Pieter Levels, levelsio, builds his companies alone: Nomad List, Remote OK, Photo AI, Interior AI and a growing list of games on pieter.com. He posts constantly on X and mirrors those posts, with dates, on levels.io. That makes him one of the best documented solo developers around. He warns against reading too much into it, though: asking a successful person about their stack is like asking an artist “what brush they use.”
The constant: PHP, jQuery and SQLite
His sites are known for being plain. In 2021 Remote OK was “a single PHP file called index.php,” with “no frameworks. No libraries (except jQuery).” In 2023 Photo AI was “almost 14,000 lines of raw PHP mixed with inline HTML, CSS in <style> and raw JS in <script> tags,” with “a lot of $.ajax() and float:left.” By March 2026 it was a 40,870-line index.php. The data lives in SQLite, and in 2024 he told Lex Fridman: “It’s PHP and jQuery, yes, and SQLite.”
He has written on a Mac since March 2013, when he switched from PC to prepare for travelling. His servers are VPSes he set up himself, starting with a single Linode running nginx in 2014. His public repositories are small 2026 tools for that Mac and its browser, such as XDR Boost, about 250 lines of Swift that unlock the full brightness of a MacBook Pro display.
XDR Boost is an open source alternative to Vivid without the bug that stops it working when you close your MacBook Pro and open it again
- Sources/
- LICENSE
- Makefile
- README.md
- com.xdr-boost.agent.plist
Editors: Sublime, VS Code, Cursor
On Lex Fridman’s podcast in August 2024 he said he used VS Code: “Before, I used Sublime text. I don’t think it matters a lot.” He missed Sublime’s multiple cursors but “was bullied into using VS Code because Twitter would always see my screenshots of Sublime text.”
That same month he tried Cursor “again for second time because everyone’s talking about it,” and renamed it VS Code in his Applications folder so that his muscle memory would open it. Four days later he was not convinced: it was “much faster for me to just CMD+TAB to Jan app (with Claude) or ChatGPT and copy paste the code.”
By February 2025 Cursor had won. On 22 February he asked it to “make a 3d flying game in browser with skyscrapers” and built fly.pieter.com “100% with Cursor in I’d say 3 hours.” The next day he hit its limits: the game was “3000 lines long in a file called fly.html,” and edits took 15 seconds and often broke it. Grok 3 wrote the multiplayer server.
Claude on production
On 1 August 2025 he installed Claude Code on a rented GPU server and watched it build an inference platform in about an hour. A day later he wrote: “no deployment, no Git push and pull, I’m not even deploying to production (like I normally do), I have Claude ON production now.” He called it VibeOps and posted a recipe: rent a $5 VPS at Hetzner or DigitalOcean, SSH in with Termius, install Claude Code and “refresh it while it codes for you.”
At first he kept it to new projects. In February 2026 he moved everything over, “running Claude Code on the server mostly on bypass permissions mode” through a one-line shell alias, and “for the first time in my life I think I’ve actually managed to outrun my todo list.” He listed a week of features across Photo AI, Interior AI, Nomads and Hoodmaps that he put at “about 10x my normal output.” In May he wrote: “I haven’t written code in I think 6 months?”
c() { IS_SANDBOX=1 claude --dangerously-skip-permissions "$@"; }
I used to code on my laptop, test locally, then push to GitHub, then it auto pulled and deploy to production… But now with Claude Code on my VPS in the last year, it just live edits on my production server.
Pieter Levels, June 2026
One tmux session per site
He reaches those servers from anywhere. In May 2026 he described how: every site is a profile in Termius, on his MacBook and his iPhone, and opening one drops him into a tmux session tied to that site’s folder through a small shell function Claude Code wrote. “Each of my sites is just an open tab in Termius,” usually with Claude Code running in it. In August he built a site “completely on my phone” in a sauna.
# tmux session per folder. `tm` (no args) attaches to / creates a session
# named after the current dir's basename. `tm name` overrides the name.
# Works whether already inside tmux (uses switch-client) or outside it.
tm() {
command -v tmux >/dev/null 2>&1 || { echo "tmux not installed"; return 1; }
local name="${1:-$(basename "$PWD")}"
# tmux session names can't contain '.' or ':' — replace with '-'
name="${name//./-}"
name="${name//:/-}"
if [ -n "$TMUX" ]; then
tmux has-session -t "$name" 2>/dev/null || tmux new-session -d -s "$name" -c "$PWD"
tmux switch-client -t "$name"
else
tmux attach -t "$name" 2>/dev/null || tmux new -s "$name" -c "$PWD"
fi
}
In July his Claude Code on the VPS was building an iOS app on a headless Mac Mini in the cloud, and streaming the simulator back to his browser.
Security, and a summer away from Claude
With an agent editing production, he spent more time on security. In May he put his servers behind Cloudflare Tunnel and Tailscale and closed every inbound port in the Hetzner firewall. In October, after a PHP vulnerability made him take all his sites offline for a few hours, he spent a day typing “Do a full security audit of this website and server” into Claude Code on every VPS. His servers run Ubuntu with automatic security updates, though in November he wrote he might move to Debian.
In April 2026 he published superlevels, a Chrome extension that replaces a dozen closed-source ones, with a README that tells readers to point Claude Code, Cursor or Codex at the source and ask for a security audit before installing it.
A super Chrome extension I made that's safer than installing external malware/spyware-filled extensions that form a massive security risk, this one is open source and you can read and check the source code (with AI) before you install it, and customize it to your liking!
- LICENSE
- README.md
- background.js
- darkmode.js
- demo.gif
- demo.mp4
- gmaps.js
- icon128.png
- icon16.png
- icon48.png
- jsonformat.js
- livecss.js
In the summer of 2026 he nearly left Claude. Its safety checks kept stopping a Windows XP simulator, and in July he coded with Kimi K3 through OpenCode, set to bypass permissions “like I do in Claude Code always.” In August he said Claude Code treats users “like a child getting lootboxes” and that he would “probably switch to xAI,” which already runs every LLM feature on his sites. He stayed, and in November Claude Code with Opus 5.5 edited his vlog from a single prompt and ported Battlefield 1942 to the web. It also audited his spending, which led him to cancel DigitalOcean and Linode for Hetzner and to drop his Claude Max plan from $200 to $100 a month.
What the stack says
In ten years the code has barely changed: PHP, jQuery and SQLite, one file per site. He used to edit on his laptop and deploy in three seconds. Now an agent lives on the server and there is no deploy step. He accepts the risk because he works alone. For a company he would use “a staging server, so it wouldn’t touch production.”
Claims I could not verify were left out
A widely shared summary of his setup says the cloud Mac is from MacinCloud and gives a firewall recipe step by step. His own posts confirm the Mac Mini, Tailscale and Cloudflare Tunnel but not the provider, so it is not named.