -- npx -y [email protected]

claude-desktop

{
  "mcpServers": {
    "frontend": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "LASTSAAS_API_KEY": "${LASTSAAS_API_KEY}"
      }
    }
  }
}

Trust audit

CAUTIONgrade B · trust 87/100 Install with care. The audit found things worth knowing before you trust its output.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (9 observation(s))
Network: declared (6 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: none-found

Findings (12)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

backend/internal/api/handlers/webhooks.go:172

if ip.Equal(net.ParseIP("169.254.169.254")) {

Why it matters. cloud metadata endpoint: the classic SSRF credential grab

LOWInventory / provenance · inv.hidden_file · CWE-1104

.goreleaser.yaml

.goreleaser.yaml

Why it matters. hidden member outside the usual dotfiles

Fix. review its purpose