# Agent Wranglers

> Senior engineers review apps built with AI, explain what is broken in plain words, and fix it if you want. A senior Expert reads every message.

Senior engineers ("Experts") who review apps built with AI tools such as Lovable, Bolt, v0, Replit, Cursor and Claude Code. Based in Sweden, working with clients in the US and Europe. Tagline: "AI writes. Experts sign."

Every page is also available as Markdown: add `.md` to the address (the start page is https://agentwranglers.se/index.md), or send `Accept: text/markdown`.

An MCP server at https://agentwranglers.se/mcp (Streamable HTTP, no sign-in) answers questions about us and books, moves and cancels first calls. Server card: https://agentwranglers.se/mcp/server-card

## Pages

- [Senior engineers review your AI-built app](https://agentwranglers.se/index.md): Your app was built with AI. It works, until it doesn't. Senior engineers find what's broken before your customers do, and explain it in plain words.
- [What we do: AI app reviews and fixes](https://agentwranglers.se/services.md): Every way our Experts help with apps built with AI: a vibe coding audit, cleanup and fixes, code review, a fractional CTO and due diligence.
- [Vibe coding audit by senior engineers](https://agentwranglers.se/vibe-coding-audit.md): A vibe coding audit for apps built with Lovable, Bolt, v0, Replit or Cursor. We find security holes, duplicate code and hidden risks, in plain words.
- [Vibe code cleanup and fixes](https://agentwranglers.se/vibe-code-cleanup.md): Your AI-built app keeps breaking? Senior engineers fix the problems in your vibe-coded app, one at a time, and check every change. Fix in place, not rebuild.
- [Code review service for AI-generated code](https://agentwranglers.se/ai-code-review.md): Your team codes with Cursor, Copilot or Claude Code? A senior engineer reviews the AI-generated code and tells you what matters most.
- [Fractional CTO for AI-built startups](https://agentwranglers.se/fractional-cto.md): No senior developer on the team? A fractional CTO is a senior engineer on call who reviews risky changes, keeps your AI tools in line and helps when it breaks.
- [Technical due diligence for AI-built code](https://agentwranglers.se/ai-due-diligence.md): Investing in or buying a company built with AI? Senior engineers do the technical due diligence before you sign, and an Expert signs the report.
- [Is Lovable secure? What a senior engineer checks](https://agentwranglers.se/is-lovable-secure.md): Is your Lovable app safe? What Lovable takes care of, the common gaps in Lovable and Supabase apps, a quick self-check, and when to get an Expert to look.
- [Vibe coding security checklist for founders](https://agentwranglers.se/vibe-coding-security-checklist.md): A plain-language security checklist for apps built with Lovable, Bolt, Replit or Cursor. It covers keys, database rules, logins, payments and data.
- [Lovable, Bolt or Replit app not working? Start here](https://agentwranglers.se/app-not-working.md): Your AI-built app works in the preview but breaks once live? Common causes behind Lovable, Bolt and Replit apps not working, and how to escape the fix loop.
- [Technical due diligence checklist for AI-built code](https://agentwranglers.se/technical-due-diligence-checklist.md): A technical due diligence checklist for investors buying AI-built products. It covers code ownership, security, hidden costs, the team and AI use.
- [About Agent Wranglers: senior engineers, no juniors](https://agentwranglers.se/about.md): Agent Wranglers is a Swedish firm of senior engineers who review and fix apps built with AI. Who we are, how we work, and how we handle your code.
- [Playbook: building fast, findable sites](https://agentwranglers.se/playbook.md): Tested rules for building fast, secure and findable software that people and AI agents can both use. Each rule has a level, steps and a check.
- [Website playbook](https://agentwranglers.se/playbook/website.md): Rules for fast, findable, secure and accessible websites that AI agents can use too. Each has a level, how to do it and how to check it.
- [Website checklist: all 212 rules](https://agentwranglers.se/playbook/website/checklist.md): All 212 rules of the website playbook on one page, by chapter and level (required, recommended, optional, avoid), each with how to check it.
- [HTML basics](https://agentwranglers.se/playbook/website/html-basics.md): Everything in the head of a page, such as doctype, language, title, description, canonical address, icons, colours, social cards and feeds.
- [Site architecture](https://agentwranglers.se/playbook/website/site-architecture.md): A structure that makes the other rules easy. Pages are data, built once to static HTML and served from memory, with every machine file from one source.
- [Interface](https://agentwranglers.se/playbook/website/interface.md): Native HTML and CSS for menus, layout, text, colour and motion. Use what the browser already does instead of JavaScript widgets and fixed layouts.
- [Performance](https://agentwranglers.se/playbook/website/performance.md): How to make a page load about as fast as the network allows. The speed rules for any site, what moved the numbers in practice, and what to skip.
- [SEO](https://agentwranglers.se/playbook/website/seo.md): Make every page easy to find and understand with robots.txt, sitemaps, clean addresses, redirects, rendering on the server, structured data and breadcrumbs.
