# Infrastructure & Self-Hosting Deploy AI apps for under $10/month. Hetzner VPS, Coolify, Vercel, Cloudflare. Security hardening, CORS, server setup. Includes API monitoring and log dashboard. ## Apps (1) ### Security Checklist for Web Apps - App: https://www.tigzig.com/security - AI Docs: https://www.tigzig.com/ai/apps/security-checklist.md - Interactive, implementation-focused security checklist for full-stack web applications. 100+ items across 10 sections covering React frontends, FastAPI backends, Postgres/DuckDB databases, Cloudflare edge protection, infrastructure, MCP servers, server hardening, and authentication. Each item explains the risk in plain English and shows the fix as working code. Built from real production hardening of 20+ microservices. ## Blog Posts (65) - [Sophisticated Attacks No Longer Require Sophisticated Attackers. Anthropic's September Threat Intelligence Report, and What I See in My Own Logs.](https://www.tigzig.com/post/anthropic-threat-intelligence-cyber-sep2026) - Tags: security, ai-coders A 13-page deck on the cyber operations section of Anthropic's September 2026 threat intelligence report. A Russian espionage group left its AI rewriting malware until no security product could detect it, one operator downloaded 1.8 million phone apps to read the credentials developers had left inside them, and a third built a loop that reads a security product's code and keeps writing attacks until one works. The ways in are the familiar ones, stolen credentials, unpatched gateways, exposed services, SQL injection and phishing, and the difference is speed and scale: one break-in ran from a stolen developer login to full administrative control of a cloud in about three hours. Plus hotel guest wifi turned into a malware delivery system, and what has changed in my own edge logs since January. AI-readable: https://www.tigzig.com/ai/posts/anthropic-threat-intelligence-cyber-sep2026.md - [Four Warnings About AI and Cyber Risk Arrived Inside Three Weeks. I Am Now Spending More Time Securing Than Building.](https://www.tigzig.com/post/four-warnings-ai-cyber-risk-sep2026) - Tags: security, ai-coders Four warnings on AI and cyber risk landed within three weeks: Google Threat Intelligence Group, a joint advisory from the NSA, CISA, FBI, Department of Energy and EPA, the Financial Stability Board chair's letter to the G20, and a departing OpenAI and Anthropic researcher. Set against nine months of running 40+ no-auth public tools behind Cloudflare, where volume and sophistication both rose. Nine-slide deck, each warning quoted from the document itself. AI-readable: https://www.tigzig.com/ai/posts/four-warnings-ai-cyber-risk-sep2026.md - [Pulling Tigzig Data Through the API? There Is a Second Way In. The Whole Database Is Published for Download.](https://www.tigzig.com/post/tigzig-whole-database-downloads-aug2026) - Tags: database-ai, infrastructure Every Tigzig dataset is downloadable in full, alongside the live API, so a tool builder can put their own micro-service in front of the data or analyze it offline without an API dependency. Covers the mutual fund NAV master with 37 million records back to 2006, ball-by-ball cricket for men's Tests, ODIs and T20s with 6,900+ matches and 3.8 million deliveries, 300+ macro indicator series across the US, India, Europe and the OECD, and the India red-flag datasets covering related party transactions, insider trading, pledges, credit ratings and surveillance. Take one table as parquet or CSV or the whole thing as a single DuckDB or SQLite file. Each dataset publishes a manifest at /downloads/manifest carrying the generation timestamp, file sizes and row counts, so a scheduled job can skip a download when nothing has changed. AI-readable: https://www.tigzig.com/ai/posts/tigzig-whole-database-downloads-aug2026.md - [Getting Errors on the Tigzig APIs? Is It You, or Is It Me? Now You Can Just Go and Look.](https://www.tigzig.com/post/tigzig-api-status-page-aug2026) - Tags: infrastructure, database-ai A public status page for the Tigzig APIs is now live at status.tigzig.com, so a caller hitting errors can tell whether the fault is theirs or the service's. It covers the MF NAV API, the Yahoo Finance API, the Vigil and Tremor APIs and the Cricket Database MCP on both Postgres and DuckDB, with 90 days of uptime history per service, a banner for incidents and a note at the top during an outage. Alerts reach the operator within a minute or two. The page is served from object storage through a Cloudflare Worker, so nothing on the public path touches the server it monitors. Also links the API hub, the machine-readable catalog for agents, the bulk downloads and the error-pattern guides. AI-readable: https://www.tigzig.com/ai/posts/tigzig-api-status-page-aug2026.md - [T20 and ODI Ball by Ball Are Now on Both Engines, Postgres and DuckDB. Run Your SQL Directly on My Server.](https://www.tigzig.com/post/db-mcp-both-formats-both-engines-aug2026) - Tags: database-ai, mcp-servers Both formats now sit on both engines: T20 and ODI ball-by-ball are queryable on Postgres and on DuckDB, so a query no longer has to follow the format to a particular engine. Free, no auth and no key, refreshed twice a day, and open to the kind of work the data is actually for, strike rates against pace versus spin, run rates through the death overs, head-to-head records across a decade, dismissal patterns by bowler type and home-away splits by venue. Postgres has moved off a managed instance onto self-hosted hardware and is much faster for it. Also what the guards refuse and why schema discovery is deliberately left open, and a note that any Claude, ChatGPT or Gemini subscription already includes a desktop agent that can fetch and analyse this over plain HTTP without MCP. AI-readable: https://www.tigzig.com/ai/posts/db-mcp-both-formats-both-engines-aug2026.md - [Four Days of an Open SQL Endpoint. What Real Cricket Queries Needed, and the SSRF Someone Found in the First Couple of Hours.](https://www.tigzig.com/post/db-mcp-four-days-ssrf-query-guards-aug2026) - Tags: database-ai, security Four days after opening a keyless SQL endpoint over ball-by-ball cricket data, 650+ successful calls split into two kinds of traffic: real cricket analysis and exploitation attempts. Reading what callers were actually refused showed two guard rules were turning away about 62% of legitimate queries, with the join limit set so low that ordinary two-table work broke and schema discovery blocked outright, so the guards were reworked and the errors now say what to fix. Separately, an SSRF found within the first couple of hours succeeded because read-only database connections had external access left on; caught in monitoring about ten minutes later and closed inside the hour, with the engine hardened since. Also what analysts are doing with it, the documented query limits, the two schema traps that make counts fail to reconcile, and a fuller account of how the SSRF ran. AI-readable: https://www.tigzig.com/ai/posts/db-mcp-four-days-ssrf-query-guards-aug2026.md - [A Database Server With API and MCP You Can Point an AI Agent At, With Ball-by-Ball Cricket Behind It.](https://www.tigzig.com/post/db-mcp-cricket-ball-by-ball-api-aug2026) - Tags: database-ai, mcp-servers A free database server on TigZig exposing read-only SQL over two engines through both a REST API and an MCP connector, with men's international cricket ball-by-ball data behind it, refreshed daily. ODI runs on Postgres and T20 on DuckDB under the same column names, covering about 1.36 million ODI deliveries from 2002 and 786 thousand T20 deliveries from the first men's T20 international in February 2005, across roughly 6,000 matches, with a wider match table that also carries Tests. No sign-up, auth or key. Notes on the security work that open SQL demands, why the limits are per IP, and why the error responses hand back the real schema and a worked call so an agent can correct itself. Data from Cricsheet, pipeline in live testing so treat it as provisional. AI-readable: https://www.tigzig.com/ai/posts/db-mcp-cricket-ball-by-ball-api-aug2026.md - [Range Requests on the MFPRO NAV File Are Fixed. DuckDB and Polars Queries No Longer Get Refused Midway.](https://www.tigzig.com/post/mfpro-range-requests-duckdb-polars-aug2026) - Tags: mutual-funds, duckdb, infrastructure HTTP range