QuoteKit - From client brief to fixed-price proposal QuoteKit turns a short client brief into a fixed-price proposal in under a minute, with scope, exclusions, and a timeline. Clients accept through a private page without an account. The problem Writing a solid proposal can take hours. When the scope is unclear, clients question the price, and freelancers end up doing work they did not plan for. Most quoting tools focus on nice PDFs or invoice tracking. They do not help you decide what is included, what is not, and what the work should cost.

How it works You paste in a short client brief and choose a service type: Rescue, Audit, Build Sprint, or Custom.

QuoteKit generates a complete proposal with:

A project summary In-scope work Out-of-scope work Assumptions A delivery timeline A fixed price

Everything can be reviewed and edited before the proposal is sent. What I focused on

Reliable AI output AI responses are validated against a schema before they are saved. If the model returns incomplete or broken data, the response is rejected instead of creating a broken proposal.

Controlled pricing The model gets a price range for each service type, and the user reviews every price before sending.

Simple client acceptance Every proposal has a private client link. The client can review and accept it with their name and an optional note, without creating an account. Acceptance is recorded only once, and later attempts are ignored.

Clear scope boundaries The out-of-scope section helps with requests like "one more small thing." The proposal already shows what was not included, so the extra work becomes a change order.

Server-side plan limits Free accounts can create up to three proposals per month. The limit is enforced on the server, so it cannot be bypassed through the browser. The Pro plan costs $19 per month and includes Stripe Checkout, a customer billing portal, and webhook-based subscription syncing.

AI agent access QuoteKit can also be used by AI tools such as ChatGPT, Claude, and Cursor through an OAuth-protected MCP connection. Agents can list, read, and draft proposals for the signed-in user, and they can only access that user's data.

Security Every table uses row-level security, so users can only access their own records. The public proposal page does not read directly from the proposals table. It uses a database function that returns a fixed set of safe fields. Uploads are stored in separate folders for each user, and payment redirects are restricted to the app's own domain. A pre-launch security review found a profile permission issue and an open redirect. Both were fixed before release.

How I built it I built QuoteKit with Lovable. Then I did what a prototype usually skips before real users arrive: I added row-level security on every table, enforced the plan limits on the server, validated the AI output, and fixed the issues the security review found.

Stack Built with Lovable. React 19, TypeScript, TanStack Start, Tailwind CSS v4, shadcn/ui, PostgreSQL with row-level security, Stripe.

Skills: React, TypeScript, PostgreSQL, Stripe, Lovable, AI Integration, SaaS Development