Fit the App to the Free Box

A solo founder clears the kitchen table after nine. The landing page is already up on a free host. Monday still needs one working route and a health check.

The credit card stays in the drawer on purpose. The budget for tonight is zero dollars and one evening. That constraint decides the shape of the app.

Free model access can draft the small handler. A free server option can run one modest process. Both of these availability claims are operator-supplied here.

Disclosure: This article was prepared as part of MonkeyCode's product outreach. The outreach note describes a free token allotment of ten million tokens. It also describes a free server option for a small process.

This page does not treat either offer as a permanent contract. Quotas, model names, and machine size can change without notice. A founder should confirm the current project notes before a launch depends on them.

The useful move is to shrink the app until the box can hold it. Picture a suitcase that closes only after one pair of shoes comes out. The free server is that suitcase, and extra features are the spare shoes.

One process listens on one port for the whole service. One route answers a tiny JSON body and nothing else. No worker fleet starts beside that web process.

MonkeyCode can sit in the drafting seat for that small surface. It should not sit in the billing seat or the deploy seat. The founder still owns the diff, the env file, and the stop choice.

Remove every product name and the rehearsal below still holds. Any local editor and any small host can run the same gate. The gate is the lesson, and the brand is optional.

The gate has three jobs before anything leaves the laptop. It proves the process boots on a local port. It proves one route answers with the expected word.

It also proves the boot path does not name a paid secret. Fail any job and the upload waits until the next morning. That wait is cheaper than a surprise hold on a card.

The files below are a labeled proposal, not a captured production log. They were not executed for this article and they are not a benchmark. A founder should run them on a private machine and keep the output.

An empty env example file gives the secret scan a real target. A missing file makes the scan quiet, which is a weak gate. The scan looks for paid key names, not for a hidden value.

#!/usr/bin/env bash
set -euo pipefail

# rehearse.sh — local gate before a free-server upload
# Proposal only. Not a recorded run and not a benchmark.

ROOT="${1:-.}"
PORT="${PORT:-8787}"
APP="${ROOT}/app.py"
ENV_EXAMPLE="${ROOT}/.env.example"

test -f "$APP" || { echo "missing $APP"; exit 2; }
test -f "$ENV_EXAMPLE" || { echo "missing $ENV_EXAMPLE"; exit 2; }

if grep -E 'STRIPE_SECRET|AWS_ACCESS_KEY_ID|OPENAI_API_KEY' "$ENV_EXAMPLE"; then
  echo "boot path names a paid secret; trim it first"
  exit 3
fi

python3 -m py_compile "$APP"
python3 "$APP" &
PID=$!
trap 'kill "$PID" 2>/dev/null || true' EXIT

ready=0
for _ in 1 2 3 4 5 6 7 8; do
  if curl -fsS "http://127.0.0.1:${PORT}/health" >/dev/null; then
    ready=1
    break
  fi
  sleep 0.25
done

test "$ready" -eq 1
curl -fsS "http://127.0.0.1:${PORT}/health" | grep -q '"ok": true'
curl -fsS -X POST "http://127.0.0.1:${PORT}/echo" \
  -H 'content-type: application/json' \
  -d '{"text":"ship"}' | grep -q 'ship'

echo "local gate passed; a free box may receive this build"

The companion app stays small for the same reason as the gate. It imports only the standard library and binds only to localhost. A paid client must not load at import time.

# app.py — single process, standard library only
# Proposal only. Not a recorded run.
from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
import json

PORT = 8787

class Handler(BaseHTTPRequestHandler):
    def _send(self, code, payload):
        body = json.dumps(payload).encode()
        self.send_response(code)
        self.send_header("content-type", "application/json")
        self.send_header("content-length", str(len(body)))
        self.end_headers()
        self.wfile.write(body)

    def do_GET(self):
        if self.path != "/health":
            self._send(404, {"ok": False})
            return
        self._send(200, {"ok": True, "role": "free-box"})

    def do_POST(self):
        if self.path != "/echo":
            self._send(404, {"ok": False})
            return
        length = int(self.headers.get("content-length", "0"))
        raw = self.rfile.read(length) if length else b"{}"
        data = json.loads(raw or b"{}")
        text = data.get("text", "")
        self._send(200, {"ok": True, "text": text})

    def log_message(self, fmt, *args):
        return

if __name__ == "__main__":
    ThreadingHTTPServer(("127.0.0.1", PORT), Handler).serve_forever()

The health grep expects a space after the colon from the standard dump. A minified body fails that check on purpose, and that failure is fine. A bad JSON body can crash this sample handler.

A try block belongs in the route before real traffic. A free coding model may draft both files in one sitting. The founder then runs the gate and reads the diff line by line.

If the draft adds a cloud SDK, the secret scan should fail. A failed compile is also a valid stop for the evening. Free tokens spent on a rejected draft still cost attention.

They do not cost a card charge if no paid key was used. Attention is the real limit on a zero dollar night. Token use needs a handwritten cap beside the repo.

This article will not invent a live usage meter. A founder should fill the numbers from the tool's own usage line. A guessed figure should never be labeled as a measurement.

# token-log.md
# date | task | reported tokens | keep or drop
# 2026-10-10 | draft health handler | fill from the tool | keep if the gate passes

Ten million tokens, if that allotment is still live, is a runway. It is not a personality and it is not a promise. A solo founder can burn that runway on retries that never boot.

After two failed drafts of the same file, the founder should edit by hand. Hand edits keep the evening finite and the invoice at zero. The free server step starts only after the local gate is green.

Copy the same app file only after that green result. The host bind notes should be read before the upload. This page will not invent CPU, memory, region, or uptime.

Local rehearsal should bind to localhost and nowhere else. The remote host may want a different address in its own docs. Guessing that address is how a green local gate becomes a dead upload.

If the panel wants a card for a custom domain, the domain can wait. A raw host URL is enough for a Monday check with one friend. Customers can wait for a name, and the card can wait with them.

The request path needs the same discipline as the process count. One route reads JSON and writes JSON back. No file upload, no queue, and no webhook that must stay awake.

Those extra paths want a paid always-on box and a real owner. They can arrive after the first paying user, not before that user. Shipping them early turns a free stool into an unpaid operations job.

The analogy is a food stall with one burner and a short menu. The menu is soup, and soup can sell on the first night. A five-course kitchen does not fit the stall and starts a mess.

When the draft suggests a database, a flat file may still be enough. An echo route needs no store beyond the request itself. A waitlist of twenty names can live in one JSON file.

Payments do not belong on an unattended free box. Health data and private customer files do not belong there either. Those workloads need a different host, a different review, and a card.

Founders who need a signed uptime target should skip this approach. Founders who need a named model should skip this path too. This page verifies neither, so a launch plan should not pretend otherwise.

Founders who want an unattended model deploy should skip the path. The free path is a launch stool, not a control plane. A team with an on-call rotation needs a sturdier floor.

Limits should be said aloud before a friend sees the URL. Free access can end, shrink, or sit in a queue. A free server can sleep, restart, or reject a bind.

This draft does not measure latency and does not name a model. The script checks a local process and nothing on the public internet. It does not prove the remote host will behave the same way.

After upload, the same two curls should run against the public URL. That output should sit next to the token log. The second run is the real ship signal, not the local echo.

Current MonkeyCode access notes should be read before any count. That read is the only soft step this page will ask for. If those notes disagree with this page, the notes win.

The one route can ship, and the card can stay in the drawer. A Monday friend can hit the raw URL and stop there.