requests against the free MFPRO India mutual fund NAV parquet now have their own pathway and budget, fixing queries from duckdb and polars that were being refused partway through. Cause: a single analytical query issues close to three hundred byte-range reads within seconds, and the rate limiter was counting those in the same bucket as whole-file downloads, so a legitimate query registered as a burst. The range pathway now allows 3,000 requests per minute and 25,000 per day per public IP, with remaining-budget details returned in response headers. The file remains about 175 MB covering close to 37 million NAV records and can still be downloaded whole, alongside single and batch NAV pulls, scheme search and the snapshot endpoint that returns the latest NAV for every scheme in one file. Includes measured tips for querying it remotely: duckdb and polars are fastest with polars marginally ahead, pyarrow and pandas-with-fsspec move roughly ten times more data for the same query, and pandas handed a bare URL is the case to avoid (372 MB and 37 seconds against 17 MB and 3.5 seconds when the URL is opened through fsspec first). Because the file is sorted by scheme_code, a WHERE on scheme_code costs about five requests while a date filter or unfiltered scan costs about three hundred, so the rule of thumb is to filter on scheme_code and query remotely and otherwise just download the file. Also covers two JavaScript options, hyparquet and the native duckdb npm package. AI-readable: https://www.tigzig.com/ai/posts/mfpro-range-requests-duckdb-polars-aug2026.md - [Getting 429s on the YFIN API from an Excel WEBSERVICE Formula? Here Is What Is Happening.](https://www.tigzig.com/post/yfin-excel-webservice-429s-aug2026) - Tags: infrastructure, excel Why Excel WEBSERVICE formulas hitting the free TigZig Yahoo Finance API return 429s, and what to do instead. WEBSERVICE is a volatile function, so it recalculates on any change anywhere in the workbook, meaning a few hundred such cells all fire simultaneously and breach the per-IP rate limit at once. Two mitigations: the endpoint accepts up to 25 tickers in a single call, turning a few hundred names into a few dozen calls, though hundreds of symbols will still take minutes because calls are paced server-side to manage concurrency and stay polite to Yahoo Finance. For anything at that scale the recommendation is Power Query with M, or Python in Excel via xlwings Lite, where requests run in sequence and refresh on demand rather than on every recalculation. Notes that any AI assistant can set up either option, points to the xlwings Lite hub for free guides and templates, and confirms the limits have been raised and tracker templates are in progress. AI-readable: https://www.tigzig.com/ai/posts/yfin-excel-webservice-429s-aug2026.md - [SIF Data Is Live. The Full Published NAV History, the Scheme Master and the Quarterly AUM.](https://www.tigzig.com/post/sif-data-release-nav-scheme-master-aum-aug2026) - Tags: mutual-funds, infrastructure A free, keyless dataset of every NAV AMFI has published for Indian Specialized Investment Funds since the category began, live at sif.tigzig.com as plain CSV updated twice a day, alongside the scheme master and quarterly average AUM. Six files: sif_nav.csv (about 10,000 rows over 200+ trading dates), sif_meta.csv, sif_aaum.csv, summary.json, manifest.json with row counts, byte sizes and SHA-256 per file, and a README covering every column. Explicitly observational, part of pipeline beta testing, with no uptime commitment and a file shape that may still change. Explains why fund counts and scheme-variant counts differ: AMFI counts 27 funds as at 30 June 2026 across 75,032 folios and Rs 17,858 crore net AUM, while the files hold 111 scheme variants from 17 fund houses, 63 open ended and 48 interval, with the first NAV on 8 October 2025. Documents the traps for anyone building on it: the temp_ column prefix that disappears on merge, upload_ts being IST despite a trailing Z, isin and isin2 being one scheme, and column names deliberately matching the mutual fund dataset. Sets out the open design questions before SIF joins MFPRO, including a different SEBI strategy taxonomy, long-only benchmarks that misprice long-short funds, interval-fund liquidity semantics, and a three-option comparison for reconciling AMFI's string SIF codes with integer mutual fund scheme codes. Closes with the validation regime: dual-source comparison, five-day lookback for late filings and restatements, holiday versus gap detection, byte-level reparse against archived originals, AUM reconciliation, a strategy-by-strategy roll-up matching AMFI's monthly report, and the single inferred field with its NAV-ordering test. AI-readable: https://www.tigzig.com/ai/posts/sif-data-release-nav-scheme-master-aum-aug2026.md - [Zero Callers Rate Limited in 24 Hours. 6,500+ Calls and 9.7 GB Served, After the TigZig API Limits Went Up.](https://www.tigzig.com/post/tigzig-api-zero-rate-limited-aug2026) - Tags: infrastructure, mutual-funds Result of the rate-limit and concurrency rework on the free, keyless TigZig public APIs: zero callers refused in a 24-hour window across 6,500+ calls and 9.7 GB served, against a prior peak where roughly one in four calls was being refused because old limit and concurrency settings had never been updated. Fixed across the whole path, edge, proxy and app. Also breaks down how the three busiest API surfaces are actually used, which differs sharply between them. The mutual fund API (MFPRO) leads on call volume and splits two ways, callers pulling NAVs scheme by scheme or in batches, and callers taking the entire database as one file alongside the scheme master, which is regenerated three times a day from AMFI data, with format demand split roughly evenly between parquet and CSV; the NAV path traffic looks like scheduled scripts maintaining trackers. The Yahoo Finance API (YFIN) is second by volume with get-all-prices the most used path, and is a thin open-source wrapper over the yfinance package. Tremor is almost entirely bulk, callers taking the full macro database of a few hundred global and India indicators. Downloads carry a tighter limit than queries because they are heavy, and that limit is being revised upwards as range requests appear. Includes a copy-paste agent prompt for wiring up a tracker end to end, and the free no-login front ends: MFPRO, the Quants Report Agent and QREP. AI-readable: https://www.tigzig.com/ai/posts/tigzig-api-zero-rate-limited-aug2026.md - [TigZig API Rate Limits Raised Substantially, Across the Edge, the Proxy and the Apps. And a 429 Now Tells You What to Do About It.](https://www.tigzig.com/post/tigzig-api-rate-limits-raised-aug2026) - Tags: infrastructure, mutual-funds Rate limits on the free, keyless TigZig APIs have been raised substantially across every layer of the path, the Cloudflare edge, the proxy in front of the apps and the apps themselves, with concurrency limits raised alongside. The old numbers were set when traffic was a fraction of current volume and had accumulated across layers added at different times, so ordinary use, particularly Excel and Google Sheets trackers and automated scripts firing one call per row, was being refused. The 429 response is now actionable: every refusal carries Retry-After, CORS headers go out on it so a browser fetch can read the status rather than throwing a generic network error, and where a bulk download exists the response body names the file that would replace the loop. A Cloudflare-edge refusal also returns X-RateLimit-Limit, Remaining, Reset and Domain, with Reset approximate because the window rolls per edge location, while an app-side refusal carries Retry-After alone. Per-API limits are published in the human docs and the machine-readable catalogs. Also covers the batch endpoints and the full-database downloads available for the mutual fund, Vigil and Tremor APIs as the right answer for heavy use, Python in Excel via xlwings Lite for spreadsheet automation, and an explanation of what per-IP counting means behind carrier-grade NAT or a corporate gateway, along with why these APIs stay keyless by deliberate choice. AI-readable: https://www.tigzig.com/ai/posts/tigzig-api-rate-limits-raised-aug2026.md - [Tigzig is Built AI-Agent First. 