Changelog

New /shipped: a public wall of things people actually built after getting roasted. Each card links back to the verdict it came from, and shows who built it, what they built, the live URL / repo, and the ship date. Newest-first with a “shipped this month” toggle. No dead end — when the wall is empty it surfaces the top unclaimed high-tier verdicts with a “be the first” CTA instead of “nothing yet.” Every build gets its own /shipped/<id> page with an OG card.

It extends the claim flow, it doesn’t fork it: a claimed idea can now be marked shipped with a URL, a repo link and a 2-3 sentence write-up — same no-signup verification the claim board already uses (ship what you claimed, same handle). We fetch the submitted link once to confirm it resolves and isn’t a parked domain, and flag rather than block. Abuse reuses the existing /report path — no second moderation system.

Wired into the funnel: a “someone built this” strip on /result pages that have a shipped build, shipped builds injected into the matching /agent-for/<topic> pages, a “Roasted and shipped” README badge (reusing the existing badge SVG), and entries in the sitemap + per-result llms.txt. Still no signup, no paywall, no email capture.

Roast from your IDE without a token. The MCP server at /api/mcp used to require a bearer token — which killed the no-signup promise at the one surface where distribution is cheapest. It now has an anonymous tier: no token, no signup. Tools roast_idea, get_verdict, get_stats, and browse_explore, with tighter caps (3 roasts/hour, 10/day). A token still unlocks the higher web limits plus validate_idea / find_existing_agents.

Both tiers pass the same guard pipeline as the website (kill switch → daily cap → budget → burst → hourly → daily), so anonymous access can never run up spend — the kill switch cuts it too. MCP-minted roasts land in /explore and the homepage counter like any other, and /api/stats now reports mcp_completions so installs visibly restock the shelves.

Discovery doc now served at /.well-known/mcp/server.json (as well as /server.json) so registry crawlers and one-click installers find it — one source, both paths identical. The /mcp page is rewritten for a human deciding to install: anonymous snippets first, a 20-second demo, and the honest anon-vs-token limits table.

/roast <idea> in Claude Code. A one-install plugin: type your AI-agent idea and get the verdict tier, the agent-readiness score, the top OWASP-MCP risk, a savage one-liner, and a shareable /result link — without leaving the editor and without signing up. Also /battle <A> vs <B> for a head-to-head and /steal for the claim board.

It’s a distribution wrapper, not a second brain. The commands hit a new public endpoint (/api/plugin/roast) that runs the exact same verdict engine and guard pipeline as the website — kill switch → daily cap → budget → burst → hourly → daily — so plugin usage is governed like everything else, and plugin-minted verdicts are counted on their own (plugin_completions in /api/stats). Zero config: no token, no API key.

New /battle/bracket/<week>: a single-elimination bracket of the week’s build-worthy ideas. Each matchup is a real 1v1 Roast Battle — click “Fight this matchup” and the model calls it, winners advance, and a champion gets crowned (👑) at the top. Same engine and the same rate-limit / budget guards as every battle; the bracket just wires them into a tree.

Seeds itself from recent high-tier roasts (no signup, no picking), with a shareable bracket OG card, a machine-readable llms.txt feed, and a “Bracket of the Week” link on the home page and the battles hub. Fully- fought brackets get indexed; still-advancing ones stay noindex. Champions link into the Hall of Fame when they’re top-tier.

Every /result page now has a quiet opt-in: “Leave your email and I’ll take a real look.” A human (the person who built the roaster) reads it and emails you back — whether it’s worth building, what to skip, the fastest V0. One field, no signup, no list; it’s only ever used to reply about that idea.

Behind the scenes, the operator’s new-analysis email now leads with a lead-heat read (HOT/WARM/COLD from the verdict + how detailed and B2B the brief is), flags repeat submitters and traffic behind a corporate proxy/VPN (so the “location” isn’t taken at face value), and puts the signal in the subject line. Plus a daily digest of new leads and consult clicks.

Every /agent-for/<topic> page now opens with the real verdict split for that topic — N ideas roasted · X% told to ship · Y% already exist — computed straight from the corpus, and the “who’s in this space” list is ranked by how often each competitor is actually cited across those verdicts (with the count shown).

Sharper sharing: the per-topic OG card now shows the “X% told to ship” number, the X share prefill carries the real verdict, and each page adds Article structured data alongside the existing FAQPage/ItemList. Thin topics still stay noindex until they clear the real-data threshold. Still free, still no signup.

The result page had drifted into three overlapping booking prompts. They’re now one dismissible card, placed right after the verdict & kill-prediction, with copy that reads the room: “Verdict says ship it? Cool. I build these for a living — grab 20 min and I’ll scope it live, free.” for the build-worthy tiers, and “Verdict says don’t. Want a second opinion from the human who built the roaster?” for the kill tiers.

One button that opens the operator’s Cal.com in a new tab — no inline embed, no contact form, no email capture, no signup. The link is set by NEXT_PUBLIC_CAL_BOOKING_URL. The click is counted under a cta_click analytics channel (same lightweight beacon), so click-through vs. bookings stays measurable. Share buttons and the OG image are untouched. Still free, still no signup.