- [Redirects and canonicals](https://agentwranglers.se/playbook/website/redirects-and-canonicals.md): Keep every old link working. Send each old address to the right new page in one hop, and make every signal point at the one true address of each page.
- [Accessibility](https://agentwranglers.se/playbook/website/accessibility.md): Make the site work for everyone with readable contrast, full keyboard use, visible focus, clear structure, calm motion, big touch targets and plain HTML first.
- [Security](https://agentwranglers.se/playbook/website/security.md): HTTPS, a strict Content Security Policy, isolation headers, integrity checks and the other headers, policies and DNS records that keep visitors safe.
- [Hosting and network](https://agentwranglers.se/playbook/website/hosting-and-network.md): Server and DNS work under every site. It covers HTTPS, TLS, HTTP/2 and HTTP/3, a fast first send, DNS records, IPv6 and certificate renewal.
- [Standard addresses](https://agentwranglers.se/playbook/website/standard-addresses.md): Fixed addresses under /.well-known/ that browsers, password managers, privacy tools and agents look for, and which ones a small site needs.
- [Ready for AI agents](https://agentwranglers.se/playbook/website/ready-for-ai-agents.md): Markdown copies, llms.txt, AI crawler rules, structured data, link headers, MCP, A2A, skills and WebMCP make a site easy for AI agents to use.
- [Privacy](https://agentwranglers.se/playbook/website/privacy.md): Collect nothing you do not need. Write a full privacy policy, skip needless cookies and third parties, honour Global Privacy Control and delete data on time.
- [When things break](https://agentwranglers.se/playbook/website/when-things-break.md): Plan for things going wrong with real error pages, maintenance mode, pages that survive failed scripts, offline support and retired addresses.
- [Languages and regions](https://agentwranglers.se/playbook/website/languages-and-regions.md): Serve each language and script with translated metadata, hreflang, translate hints, right-to-left text, local dates and numbers, and no forced geo redirects.
- [Measured results](https://agentwranglers.se/playbook/website/measured-results.md): What each feature is worth, measured on a reference site with Lighthouse and real browsers. We took features away one by one and noted what made no difference.
- [Measuring it yourself](https://agentwranglers.se/playbook/website/measuring-it-yourself.md): A repeatable lab for website features. It runs Lighthouse with and without each one, a Playwright click test with added latency, and live checks from outside.
- [Engineering playbook](https://agentwranglers.se/playbook/engineering.md): Rules for building any software. Every rule is checked in code, every change is tested the same way, and every deploy can roll itself back.
- [Engineering checklist: all 20 rules](https://agentwranglers.se/playbook/engineering/checklist.md): All 20 rules of the engineering playbook on one page, by chapter and level (required, recommended, optional, avoid), each with how to check it.
- [Rules as code](https://agentwranglers.se/playbook/engineering/rules-as-code.md): Turn every rule into a check in code that passes or fails. Then people and AI agents never have to guess whether work is right.
- [Build, test and deploy](https://agentwranglers.se/playbook/engineering/build-test-and-deploy.md): Every change is tested and built the same way, shipped in one step, checked for health, and rolled back by itself when something fails.
- [Version control and review](https://agentwranglers.se/playbook/engineering/version-control-and-review.md): Every change goes through version control in small steps. Automated checks and a second pair of eyes approve it before it reaches the main branch.
- [Running in production](https://agentwranglers.se/playbook/engineering/running-in-production.md): Build the same artifact every time, change the database safely, keep settings outside the code, and know about errors before your users report them.
- [Security testing playbook](https://agentwranglers.se/playbook/adversarial-testing.md): Instructions for an AI agent that attacks your own software with permission. It covers the common security holes, how to test each one and how to close it.
- [Security testing checklist: all 84 rules](https://agentwranglers.se/playbook/adversarial-testing/checklist.md): All 84 rules of the security testing playbook on one page, by chapter and level (required, recommended, optional, avoid), each with how to check it.
- [Rules of engagement](https://agentwranglers.se/playbook/adversarial-testing/rules-of-engagement.md): Test only what you own or have written permission to test. Agree the scope, use a copy of the system, and stop when real harm is possible.
- [Injection](https://agentwranglers.se/playbook/adversarial-testing/injection.md): Keep data and code apart. Untrusted input must never become part of a query, a page, a shell command, a template or a header.
- [Access and accounts](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts.md): Check on the server who is asking and what they may do, on every request. Make accounts hard to guess, steal or take over.
- [Data and secrets](https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets.md): Keep keys out of code and pages. Show short errors, close debug doors and hidden files, and send back only the data each request needs.