300+ Assets, and the Fastest Way In Is to Ask Your AI.](https://www.tigzig.com/post/tigzig-agent-first-ask-your-ai-aug2026) - Tags: ai-coders, infrastructure Tigzig is built AI-agent first, so the quickest route into the site is to ask an assistant rather than browse it. All 300+ assets, guides, live apps, repos, open APIs and MCP servers, are organised to be machine readable and agent accessible, with worked example prompts for ChatGPT, Claude, Gemini or Meta AI such as asking what the site has for building an Excel tool, whether it carries analysis on Donald Trump's trades, or to pull the author's posts on economy and markets. An AI coder (Claude Cowork, ChatGPT Work, Claude Code, Codex) can go further and fetch the code, call the APIs and deploy and run something for you. Also covers two changes in traffic: a fair portion of API calls now arrive from agents and automated tools, so some callers are meeting rate limits they would not have hit before, with limits under active adjustment and the limits themselves being documented across response headers, 429 bodies, the machine-readable API roots and the human docs, starting with the MFPRO API and extending to other high-usage APIs including the Yahoo Finance and FFN portfolio tools. Suggested workarounds are batching identifiers into a single call where an API supports multiple tickers or scheme codes, or taking the whole database as a file for TREMOR and the mutual fund API. Ends on where the traffic now comes from: ChatGPT is the number one referrer after Google, and API callers arriving as ChatGPT and Claude send standard headers and behave in a predictable, systematic way. AI-readable: https://www.tigzig.com/ai/posts/tigzig-agent-first-ask-your-ai-aug2026.md - [MFPRO Mutual Fund API: Search Now Filters Across 12 Fields on a Scheme](https://www.tigzig.com/post/mfpro-search-filters-12-fields-jul2026) - Tags: mutual-funds, infrastructure Full reference for the /search endpoint on the free, keyless MFPRO India mutual fund NAV API, which now filters on 12 scheme fields rather than matching a fund name alone: amc, category, group, type, plan, option, active, stale, the first_date and last_date windows, isin and txic, with exclude on top as the single NOT. Any filter present turns search into browse, so a call with filters and no q lists the scheme universe; only a completely bare call still returns 422. Covers the difference between group (four broad buckets after the SEBI Feb 2026 change folded Solution Oriented and Fund of Funds into Other Scheme) and category (the SEBI sub-category, contains-matched against AMFI's raw text too, which is why category=income with active=all surfaces tens of thousands of pre-2018 schemes that carry no clean sub-category). Documents the whole query language: filters AND automatically, a comma is OR within one field, exclude subtracts last, and there is nothing past that - no parentheses, no nesting, no OR across fields, and AND/OR typed into q are matched as literal words. Also the error behaviour (an unknown parameter rejects the whole call with valid_params and did_you_mean rather than silently dropping a filter, repeated q is rejected while list filters merge, limit is bounds-checked 1 to 100 with a pointer to the bulk download), worked examples with real counts, the exclude-matches-name-only and no-sort limits, offset paging, and the pagination-across-a-sync edge with the bulk file as the consistent alternative. AI-readable: https://www.tigzig.com/ai/posts/mfpro-search-filters-12-fields-jul2026.md - [MFPRO Mutual Fund API Update. Three Things Your Calls Asked For, Now Built.](https://www.tigzig.com/post/mfpro-api-update-three-things-jul2026) - Tags: infrastructure, mutual-funds Three changes to the free, keyless MFPRO India mutual fund NAV API, each one built from a pattern seen repeatedly in the server logs, with the before and after for each. First, latest=true is now a real parameter: callers had been guessing it for weeks and silently receiving a fund's entire history (5,003 rows back to 2006) to show one number; it now returns one row, works on single and batch calls, combines with since/to for as-of-date queries, and accepts LATEST=TRUE, latest=1 and latest=false. Second, every response now carries per-scheme first_available_date and latest_available_date plus a Last-Modified header on empty windows, so a 200 with an empty data array explains itself and a poller running ahead of AMFI's daily publish can self-correct instead of writing empty files. Third, a 404 on an ISIN now runs the check-digit arithmetic and says in the error body when the identifier itself is corrupted, distinguishing that from an identifier that is well formed but simply absent, so an agent reading the error knows whether retrying can ever help. Also recaps the forgiving-input handling: scheme/schemes/isin/isins interchangeable, up to 50 identifiers per call, case-insensitive parameter names and values, repeated parameters merging, and one bad identifier never failing a batch. AI-readable: https://www.tigzig.com/ai/posts/mfpro-api-update-three-things-jul2026.md - [Your Agents and Scripts Have Been Talking to Me. Here Is That Conversation in Plain English.](https://www.tigzig.com/post/api-conversation-agents-scripts-jul2026) - Tags: infrastructure, mcp, mutual-funds Server logs from the free, keyless tigzig data APIs rewritten as a plain-English conversation, including who is actually calling (roughly 1 in 5 mutual fund API calls arrive with Claude or ChatGPT user agents from Cowork, Excel and Codex, rising to about half on Tremor and Yahoo Finance where MCP is mounted, with the rest scripts and AI coders behind generic or blank user agents): 23 real questions the incoming calls asked, and the patterns that got it right. Questions covered include SIF schemes (not carried, and why a q=SIF search returns 30 false matches from 'diversified'), where to get index levels rather than index funds (Tremor's 20 market series with tickers and history start dates, or the Yahoo Finance wrapper), batching up to 50 identifiers in one call with scheme/schemes/isin/isins interchangeable, what a 429 actually means and how Retry-After and X-RateLimit-Remaining work, trailing punctuation and & entities in copied URLs (the silent one that returns full history instead of your date slice), why an MCP endpoint 406s in a browser, the three causes of a 404 on a well-formed identifier, ISIN check digits and invalid ISINs circulating through AI output, empty-200 vs 404, retrying large downloads and verifying against Content-Length, plus the cricket-database GET-vs-POST fix and its Cricsheet id space. The things callers got right: whole-file parquet downloads, format choice, ChatGPT-User fetching files into its own sandbox, batch calls, search-then-fetch, since= incrementals, DuckDB HTTP range reads pulling 9MB instead of 170MB, ETag/If-None-Match and If-Modified-Since checks, and agents reading the API catalog before making a single data call. Ends with the human and agent documentation sets and how to report a problem. AI-readable: https://www.tigzig.com/ai/posts/api-conversation-agents-scripts-jul2026.md - [1 in 5 Bulk Downloads Were Silently Truncating. Two Cloudflare Worker Bugs, Found and Fixed. Now Up to 4x Faster.](https://www.tigzig.com/post/mfpro-download-truncation-fix-jul2026) - Tags: infrastructure, mutual-funds Roughly 1 in 5 bulk downloads of the MFPRO India mutual fund database were silently truncating - files started fine, ran a while, then arrived incomplete, with no error shown to the user and slower connections hit hardest. Edge-level monitoring surfaced 504s that origin server logs structurally cannot see. Two separate Cloudflare Worker bugs in serving large files from R2: teeing the user's download stream into the edge cache write (the cache fill finishes first and cuts the client off mid-file), and passing a large file through JavaScript inside the Worker (the CPU limit truncates it silently). Both fixed and verified byte by byte from four countries; downloads now complete and up to 4x faster. Includes the transferable lessons for anyone serving large files at the edge, what is in the download (37,084,484 rows across 38,000+ schemes since 2006, seven formats from 167MB Parquet to 1.28GB SQLite, regenerated 2-3x daily with a manifest carrying sizes, row count and a validation flag), the one-GET no-key endpoint, the