Each /agent-safety/<code> page now lists every idea that tripped that OWASP-MCP risk — a proper paginated card list, not just a handful of samples — and every card links straight through to its /result page.

Richer structured data on those pages: SoftwareApplication (marked free), ItemList of the flagged ideas, and a FAQPage answering what the risk is, how many ideas trip it, and how to mitigate it — all grounded in the real corpus, not a generic checklist.

On every /result page, all three OWASP-MCP risk chips now deep-link to their per-risk page (not just the top one), so a fresh roast feeds traffic into each risk surface. Still free, still no signup.

New /roastthis <idea> slash command for Slack and Discord. It replies right in the channel with the verdict tier, the readiness score, the top risk, and the “you’re the X% who…” framing — plus a button that opens the full /result page, so the link unfurls to the same share card everywhere.

Same engine as the website: every channel roast mints a real, shareable result page and runs through the same rate limits and budget guards. Requests are signature-verified (fail closed if a bot isn’t configured). Still free, still no signup.

Every verdict now has a “Download card” button that rasterizes a shareable card to a PNG entirely in your browser — nothing is uploaded, no server round-trip. Pick portrait (1080×1350, for stories & status) or landscape (1200×630, the same shape as the link preview). Saves as whycant-<slug>.png.

Same one-tap card on /battle (the losing side is dimmed) and /recap. It reuses the OG card’s own design tokens, so the saved image matches what X / LinkedIn / WhatsApp render as the preview.

Portrait was the piece the earlier Save card button (2026-06-27) deliberately skipped. Still no signup, no paywall — the image is generated on your device.

Every roast now ends with a “Ship It Anyway” wedge on /result/[id]: the one differentiator that isn’t already taken, the single riskiest assumption to test first, and the honest cost (plus who this is not for). It’s the roast that then dares you — generated in the same Claude call as the verdict, so no extra API round-trip, and persisted with the result.

The wedge rides the share card too: the per-result OG image (/api/og/[id]) now paints the differentiator in a “the version that survives” band, so the salvage plan is screenshot-native and travels with the link.

The section closes into the existing free 20-minute Cal.com scoping call, reframed as “pressure-test this wedge live” — no new form, no email capture, no signup. The wedge is also machine-readable in each result’s llms.txt and feeds the /agent-for/[topic] hub (a new “how do you build a {topic} agent that isn’t already dead” FAQ answer), so it’s a durable, indexable long-tail surface.

The /agent-for/[topic] long-tail pages rendered fine but were invisible: the index-gate (AGENT_FOR_INDEX_THRESHOLD) defaulted to 3 real matching ideas, and with the current corpus no topic cleared it — so every page was noindex and the sitemap listed zero of them. Dropped the default to 1: one real matching roast is enough differentiated content to index; genuinely empty topics still stay noindex and out of the sitemap.

New /agent-for hub that links every topic grouped by category, a “Browse by idea” shelf on /explore, and a footer link — so crawlers, LLMs, and humans finally have an internal path into the topic shelf (previously it had no inbound links).

The result-page scope CTA is now a one-click inline Cal.com booking (@calcom/embed-react): click “Book 20 min — free” and the calendar opens inline, themed to match the site. The embed is lazy — it loads only on click, so a normal result view pays zero embed cost and nothing blocks the page's ISR.

The booking notes are pre-filled with the result id + verdict tier (mirrored into Cal metadata), so the call context is attached to whatever lands in the calendar.

scope_cta_view + scope_cta_click beacons reuse the existing /api/analytics/share rollup (excluded from the share counter). The /api/contact consult form stays as an email fallback, now linked from the CTA. Added a non-conflicting Service JSON-LD for the free call.

Deterministic, no-PII variant assignment (lib/experiments.ts): a result's id hashes into an A/B bucket for the OG share-card framing eyebrow, and an anonymous localStorage bucket drives the homepage headline copy. Same input → same bucket, on server and client.

The existing beacons (/api/analytics/share, /api/views/[id]) now record the variant tag alongside each event — additive fields only, old payloads still work.

New auth-gated /admin/experiments reads share + view counts grouped by variant and shows share-rate with a two-proportion confidence note. Read-only; the numbers are exactly what's in the store.

New POST /api/webhooks registers a subscriber (target_url, events, optional result_id scope). Subscribe to verdict.created for every new roast, or near_duplicate.submitted to get told when someone submits a near-duplicate of an idea you're watching.

Deliveries are signed (X-Whycant-Signature, HMAC-SHA256 over the body) and retried with exponential backoff, dead-lettering after 6 failures. Targets are SSRF-checked — https only, no internal/metadata IPs, DNS re-resolved before every send.

GET /api/webhooks lists your subscriptions and DELETE /api/webhooks/[id] unsubscribes — both scoped by the signing secret we hand you at registration. No account required.

