Made by 1 person
+ AI.

Can you ship a production SaaS
in ~72 hours
for nearly $0?

No engineering team. No frontend dev. No backend engineer. No QA department. No dedicated DevOps. One person with product vision — and AI as the co-builder.

What has to work on day-1 to call it "production"

• ✓ Frontend — public site + dashboard + 5 locales + 193 country pages
• ✓ Admin — users, eSIMs, payments, reports, promo codes, audit log
• ✓ Backend — auth (Google + Telegram), sessions, payment intents, ledger
• ✓ Biller integration — clients, contracts, tariffs, traffic sync
• ✓ RSP integration — real SIM provisioning, status, device
• ✓ Crypto checkout — invoice, IPN, on-chain refund
• ✓ Security — bcrypt, 2FA, lockout, step-up, audit log
• ✓ SEO — sitemap, hreflang, IndexNow, meta editor without redeploy
• ✓ Backups — Litestream → R2, recovery tested
• ✓ Observability — health checks, error log, audit trail

What's actually live
in production right now

Figures as of 7 October 2026.

What did this actually cost?

How it came together

The part that turned out
to be more interesting

Everything above is still true — it shipped in three days. What follows is what happened after, and it is the half that surprised me: the product built by one person and an AI is now bought by AI.

Not "has an API". An agent can discover Roamzy, open an anonymous account with no human in the loop, check per-country rates, pay in stablecoin, receive the eSIM, and earn a referral share — without ever asking a person to fill in a form. That is a different product from the one this page originally described.

Figures as of 7 October 2026.

What was added

• Remote MCP endpoint — roamzy.io/mcp, 12 tools, reachable anonymously. Most MCP servers answer 401 until you bring a key; this one never does, because an agent that has to stop and ask for credentials is an agent that stops.
• An npm package — @roamzy/mcp-server, published, plus a listing in the MCP Registry that advertises the remote endpoint so there is nothing to install at all.
• OAuth 2.1 with dynamic client registration — for agents that do want an identity. Built, audited, live; the anonymous path stays the default.
• Referral for agents — an anonymous agent account earns a share of what it refers, forever. Machines are a sales channel, not just a user segment.
• A machine-readable layer — llms.txt, agents.json, an OpenAPI catalog and markdown content negotiation, so a model reading the site gets structure instead of scraped HTML.

What running it actually taught me

Shipping fast was the easy part. The expensive part was everything that only shows up once real money moves through the thing — and the honest lesson is that AI does not remove the need for rigour, it moves where the rigour has to live.

• Tests went from zero to 1623 across 148 files. Almost none of them were written up front. Each one exists because something specific broke, or because an audit proved a defect could come back silently — so the test encodes the bug, not the feature.
• Audits found what testing did not. Repeated adversarial passes — with one agent finding and a second one trying to refute the finding — surfaced a class of problem no amount of green CI would have: a balance write that silently overwrote concurrent top-ups, a refund that left a bonus spendable, a page that answered 200 while saying "not found".
• The worst bugs were invisible. Not crashes. An error handler registered a few lines too late, so for months the entire API returned raw internal messages and no exception ever reached the error log. Everything looked fine from the outside, which is exactly why it lasted.
• A gate that greps source code is theatre. One "money is refunded correctly" test passed happily against code with the refund call deleted — it was matching an import line. Mutation testing is the only way to know a test tests anything.

None of that contradicts the headline. One person plus AI really did ship this in three days. It is just that shipping was day one, and every day since has been about earning the right to keep it running.

The channel that turned out
to be the only one

Something shifted in the last week, and it is worth writing down honestly, because it was not what I expected.

The remote MCP endpoint is now in the official MCP Registry, on npm as @roamzy/mcp-server, and carried by Cline's marketplace, Smithery, Glama, LobeHub and mcpservers.org. A sixth locale — Chinese — went live across all 193 country pages and the entire blog.

Here is the part I did not plan. Every external link this site has ever earned came from that side: developer catalogues and GitHub. Not one from travel media. The machines found the product before the people did — which is either a distribution strategy or an accident, and I am still not sure which.