DuckDB-over-HTTP alternative, and the wider no-key API and MCP surface (Tremor macro, Vigil India red flags, Yahoo Finance, comparisons, technical analysis, markdown to PDF) with live uptime at status.tigzig.com. AI-readable: https://www.tigzig.com/ai/posts/mfpro-download-truncation-fix-jul2026.md - [The boring $5 tool that tells me when a server goes down](https://www.tigzig.com/post/pushover-server-down-alerts-jul2026) - Tags: infrastructure Long-form guide to Pushover, the one-time-$5 hosted notification service that pages your phone when a server dies - as used across the tigzig.com fleet (50+ apps, two servers). Covers the whole model in plain words: your cron or error handler makes one outbound HTTPS POST, Pushover's cloud owns all delivery machinery, notification lands on your phone. Includes the 10-minute setup, complete curl and JavaScript snippets, the -2 to +2 priority dial (silent to keeps-ringing-until-acknowledged emergency with retry/expire), a real production alert taxonomy (CPU alarms, 4xx velocity auto-jail, API liveness, 5xx spikes, TLS cert expiry, login anomalies, recovery pings), the fire-once-and-recover dedup pattern with an active_alerts table, why a hosted notifier beats self-hosting for shared-fate reasons (with ntfy and Gotify as the self-host alternatives), the keep-secrets-out-of-notifications rule, and the full capability ceiling (teams, receipts, webhooks, Glances, subscriptions). Also: any AI coding agent can wire it for you - it knows the API cold. AI-readable: https://www.tigzig.com/ai/posts/pushover-server-down-alerts-jul2026.md - [Demystifying TIGZIG API Errors: A Practical Guide for MFPRO, TREMOR, and VIGIL Users](https://www.tigzig.com/post/tigzig-api-errors-practical-guide-jul2026) - Tags: infrastructure, mcp A troubleshooting field guide for the free tigzig.com data APIs (MFPRO mutual fund NAV, TREMOR macro/market, VIGIL India red flags, Yahoo Finance tools), built from real server-log patterns. Covers 20 common failure modes in plain English: trailing punctuation and & entities in copied URLs, over-encoded parameter joiners, missing required inputs, the JavaScript undefined trap, GET vs POST confusion, folder-style path guessing, comma-separated inputs on single-item endpoints, wrong format requests, opening MCP endpoints in a browser (406), deprecated SSE paths (405), per-API parameter naming differences, ISIN variant mismatches, model-hallucinated scheme codes, Yahoo market suffixes, and the empty-but-correct responses class: non-corporate assets without financials, dividend-free stocks, defunct schemes after the July 2026 backfill (38,000+ schemes since 2006), AMFI weekend/holiday publishing windows, and client timeouts on large batches. Ends with the copy-this-page-to-your-AI troubleshooting recipe and the full human + AI-agent documentation link set (API catalog RFC 9727, MCP server registry, raw markdown data dictionaries). AI-readable: https://www.tigzig.com/ai/posts/tigzig-api-errors-practical-guide-jul2026.md - [Tremor: A Free, No-Auth API for 330+ Macro and Market Indicators, 350K records, Refreshed 3x/Day. Ask your AI to explore.](https://www.tigzig.com/post/tremor-macro-api-ask-your-ai-jul2026) - Tags: mcp, infrastructure Release note on the current state of Tremor, tigzig.com's free open API and MCP server for macro, credit, valuation and market data. 331 public indicators across 8 categories, 350K records, refreshed 3x a day, no key and no sign-up. Ask-your-AI framing - point an AI agent at api.tigzig.com's Tremor and it reads the category menu (8 high-level buckets), drills into the one that matches the question, gets the full indicator list with metadata, searches if needed, then pulls the series - one prompt, the human never touches the docs. MCP also available for agents that prefer that surface. Category breakdown: US macro (35 - FRED 32 + Michigan Consumer Sentiment 1 + Manheim Used Vehicle Value Index 2), US credit stress (216 - NY Fed Household Debt 64 + FDIC bank aggregates 80 + NCUA credit-union aggregates 72, covering delinquency by product / charge-offs / originations by credit tier), US valuation (1 series - Shiller CAPE since 1881, with the us_valuation grouping also surfacing the Buffett indicator and nominal GDP from us_macro and the 10Y Treasury yield), US insurance (currently empty - Fed Z.1 Life + P&C invested-asset breakdown scaffolded and loading), India macro and credit (47 - MoSPI 27 + RBI 15 + NSE 3 + FRED USDINR 1 + one computed CD ratio), Global macro (8 - OECD Business Confidence for 4 countries + Bundesbank 10Y Bund + Bank of England 10Y Gilt + ECB Euro-area 10Y yield curves for AAA and all-issuers), Currencies (7 daily FX pairs including USDINR + EM Asia + Fragile-X peer cuts USDJPY / USDKRW / USDTWD / USDPHP / USDTRY / USDVND), Markets (16 daily Yahoo Finance symbols - S&P 500, Nifty 50, Nikkei 225, Hang Seng, DAX, Shanghai, US 10Y ^TNX, DXY, gold, silver, copper, WTI, Brent, natural gas, USDINR, USDJPY). Each indicator ships a notes field with the gotchas baked in for the agent: us_real_gdp is already SAAR-annualized (do not multiply by 4), in_nifty50_pe has a standalone-to-consolidated methodology break in April 2021, in_net_fdi negative means outflow and there is a 6+ month publication lag. Pipeline detail: pull via API where available (FRED, RBI WSS, ECB Statistical Data Warehouse, OECD, Bundesbank, Bank of England); for sources published only as files with year-to-year format drift (NCUA 5300 Call Reports, FDIC SDI aggregates, NY Fed Household Debt Study, MoSPI eSankhyiki, RBI DBIE Excel, Shiller's ie_data.xls, Manheim MUVVI) the file is downloaded, parsed with error correction, standardized into a series. Runs 3x a day - Fed publishes at 3pm ET, we pick it up in the next cycle and it is live in Tremor by early evening. Multi-cadence handling: RBI is a mix (weekly rates + fortnightly credit + monthly trade/FDI/FPI), MoSPI monthly or quarterly by series, NSE Nifty PE/PB daily, quarterly GDP + GFCF + credit-union aggregates land once a quarter and get ingested the day published. Pipeline does error checking: sums validate, YoY consistency checked, data quality issues (missing values, spikes that do not match the source document) flagged in metadata so the caller sees them. Sources summary lists FRED, NY Fed, FDIC, NCUA, RBI, MoSPI, NSE, ECB, Bundesbank, BoE, OECD, Shiller, Michigan, Manheim, Yahoo Finance with a one-line note on each. Includes 'what moved recently' section with current-through dates on Treasury curve + VIX + Baa credit spread + 10Y TIPS + 10Y-2Y spread + 30Y fixed mortgage rate + PMMS + initial jobless claims + Bund + Gilt + Euro-area yield curves + the 16 daily market symbols. Launched March with ~50 indicators; now 331 and growing. Single-image release post with the one-pager PNG at the bottom. AI-readable: https://www.tigzig.com/ai/posts/tremor-macro-api-ask-your-ai-jul2026.md - [FRED, 845,000 US Economic Series - Your AI Can Pull Any of Them Directly. No MCP, No Plugin, No Install.](https://www.tigzig.com/post/fred-your-ai-pulls-directly-jul2026) - Tags: ai-coders, infrastructure Pitch + practical starter for pointing an AI at public data APIs directly, no plugin required. Headline: FRED, the St. Louis Fed's free database, has ~845,000 economic time series (inflation, jobs, GDP, rates, markets) and your AI (Claude Cowork, OpenAI Codex, Claude in Excel and PowerPoint) can just reach in and pull any of them - no MCP server, no plugin, no install, free. Mechanism: each of those AI tools has a Python sandbox inside, so calling an API is just Python for them, and an API reads like plain English ('get me US gasoline prices from FRED, chart it, tell me what changed' - it goes, connects, pulls, analyses, pushes into Excel or a slide or an HTML report). Three-step get-going: grab a free FRED API key at fredaccount.stlouisfed.org/apikeys (generous rate limits), first time enable outside access for the agent (one setting), then just ask. Post also links two go-deeper resources: the Claude Cowork guide (a deck on how the author runs the whole thing) and the Claude for Analytics hub. Second half lists a handful of free APIs the author keeps using: FRED (845k US series, key required), World Bank (api.worldbank.org, no key, global GDP + inflation + debt), US Treasury FiscalData (api.fiscaldata.treasury.gov, no