Every /result/[id] now states where its verdict ranks against the whole corpus — one roast-voice line under the badge, e.g. “Only 4% of ideas get this verdict. Frame it.” for SHUT_UP_AND_TAKE_MY_MONEY, or “You and 31% of everyone else. Congratulations on inventing the wheel.” for ALREADY_EXISTS. Pure distribution math over the existing verdict store — no new AI call.

The share card (/api/og/[id]) carries the same stat (“Top X% — told to ship”), so the percentile travels with every link. Existing OG images are cache-busted so platforms re-fetch the new card.

Home counter strip upgraded to the doctrine pattern: “{total} ideas roasted · {x}% told to ship · {y}% already exist”, sourced from the same 30s-cached distribution behind /api/stats.

New programmatic surface at /agent-for/[topic] — ~60 seed topics (e.g. customer-support, incident-triage, lease-review) each rendering verdict distribution, top-shared roasts, the best one-liner, and a competitor snapshot — all assembled at ISR time from real published analyses that keyword-match the topic. No boilerplate; every page is unique to its corpus.

Per-topic share row + schema.org ItemList + FAQPage JSON-LD + OG card reusing the existing /api/og/[id] route, anchored to each topic's featured (most-shared) result.

Indexability is gated, not unconditional. Topics below a threshold of three matching analyses render the “roast the first one” CTA but emit robots:noindex and are excluded from the sitemap. Promotion happens automatically on the next ISR pass once the corpus catches up. This is the helpful-content-update defense — we'd rather publish a dozen substantive pages than sixty thin ones.

The result page “Save” button now downloads the canonical OG card straight from /api/og/[id] instead of rasterising the hero <div> client-side. The file you save is now byte-identical to what X, LinkedIn, and Slack render as the link preview — same 1200×630 layout, same verdict colour, same radar. Removes the html-to-image code path from ShareBar and the dead heroRef plumbing that fed it.

On premium-tier verdicts (SHUT_UP_AND_TAKE_MY_MONEY, GENUINELY_BRILLIANT, ACTUALLY_NOT_BAD), an above-the-fold “Steal this idea →” secondary CTA next to “Try Your Own Problem” links straight to the claim board. Hidden on non-claimable verdicts so it never points anywhere useless.

Production-readiness odds, OWASP-MCP risk badges, and the governance checklist are now collapsed into a single “How this was generated” disclosure (<details>) below the fold — defaults closed. Trust and provenance information is still on every result, just not interrupting the verdict→share read. Nothing was deleted.

Verbose problem descriptions were silently failing — Claude's JSON response was being truncated at the 2048-token cap and falling through to a generic 500. Bumped the output ceiling to 4096, and truncations now surface as a 422 with a useful “try a shorter version” message instead of a black-box error.

/api/health public endpoint returning model pin, live count, and last-published timestamp.

Home page now shows a “last published” micro-stat alongside the running total. Repeat visitors can see the site is alive at a glance.

/api/stats now exposes live_count separately from total — the former counts only non-expired results, the latter is the all-time roast count.

Production-readiness odds on every result — a single number, with a governance checklist underneath that grades the idea against the real things that kill agent projects (cost modeling, eval harness, abuse surface, kill-switch posture).

“Honest variant” renderer for the readiness score — shows you why a 38/100 isn't the same flavor of 38 as someone else's 38.

Embeddable readiness badge — drop a one-line snippet on your site and it renders the verdict + score from your roast.

Per-result llms.txt at /result/[id]/llms.txt — a plain-text feed crawlers and LLMs can ingest without parsing our HTML.

Public ?explain=1 query param opens an inline rationale panel on result pages without forcing a separate route.

Sora-generated hero banner on the home page.

/result/[id] moved from force-dynamic to ISR (revalidate=86400) and wrapped in unstable_cache — every result is now CDN-cacheable. View-counting moved to a client beacon so it doesn't bust the cache on first paint.

F-N1 “Build this with” bootstrap on every result — one-click starter context for shipping the agent the verdict describes.

F-N5 OWASP-MCP threat badges on results that touch tool-calling surfaces.

generateStaticParams added to /result/[id] for genuine static prerendering.

F1 Agent-Readiness Score — the 0-to-100 number that gates the rest of the verdict UI.

F2 “Steal This Idea” claim board — public list of unbuilt agents anyone can claim.

Apex canonical unification, breadcrumb JSON-LD on every content page, sitemap dedup (was double-listing /explore/hall-of-fame and /hall-of-fame), audit CI on PRs.

Every secret rotated at its source and re-added to Vercel with the “Sensitive” flag set, in response to the 2026-04-19 Vercel env-var enumeration disclosure. See /security for the full incident timeline.

Admin endpoints moved off query-param auth to an x-admin-key header with constant-time compare.

Pre-commit gitleaks hook, GitHub Secret Scanning, and Push Protection all turned on at the repo level. URLs returned by the AI for competitor links are now validated (HTTPS-only, no credentials-in-URL, no IP literals, tracking params stripped) before rendering.