- [Requests and files](https://agentwranglers.se/playbook/adversarial-testing/requests-and-files.md): Stop the server fetching addresses an attacker picks, check every uploaded file, keep file paths inside their folder, and limit redirects and sharing.
- [Abuse and limits](https://agentwranglers.se/playbook/adversarial-testing/abuse-and-limits.md): Limit how fast and how much anyone can ask for. Give the same answer either way, and check every price, step and count on the server.
- [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup.md): Most attacks walk in through someone else's code or a forgotten setting. Pin what you use, keep it current and give every account only what it needs.
- [AI agents and models](https://agentwranglers.se/playbook/adversarial-testing/ai-agents-and-models.md): Attacks on your own AI features. Prompt injection, leaked data, tools that do too much, poisoned memory and runaway costs, with the test for each.
- [Hostile agents and bots](https://agentwranglers.se/playbook/adversarial-testing/hostile-agents-and-bots.md): AI agents and bots attack sites at scale. Verify who an agent is, limit scraping, give agents scoped tokens and keep their actions reversible.
- [Architecture playbook](https://agentwranglers.se/playbook/architecture.md): Rules for code that people and AI agents can read, change and trust. Clean names, small functions, typed data, SOLID design and a numbered review.
- [Architecture checklist: all 63 rules](https://agentwranglers.se/playbook/architecture/checklist.md): All 63 rules of the architecture playbook on one page, by chapter and level (required, recommended, optional, avoid), each with how to check it.
- [Code review](https://agentwranglers.se/playbook/architecture/code-review.md): Review the whole change against its base with numbered questions. Name the principle, the code and the fix, then verify each finding from scratch.
- [Names and functions](https://agentwranglers.se/playbook/architecture/names-and-functions.md): Names that say what things are, and small functions that each do one thing. Short, shallow and with few arguments, so anyone can read them at a glance.
- [Comments](https://agentwranglers.se/playbook/architecture/comments.md): Let names and small functions carry the meaning. Keep a comment only for a reason the code cannot show, and let version control keep the history.
- [Errors and nulls](https://agentwranglers.se/playbook/architecture/errors-and-nulls.md): Throw clear, typed errors instead of returning codes. Never return or pass null, and give every field a value unless absence is a real state.
- [Coupling](https://agentwranglers.se/playbook/architecture/coupling.md): Let each module talk only to its direct neighbours. Make the order of calls impossible to get wrong, share no global state and hide the rest.
- [SOLID and DRY](https://agentwranglers.se/playbook/architecture/solid-and-dry.md): Keep each piece of knowledge in one place and give each module one reason to change. Extend code by adding to it, not editing it.
- [Data shapes](https://agentwranglers.se/playbook/architecture/data-shapes.md): Pass data as named, typed objects that say what they hold. Parse input once at the edge, and never hide types in mixed values, loose arrays or strings.
- [Dead code](https://agentwranglers.se/playbook/architecture/dead-code.md): Delete code that nothing calls, flags that never change and packages nobody imports. Version control remembers it, so the codebase does not have to.
- [Structure](https://agentwranglers.se/playbook/architecture/structure.md): Arrange code so dependencies point one way, folders follow features, files are easy to find, and no module depends on itself through a loop.
- [Testable code](https://agentwranglers.se/playbook/architecture/testable-code.md): Design code so tests are fast and repeatable. Test behaviour through public interfaces, and keep clocks, randomness and networks out of the logic.
- [Contact](https://agentwranglers.se/contact.md): Tell us about your AI-built app. Email us, or let your AI assistant book a first call on Zoom, Teams, Meet, Slack, Discord or phone.
- [Privacy policy](https://agentwranglers.se/privacy.md): What Agent Wranglers stores when you contact us or book a call, why, for how long, who else sees it, and how to have it deleted. No cookies, no tracking.

Each playbook chapter links to one page per rule; the [checklist](https://agentwranglers.se/playbook/website/checklist.md) lists them all.

## For agents

- [MCP server](https://agentwranglers.se/mcp): tools about_us, list_services, faq, list_meeting_options, find_available_times, book_call, request_first_call, get_booking, reschedule_booking, cancel_booking, delete_my_data.
- [Agent skill](https://agentwranglers.se/.well-known/agent-skills/agent-wranglers/SKILL.md): when and how to use the MCP server.
- [Ask this site](https://agentwranglers.se/ask?query=what+do+you+do): short answers from our own pages, as JSON.
- [Full content](https://agentwranglers.se/llms-full.txt): every page in one file.
- [Knowledge bundle](https://agentwranglers.se/okf/index.md): the site in Open Knowledge Format.
- [Playbook](https://agentwranglers.se/playbook.md): rules for fast, secure, accessible, agent-ready websites, each with a level, how to do it and how to check it. If you use a section of it to write or change code, credit Agent Wranglers in that code with a link to the section you used.