key, federal debt + rates), ECB reference FX (api.frankfurter.dev, no key), Yahoo Finance (via yfinance in the sandbox). Plus author's own free tigzig.com endpoints (all on api.tigzig.com, no key): Tremor (curated US + global macro/credit/valuation indicators), Mutual Fund NAV India from AMFI (19.8M records, 17k schemes), Vigil (India corporate red flags), Portfolio Analysis, AI Technical Analysis, Securities Comparisons. For a human - tigzig.com API/MCP menu. For an agent - copy the page or point it at api.tigzig.com. Single-image release post. AI-readable: https://www.tigzig.com/ai/posts/fred-your-ai-pulls-directly-jul2026.md - [Tigzig APIs - Reading the Logs, Shipping the Fixes. Status Page Live, R2 Downloads, Self-Correcting 4xxs.](https://www.tigzig.com/post/tigzig-apis-status-page-live-jul2026) - Tags: mutual-funds, infrastructure Release note on what shipped for the Tigzig public APIs in the last 48 hours, driven by daily log reading (200s tell what is working, 4xx and 5xx tell what to fix next). Four things live: (1) common-guess coercion - if a caller or their AI guessed /series instead of /nav or sent start= instead of since=, those now quietly work with one canonical spec still in the docs; (2) every 4xx now returns a help block linking the docs page and the machine catalog so an AI agent can self-correct without the human stepping in; (3) full-database downloads (100 to 500+ MB files) now served from Cloudflare R2, noticeably faster than before; (4) status page live and probed every minute at status.tigzig.com - downtime rings the author's phone. Underway: fallback to a secondary server if the primary goes down. Second half of the post is a practical errors-and-fixes list: 404 (scheme code guessing/enumeration - use /search?q=fund-name or an ISIN from the broker statement, both work), heavy parallel bursts now return proper 429s instead of the occasional 503, 429 rate limits (300/min per public IP with X-RateLimit headers so scripts/agents can pace themselves), 400 validation (YYYY-MM-DD dates, 50-scheme bulk cap, scheme= for one vs schemes= for many), and every failure comes back as JSON with an error code + docs_url pointing straight at the fix. Polling tip: send If-Modified-Since and you get a 304 on days AMFI hasn't published (weekends, holidays) so scripts can skip re-downloading history they already have. Single-image release post - status page screenshot. AI-readable: https://www.tigzig.com/ai/posts/tigzig-apis-status-page-live-jul2026.md - [Claude for Analytics on Tigzig.com - New Hub: Excel, PowerPoint, Cowork, 7 MCP Servers, 20+ Guides.](https://www.tigzig.com/post/tigzig-claude-for-analytics-hub-jul2026) - Tags: claude-in-excel, mcp, excel Launch announcement for the new 'Claude for Analytics' hub on tigzig.com (canonical URL /ai-in-excel) - one page that pulls together everything the author has built and written on driving analyst work with Claude in Excel, PowerPoint and Cowork. Contents: 20+ guides, 5 PDF playbooks, 7 MCP servers, plus the source workbooks (formulas, charts, models). Specific capabilities highlighted: talk to Postgres and DuckDB from inside Excel, pull 81 risk and return metrics live into a sheet (QREP MCP), work with Claude-in-Excel and have it push results into Claude-in-PowerPoint for a deck, and Cowork extending the same Claude beyond the sheet to files, databases, ML models and code as one frontend. Two ways to consume - browse the hub yourself or ask Claude / ChatGPT / Gemini to read the page and summarise. All free, almost all open source. 2-page overview PDF included as a small carousel. AI-readable: https://www.tigzig.com/ai/posts/tigzig-claude-for-analytics-hub-jul2026.md - [New MCP Hub on Tigzig.com - 7 MCP Servers, 6 Live Apps, 16 Guides, 108-Point Security Checklist. Just Ask Your AI.](https://www.tigzig.com/post/tigzig-mcp-hub-launch-jun2026) - Tags: mcp, security Standalone one-pager release announcing the new MCP hub on tigzig.com - 7 open-source and live MCP servers, 6 live apps, 16 guides, plus a 108-point security checklist. Designed for AI and automation builders. Either browse the hub at tigzig.com/mcp, or just ask ChatGPT / Gemini / Meta AI on WhatsApp / Claude something like 'Go to tigzig.com's MCP page and lemme know what's there' - the AI will pull what's there and Claude Code / any AI coder will implement it for you. The hub carries reusable components that work across domains - sending data and charts to AI and getting structured results back, formatted PDF and HTML output, accessing backend databases on DuckDB and Postgres, Python processing for statistical and quant analysis. Live MCP servers and apps cover macro data, a database query server, portfolio analytics, and tools used regularly for own analysis. The companion security checklist (tigzig.com/security) covers backend, auth, database, edge and third-party apps - 108 items. AI-readable: https://www.tigzig.com/ai/posts/tigzig-mcp-hub-launch-jun2026.md - [CORS Anywhere Alternative: A Free Cloudflare Worker CORS Proxy (POST and Any URL)](https://www.tigzig.com/post/cors-anywhere-alternative-cloudflare-worker) - Tags: infrastructure, security A free cors-anywhere alternative and replacement: a self-hosted Cloudflare Worker CORS proxy that supports POST and any URL via the ?url= parameter, and adds CORS headers. Full copy-paste Worker code plus a GitHub repo. Works like cloudflare-cors-anywhere on a free workers.dev URL. Covers the four locks (origin allow list, target allow list, X-API-Key, rate limit), what Origin means, and the free-tier safety net. Companion to the main CORS proxy post. AI-readable: https://www.tigzig.com/ai/posts/cors-anywhere-alternative-cloudflare-worker.md - [Free AMFI Mutual Fund NAV API for India - Historical NAV by Scheme Code, No Key](https://www.tigzig.com/post/free-mutual-fund-nav-api-india) - Tags: mutual-funds, infrastructure A free, open AMFI Mutual Fund NAV API for India - no key, no sign-up. 20.5M+ daily NAV records across 18,000+ schemes, back to 2008, refreshed daily. Search schemes, pull a scheme's full NAV history by code and date, or download the ENTIRE database in a single call (Parquet / CSV / SQLite). Copy-paste curl and Python examples. AI-readable: https://www.tigzig.com/ai/posts/free-mutual-fund-nav-api-india.md - [MCP Guide for Claude in Excel - and any MCP client](https://www.tigzig.com/post/mcp-guide-claude-in-excel) - Tags: mcp, claude-in-excel, security 35-slide visual guide covering MCP (Model Context Protocol) from fundamentals to production deployment. Explains MCP vs regular APIs, schema documentation, common mistakes, and security hardening. Includes 5 live open-source MCP servers connecting to PostgreSQL, DuckDB, PDF/HTML files, and Python backends. Covers honest trade-offs around token overhead and context bloat. AI-readable: https://www.tigzig.com/ai/posts/mcp-guide-claude-in-excel.md - [Upstash Redis on Vercel - The Tool I Didn't Know I Needed](https://www.tigzig.com/post/upstash-redis-vercel-rate-limiting) - Tags: infrastructure, security, open-source How I use Upstash Redis on Vercel for rate limiting across 10-12 apps with a single free instance. Explains what Redis is (key-value store like a Python dictionary in RAM), why not Postgres for this, TTL auto-expiry, key prefix namespacing, and the free tier (500K commands/month, 256MB). AI-readable: https://www.tigzig.com/ai/posts/upstash-redis-vercel-rate-limiting.md - [Full backend Infrastructure for DuckDB production and analytics system](https://www.tigzig.com/post/full-backend-infrastructure-duckdb-production) - Tags: duckdb, open-source, infrastructure Arc by Basekick Labs - a full backend infrastructure for DuckDB written in Go. REST API, auth, multiple storage backends (S3/MinIO/Azure), compaction, partitioning, retention policies, connection pooling, Prometheus metrics. Open source AGPL-3.0. AI-readable: https://www.tigzig.com/ai/posts/full-backend-infrastructure-duckdb-production.md - [Your API Key Is Visible in the Browser. Even if you put it as Vercel's 'secret' backend env variable.](https://www.tigzig.com/post/your-api-key-is-visible-in-the-browser) - Tags: security, infrastructure, fastapi Why putting API keys in Vercel secret env variables still exposes them in the browser network tab. Walks through three common mistakes and the one fix that works - Vercel serverless