MAVAMBO

My code, your code, our code, their code — it doesn't matter.JUST START BUILDING.

Windows 10 & 11 · 64-bit installer

See it work

Inside Mavambo

What you’ll be looking at all day.

Mavambo−◻×
Add rate limiting to the login endpoint.

The route is handled in auth/middleware.ts, which already wraps every request, so the limiter belongs there rather than on the route itself.

I’ll use a token bucket keyed on IP and account, since keying on IP alone lets one attacker lock out a shared office, and cover both cases with tests before touching login().

Ask Mavambo to build, explain, or fix something…
+your model ⌄High ⌄User approval ⌄↑
Mavambo−◻×
Add rate limiting to the login endpoint.
WRITINGTool · read_file — auth/middleware.tsReviewing new evidence and deciding the next step…Tool · write_file — auth/rate-limit.tsTool · run — npm test -- auth
▾ Evidence
Changed files: auth/rate-limit.ts, auth/middleware.ts
Ask Mavambo to build, explain, or fix something…
+your model ⌄High ⌄Auto ⌄
Mavambo−◻×
Where did the audit log session spend its tokens?

Most of it went on reading audit/ — 47 files, 186k tokens across nine turns. The remaining 18k was the write and its tests.

▾ Evidence
Session: audit log · 204.6k tokens · $1.42
Ask Mavambo to build, explain, or fix something…
+your model ⌄High ⌄User approval ⌄↑
Mavambo−◻×
Use the same limiter for the signup route.

The signup route is behind a different middleware chain, so the limiter would never run there without moving it.

NEEDS YOUR DIRECTION

Moving it changes behaviour for three other routes. Tell me to proceed, or point me at a narrower fix.

Ask Mavambo to build, explain, or fix something…
+your model ⌄High ⌄User approval ⌄↑

Why this one

An agent you can actually leave running.

01

Nothing to install first

Mavambo carries its own Python. No runtime to match, no version to pin, no environment to repair. Install it and it works.

02

It asks before it acts

Every command it wants to run and every file it wants to write stops and waits for you — until you tell it not to. Approval or Auto is a dropdown in the composer, switchable mid-session.

03

You watch the meter

Live token and cost tracking on every session, turn by turn. On DeepSeek it also meters what is left of what you topped up. You never find out afterwards.