marketaiguide
bolt.new

Bolt.new

StackBlitz's AI builder that writes, runs, and deploys full-stack web apps inside an in-browser development environment, with an optional hosted backend called Bolt Cloud.

Free tier available; paid subscription tiers with token-based consumption billing and purchasable token top-ups. Proprietary Named by Claude in 1 list this week

How Claude rates Bolt.new.

Each score below is the model's own, on the rubric it wrote for that list, from what it already knows about Bolt.new. Nothing here is edited by us.

The best AI app builders

#9 this week, scoring 5.8 out of 10. Best for Rapid prototyping of full-stack web applications and MVPs by non-developers or developers wanting extreme speed.

Code Portability 4
While you can download code, applications often rely on the WebContainer environment and require significant work to run elsewhere.
Generation Quality 7
Generates functional applications quickly but code quality and architecture can be inconsistent for complex requirements.
Stack Flexibility 6
Supports multiple frameworks but limited to what runs in WebContainers, restricting some backend and database choices.
Iteration & Control 7
Good iteration through prompts and direct code editing in the browser, though debugging complex issues can be challenging.
Pricing Transparency 6
Pricing tiers are clear but the value proposition at higher tiers relative to alternatives is somewhat unclear.

Rank by week:

#7#9#9

Want a better score? How to improve your AEO.

Security headers

What Bolt.new's website sends to your browser.

Scanned 2026-08-25. Grade headers F, scoring 30 out of 100.

− No Content-Security-Policy, so no defence in depth against cross-site scripting
+ Strict-Transport-Security is set
− No X-Content-Type-Options, so MIME sniffing is not disabled
− No X-Frame-Options and no CSP frame-ancestors, so clickjacking is possible
− No Referrer-Policy, so full URLs may leak to third parties
− No Permissions-Policy, so powerful browser features are not restricted
+ Cross-Origin-Opener-Policy is set
− No Cross-Origin-Resource-Policy
+ No server-version or X-Powered-By disclosure

This is one narrow, automated check of the HTTP response headers on the vendor's own website. It says nothing about how the product itself is built, how it stores your data, or whether it has ever been audited. A good grade here is a small signal that somebody was paying attention.

Visit Bolt.new