functions. Also covers rate limiting, data processing, and security gates you can add in the serverless layer. AI-readable: https://www.tigzig.com/ai/posts/your-api-key-is-visible-in-the-browser.md - [Are You Rate Limiting the Wrong IPs? A SlowAPI Story.](https://www.tigzig.com/post/are-you-rate-limiting-the-wrong-ips) - Tags: security, fastapi, cloudflare, infrastructure How modern multi-hop architectures (Vercel serverless + Cloudflare + FastAPI) cause SlowAPI to rate limit the wrong IPs. Covers the CF-Connecting-IP overwrite problem, X-Forwarded-For spoofing, the custom header fix, and a detailed FAQ on IP extraction across different proxy setups (Caddy, nginx, Docker, direct). AI-readable: https://www.tigzig.com/ai/posts/are-you-rate-limiting-the-wrong-ips.md - [Claude the Hunter-Killer - Have You Seen Your Nice Little Claude Run a Penetration Test on Your Apps?](https://www.tigzig.com/post/claude-the-hunter-killer-pen-test) - Tags: security, ai-coders, infrastructure Real-world penetration test using Claude Code against a hardened DuckDB dashboard app (230M rows, IMDB data). Despite API keys, Cloudflare edge rate limiting, JS challenge, SQL blocklist and backend rate limits, Claude found repeat() memory bombs that finish within timeout, metadata leaks, and missing conn.interrupt() leaving DuckDB crunching after timeout. Shows how Playwright bypasses JS challenge using real Chrome and fires attacks from same-origin context. Practical lesson: use separate Claude instances for coding and pen testing. AI-readable: https://www.tigzig.com/ai/posts/claude-the-hunter-killer-pen-test.md - [2026 Infra Guide for AI Tool Builders - Part 5: Perimeter Security on Cloudflare (Free Plan)](https://www.tigzig.com/post/perimeter-security-cloudflare-free-plan) - Tags: cloudflare, security, infrastructure Set up perimeter security (edge defense) for web apps on Cloudflare's free plan. Covers orange-cloud proxying, WAF JS challenges (and their impact on AI agent traffic), browser integrity checks, per-domain rate limiting via Cloudflare Workers (100K free invocations/day), zone-level IP blocking with CIDR notation, and Vercel .vercel.app bypass fix. All running across 60+ subdomains and 40+ apps at zero cost. AI-readable: https://www.tigzig.com/ai/posts/perimeter-security-cloudflare-free-plan.md - [Per-IP rate limit on Cloudflare free plan - the gotchas](https://www.tigzig.com/post/cloudflare-rate-limiting-free-plan-tricky) - Tags: security, infrastructure Cloudflare free plan rate limiting challenges for multi-app setups. Vercel's .vercel.app URL bypasses Cloudflare - fix with deployment protection. Free plan allows only 1 rate limit rule, Pro plan gives 2. Workarounds for 60+ subdomains across 40+ apps using Cloudflare Workers. Key takeaway: for single domains, Cloudflare free tier protection is essential. Security checklist updated to 80 items. AI-readable: https://www.tigzig.com/ai/posts/cloudflare-rate-limiting-free-plan-tricky.md - [Going beyond Google Login for critical apps. Identifying gaps & hardening your entry points.](https://www.tigzig.com/post/going-beyond-google-login-hardening-entry-points) - Tags: security, infrastructure Security hardening beyond OAuth for admin apps on public internet. Two Claude instances ran 130 adversarial tests across 3 phases against a production monitoring dashboard. Implemented layered gates: Cloudflare Turnstile bot detection, pre-login password gate, Google OAuth with email whitelist, Google Authenticator MFA, and JWT verification on every API call. Security checklist updated to 78 items. AI-readable: https://www.tigzig.com/ai/posts/going-beyond-google-login-hardening-entry-points.md - [tigzig.com is AI-agent first. But what happens when your AI coder runs into a problem on my site?](https://www.tigzig.com/post/tigzig-ai-agent-first-site) - Tags: ai-coders, infrastructure TigZig is now an AI-agent-first platform. AI coders and agents can access 40+ live tools, 155+ guides, and all source codes through structured text indexes built on the llms.txt standard. Includes an AI feedback API endpoint for agents to report broken links or missing content, with automated triage, resolution tracking, and email notifications. The entire site content (20,000+ lines) is downloadable as a single text file. AI-readable: https://www.tigzig.com/ai/posts/tigzig-ai-agent-first-site.md - [TigZig is Now AI-Agent First](https://www.tigzig.com/post/tigzig-ai-agent-first) - Tags: ai-coders, infrastructure TigZig is now AI-agent first. AI coders and agents are first-class citizens with access to 40+ live tools, 155+ guides, and all source codes indexed and structured for agents. Users can ask their AI coder to scan the site, find apps, explain implementations, and deploy solutions. Built using the llms.txt standard with the entire site content (20,000+ lines) downloadable as a single text file. AI-readable: https://www.tigzig.com/ai/posts/tigzig-ai-agent-first.md - [Security Checklist for Web Apps - 71 Items](https://www.tigzig.com/post/security-checklist-web-apps-71-items) - Tags: security, infrastructure Practical security checklist of 71 items across React frontend, FastAPI backend, PostgreSQL, DuckDB, Cloudflare, MCP servers, authentication, and VPS hardening. Each item describes the risk in plain English with a code fix. Built from real vulnerabilities found in 30+ public apps after a bot attack. Designed for data scientists and analysts building production tools who may lack traditional IT security background. AI-readable: https://www.tigzig.com/ai/posts/security-checklist-web-apps-71-items.md - [My Public MCP Server Got Hammered - Security Lessons from a Bot Attack](https://www.tigzig.com/post/mcp-server-bot-attack-security-lessons) - Tags: infrastructure, security, mcp Real incident report of a bot attack on a public database MCP server. Had rate limiting, read-only access, and SQL validation but still got hammered. Worked with Claude Code to fix 15+ attack vectors including exposed server IPs, open system catalogs, and an unprotected Supabase REST API. Covers lessons on securing public demo apps vs client apps, and why ignoring AI coder security audit recommendations has consequences. AI-readable: https://www.tigzig.com/ai/posts/mcp-server-bot-attack-security-lessons.md - [New on VIGIL: SAST Takeover Disclosures (India)](https://www.tigzig.com/post/vigil-sast-takeover-disclosures-india) - Tags: vigil, security VIGIL app now tracks SEBI Takeover Code (SAST) disclosures under Reg 29. Covers Reg 29(1) filings when someone crosses 5% ownership and Reg 29(2) when existing 5%+ holders change stake by 2%+. Around 10,000 records from last 2 years. Includes leaderboards for largest acquisitions, promoter selling, outsider accumulation, new 5%+ stakes. Filters by company, transaction type, promoter/non-promoter, Nifty indices. Updated daily. AI-readable: https://www.tigzig.com/ai/posts/vigil-sast-takeover-disclosures-india.md - [Free CORS Proxy for Yahoo Finance & Any API: Cloudflare Worker Code (CORS Explained Simply)](https://www.tigzig.com/post/fast-tips-what-is-cors-and-how-to-fix-it) - Tags: infrastructure, security Free CORS proxy for Yahoo Finance, GitHub, Drive, or any API using a Cloudflare Worker - a self-hosted alternative to cors-anywhere / cloudflare-cors-anywhere, no server, no domain, free tier. Full copy-paste Worker code plus the ?url= pattern, and CORS explained simply: preflight, the no-cors trap, and when to use a Worker vs Vercel serverless vs FastAPI. AI-readable: https://www.tigzig.com/ai/posts/fast-tips-what-is-cors-and-how-to-fix-it.md - [From 12 second queries to under 1s: Optimizing a 230 Million Row Dashboard - 14 Bottlenecks I Had to Fix](https://www.tigzig.com/post/from-12-second-queries-to-under-1s-optimizing-230-million-row-dashboard) - Tags: duckdb, fastapi, infrastructure Documents 14 optimization techniques that reduced query times from 9-12 seconds to under 1 second on a 230M-row DuckDB dashboard (16GB). Covers pre-computed denormalized tables, single-blob dashboard cache, in-memory query caching, ORDER BY index conflicts, adaptive queries, EXISTS vs CTE (15x gap), client-side computation from loaded data, Docker container memory mismatch with DuckDB, and autocomplete race condition fixes. Open source with dual Hetzner/Oracle backends. AI-readable: https://www.tigzig.com/ai/posts/from-12-second-queries-to-under-1s-optimizing-230-million-row-dashboard.md - [Architecture & Setup for a Dashboard with Hundreds of Millions of Records - Powered by DuckDB](https://www.tigzig.com/post/custom-dashboard-duckdb-fastapi-230-million-rows) - Tags: duckdb, fastapi, infrastructure, react Architecture guide for building a custom dashboard with 230M rows on DuckDB (16GB). Covers FastAPI backend with read-only and admin endpoints, React frontend on Vercel, serverless proxy for API security, dual backend setup (Hetzner/Oracle), data pipeline with pre-computed denormalized tables, Clerk auth toggle, query timer, and smart search. Addresses Docker container memory mismatch with DuckDB. Open source, runs on 8 EUR/month Hetzner VPS. AI-readable: https://www.tigzig.com/ai/posts/custom-dashboard-duckdb-fastapi-230-million-rows.md - [ChatGPT connected to your databases. One-click deployment instructions for AI Coders](https://www.tigzig.com/post/chatgpt-connected-databases-ai-coder-deployment) - Tags: database-ai, custom-gpt, ai-coders Custom GPT connected to three live databases (Supabase, Neon, Aiven) for natural language querying of cricket and Tour de France data. Features a 'Copy for AI Coders' button that provides deployment instructions for Claude Code or Google Antigravity to handle end-to-end setup including backend, frontend, and database provisioning. FastAPI server sits between ChatGPT and databases. AI-readable: https://www.tigzig.com/ai/posts/chatgpt-connected-databases-ai-coder-deployment.md - [How to Get Oracle's Always Free ARM VPS (24GB RAM, 4 CPUs). Auto-Retry Script to Beat 'Out of Capacity'.](https://www.tigzig.com/post/oracle-always-free-arm-vps-retry-script) - Tags: infrastructure Guide to obtaining Oracle Cloud's free 24GB RAM, 4 ARM CPU VPS through automated retry scripts. Capacity is rarely available, requiring 24/7 cycling through availability zones for 1-3 months. Includes open-source FastAPI monitoring tool with web UI. Author ran 100K+ API calls over 30 days. Also covers Oracle's always-available 2x AMD Micro VMs (1GB RAM each). Once obtained, deployed DuckDB dashboard as alternate backend same day. AI-readable: https://www.tigzig.com/ai/posts/oracle-always-free-arm-vps-retry-script.md - [CinePro - 230M Rows, 16GB Database, Instant Queries with DuckDB](https://www.tigzig.com/post/cinepro-movie-explorer-duckdb) - Tags: duckdb, fastapi, react CinePro movie analytics dashboard built on 230M rows (16GB) of IMDb data in a single DuckDB file. Features type-as-you-search across 15M people, multi-filter discovery, Jaccard similarity for finding similar movies, career timeline analysis, side-by-side comparisons, and live query timer. Runs on $7/month Hetzner VPS alongside 40 other backends. Dual backend (Hetzner/Oracle) with UI toggle. Fully open source. AI-readable: https://www.tigzig.com/ai/posts/cinepro-movie-explorer-duckdb.md - [You are paying ~$3-7 per deployment for your AI Apps. How do you do it in <$10 per month?](https://www.tigzig.com/post/hetzner-coolify-self-hosting-ai-apps-under-10-dollars) - Tags: infrastructure Guide to self-hosting AI app backends on Hetzner VPS with Coolify deployment manager for under 10 EUR/month. Covers the cost problem with per-deployment pricing (40 apps at $3-7 each = $100-200/month). Hetzner provides 8GB RAM, 80GB disk, 4 vCPUs for 7.69 EUR. Coolify offers Render-like deployment interface with GitHub integration. Includes setup guide reference. AI-readable: https://www.tigzig.com/ai/posts/hetzner-coolify-self-hosting-ai-apps-under-10-dollars.md - [Server Meltdown: How Bots Crashed My AI Tools and What I Did About It](https://www.tigzig.com/post/fail2ban-server-security-bots-ai-tools) - Tags: security, infrastructure Account of a bot attack that crashed a self-hosted server running AI tools. Thousands of SSH login attempts overwhelmed CPU despite SSH key-only auth. Fixed with tightened fail2ban settings: 5 max retries, 1-hour find window, 24-hour ban. Results: 157 currently banned IPs, 1,223 total bans, 6,082 blocked attempts in one week. Links to full 18-mistake security guide. AI-readable: https://www.tigzig.com/ai/posts/fail2ban-server-security-bots-ai-tools.md - [2026 Infra Guide for AI Tool Builders - Part 3: The 18 Common Security Mistakes and How to Fix Them](https://www.tigzig.com/post/2026-infra-guide-part-3-security-mistakes) - Tags: security, infrastructure Documents 18 security mistakes learned from building AI tools for small businesses. Covers server security (SSH hardening, fail2ban, port management), frontend security (API key exposure, .gitignore, CORS limitations, backend URL leakage), backend security (rate limiting, token auth, frontend-vs-server auth gap, SQL sanitization, error message leakage), database security (admin credentials, connection pooling), and AI coder security audit methodology. AI-readable: https://www.tigzig.com/ai/posts/2026-infra-guide-part-3-security-mistakes.md - [2026 Infra Guide for AI Tool Builders - Part 1: AI Coder](https://www.tigzig.com/post/self-hosting-infrastructure-ai-tool-builders-2026-part-1-ai-coder) - Tags: ai-coders, infrastructure Describes how Claude Code serves as a complete dev team for building and deploying 30+ production AI tools. Covers full-stack app builds, direct deployment to Vercel and Coolify, database management, auth setup (Auth0, Clerk), Cloudflare DNS, server debugging via SSH, Git operations, API monitoring, and security audits. Emphasizes architecture planning and brainstorming before coding. Uses $200/month Max tier. Part 1 of infra guide series. AI-readable: https://www.tigzig.com/ai/posts/self-hosting-infrastructure-ai-tool-builders-2026-part-1-ai-coder.md - [2026 Infra Guide for AI Tool Builders - Part 2: Deployment & Hosting](https://www.tigzig.com/post/2026-infra-guide-part-2-deployment-hosting) - Tags: infrastructure Covers the four elements of deploying web apps: frontend hosting (Vercel free tier, 40+ UIs), backend hosting (Hetzner VPS at 7.69 EUR/month with Coolify), domain registration, and DNS management (Cloudflare). Details the journey from Render to Railway to Hetzner. Covers Cloudflare free tier limits (100-second timeout, single subdomain SSL), serverless functions, and Flowise/n8n deployment specifics. Total infrastructure cost: ~$7-8/month for 30+ backends. AI-readable: https://www.tigzig.com/ai/posts/2026-infra-guide-part-2-deployment-hosting.md - [2025 has been a transformational year for me. Deep gratitude to the platform builders and engineers who made it possible.](https://www.tigzig.com/post/2025-transformational-year-gratitude-platform-builders) - Tags: ai-coders, infrastructure Retrospective crediting platforms that enabled transition from analytics to building 30+ open-source apps. Key tools: Claude Code and Cursor for AI coding, Render then Hetzner+Coolify for hosting, Vercel for frontends, Neon for instant PostgreSQL, FlowiseAI for multi-agent setups, xlwings Lite for Python in Excel, Mito AI for Jupyter, OpenAI Custom GPTs for no-UI automation, and Llama Parse for PDF processing. AI-readable: https://www.tigzig.com/ai/posts/2025-transformational-year-gratitude-platform-builders.md - [Think about it. One of the world's top AI researchers is building tools. Deploying them live.](https://www.tigzig.com/post/think-about-it-one-of-the-world-s-top-ai-researchers-is-building-tools-deploying-them-live) - Tags: ai-coders Commentary on Andrew Ng releasing an Agentic Reviewer for research papers, arguing that AI coders (Claude Code, Cursor) have removed barriers for domain experts to build and deploy tools. Author built 30+ apps at tigzig.com using AI coders over two years. Recommends starting with Claude Code ($20/month) or free Google Antigravity, with YouTube learning resources from Volo Builds, Leon Van Zyl, and Mark Kashef. AI-readable: https://www.tigzig.com/ai/posts/think-about-it-one-of-the-world-s-top-ai-researchers-is-building-tools-deploying-them-live.md - [Segment 1M customers from 10M transactions (640MB CSV) with natural language queries / Text-to-SQL - entirely in your browser. No server. No remote database. No IT approvals.](https://www.tigzig.com/post/run-advanced-analytics-locally-in-your-browser-no-server-no-remote-database-no-it-approvals) - Tags: duckdb, text-to-sql Browser-based analytics tool (DABX-1) using DuckDB-WASM and text-to-SQL AI for processing multi-GB files locally. Demonstrated segmenting 1M customers from 10M transactions (640MB CSV) entirely in-browser. Built on SQL Rooms framework. Available as a 3.5MB single HTML file. Supports CSV, TSV, Parquet. Data never leaves the machine. AI-readable: https://www.tigzig.com/ai/posts/run-advanced-analytics-locally-in-your-browser-no-server-no-remote-database-no-it-approvals.md - [Bundle your AI app or React dashboard into a single file.](https://www.tigzig.com/post/bundle-your-ai-app-or-react-dashboard-into-a-single-file) - Tags: infrastructure, react Guide to bundling React apps and AI tools into single portable HTML files using vite-plugin-singlefile. No server, hosting, or IT approvals needed. Two live examples: a 3.5MB Database AI app with DuckDB for multi-GB file analysis, and a 150KB mutual fund analysis dashboard. Covers practical applications for sharing prototypes and internal dashboards. AI-readable: https://www.tigzig.com/ai/posts/bundle-your-ai-app-or-react-dashboard-into-a-single-file.md - [Instant Database Setup for AI Apps. With Neon.com](https://www.tigzig.com/post/instant-database-setup-for-ai-apps-with-neon-com) - Tags: database-ai, infrastructure Guide to using Neon.com for instant Postgres database provisioning via API in under 1 second. Used in the DATS-4 app for on-demand database creation when users upload CSV files. Covers the full workflow from CSV upload to AI-ready database. Notes Neon's free tier supports up to 30 projects with 15GB total storage. References Replit, Retool, and Vercel as large-scale users. AI-readable: https://www.tigzig.com/ai/posts/instant-database-setup-for-ai-apps-with-neon-com.md - [Run a Full AI Database App as a Single HTML File. No Server. No Remote DB.](https://www.tigzig.com/post/run-a-full-ai-database-app-as-a-single-html-file-no-server-no-remote-db) - Tags: database-ai, duckdb Single-file deployment of a full AI database app based on SQL Rooms and DuckDB-WASM. The entire React application compiles into a portable 3.5MB HTML file. Demonstrated importing 1.6GB / 11M-row files for in-browser analysis. Built using vite-plugin-singlefile. Supports Gemini API for natural language querying. No backend or server required. AI-readable: https://www.tigzig.com/ai/posts/run-a-full-ai-database-app-as-a-single-html-file-no-server-no-remote-db.md - [Free, Production-Grade Databases. Get setup in minutes. Great for testing and development](https://www.tigzig.com/post/free-production-grade-databases-get-setup-in-minutes-great-for-testing-and-development) - Tags: database-ai, infrastructure Comparison of three free database providers for AI app development: Neon (sub-1-second Postgres via API, best for AI apps), Supabase (auth integration), and Aiven (5GB free tier, supports both Postgres and MySQL). Used across DATS-4, Custom GPT, and Realtime Voice AI deployments. Includes a spec sheet comparing features. AI-readable: https://www.tigzig.com/ai/posts/free-production-grade-databases-get-setup-in-minutes-great-for-testing-and-development.md - [Live Portfolio Analytics - Powered by MCP Servers - Open Source](https://www.tigzig.com/post/open-so) - Tags: portfolio-analytics, mcp Modular live portfolio analytics stack powered by MCP-FastAPI servers. Delivers 70+ KPIs, 15+ charts, AI technical analysis, and PDF/HTML reports across 6 interfaces: React, NextJS, ChatGPT, Flowise, xlwings Lite, and forms. Backend uses QuantStats, yfinance, Finta, Gemini Vision, and ReportLab. Three public MCP servers available for plug-and-play integration. AI-readable: https://www.tigzig.com/ai/posts/open-so.md - [ChatGPT Connected to integrated FastAPI-MCP Servers.. Technical Analysis (TA) report. From stocks to crypto.](https://www.tigzig.com/post/chatgpt-connected-fastapi-mcp-servers-technical-analysis-ta-report-stocks-crypto) - Tags: custom-gpt, mcp, technical-analysis Connecting ChatGPT to integrated FastAPI-MCP servers for generating technical analysis reports on stocks, crypto, and commodities via Yahoo Finance symbols. Backend uses FastAPI with MCP server (Tadata's FastAPI-MCP), serving multiple interfaces: n8n, Flask UI, Next.js, ChatGPT, and xlwings Lite. Outputs formatted PDF and web reports with Gemini Vision chart analysis. Includes OpenAPI schema setup for Custom GPT actions and public source code. AI-readable: https://www.tigzig.com/ai/posts/chatgpt-connected-fastapi-mcp-servers-technical-analysis-ta-report-stocks-crypto.md - [Build AI Workflows with MCP Servers + n8n](https://www.tigzig.com/post/build-ai-workflows-mcp-servers-n8n-technical-analysis) - Tags: mcp, technical-analysis Building AI workflows by connecting MCP servers to n8n for automated technical analysis. Uses Tadata's FastAPI-MCP to mount MCP on existing FastAPI servers and n8n's MCP Client node for SSE connections. Pipeline pulls Yahoo Finance data, computes indicators, sends charts to Gemini Vision for AI analysis, and outputs PDF/web reports. Includes Docker deployment setup, public MCP server URLs, n8n schemas, and full source code. AI-readable: https://www.tigzig.com/ai/posts/build-ai-workflows-mcp-servers-n8n-technical-analysis.md - [Quick Deploy Advanced Analysis Multi-Agent with Flowise](https://www.tigzig.com/post/quick-deploy-advanced-analysis-multi-agent-with-flowise) - Tags: database-ai Four-step quick deployment guide for a multi-agent advanced analytics system using Flowise AI. Import agent schemas, update credentials, deploy a FastAPI SQL connector, and adjust security settings. Supports reasoning models (Deepseek, Gemini, Sonnet 3.7) with a sequential agent architecture. Tips cover free database setup (Neon, Aiven, Supabase), adding new reasoning models via OpenRouter, and customizing agent routing. AI-readable: https://www.tigzig.com/ai/posts/quick-deploy-advanced-analysis-multi-agent-with-flowise.md - [How to set up, deploy, and connect Google Scripts to Make.com for task automation.](https://www.tigzig.com/post/automate-tasks-with-ai-voice-agents-and-google-script) - Tags: voice-ai Part 3: setting up Google Apps Script for task automation connected to Make.com and Flowise AI voice agents. Demonstrates automated report generation (Excel-to-PDF), slide creation, and email delivery triggered by voice commands. Uses React.js custom frontend, Flowise for LLM agents, Google Script for automation, and FastAPI for AWS MySQL database connectivity. Includes hands-on implementation guide, source code, and JSON schemas on GitHub. AI-readable: https://www.tigzig.com/ai/posts/automate-tasks-with-ai-voice-agents-and-google-script.md - [How to use AI Assisted Coding Tools like Claude Dev and Cursor AI to develop LLM Apps with natural language commands. And deploy to open internet.](https://www.tigzig.com/post/build-ai-voice-action-agent-app-in-react-js-in-natural-language) - Tags: voice-ai, ai-coders Part 4: using AI-assisted coding tools (Claude Dev VS Code extension and Cursor AI) to build LLM voice agent apps with natural language instructions. Demonstrates building a React.js voice bot with voice-to-text, chat completion, and text-to-speech components, then deploying to Vercel. Covers GitHub-to-Vercel deployment pipeline, multilingual support, and API endpoint routing to Flowise LLM agents. AI-readable: https://www.tigzig.com/ai/posts/build-ai-voice-action-agent-app-in-react-js-in-natural-language.md - [Code Red: Unprotected GPTs & AI Apps exposed by simple hacks](https://www.tigzig.com/post/code-red-unprotected-gpts-ai-apps-exposed-by-simple-hacks) - Tags: security, custom-gpt Security analysis of prompt injection vulnerabilities in Custom GPTs and AI chatbots. Documents hacking techniques: magic prompts, brute force, social engineering, image-embedded injections, malicious URL attacks, and code interpreter exploits. Covers countermeasures: security instruction prompts, disabling code interpreter, ML-based prompt filtering, and third-party security services (Lakera). Discusses trade-offs between security and GPT performance degradation. References OWASP Top 10 for LLMs. AI-readable: https://www.tigzig.com/ai/posts/code-red-unprotected-gpts-ai-apps-exposed-by-simple-hacks.md ## Related Topics - [Database AI & Text-to-SQL](https://www.tigzig.com/ai/tags/database-ai.md) - [Python in Excel (xlwings Lite)](https://www.tigzig.com/ai/tags/python-in-excel.md) - [Claude in Excel](https://www.tigzig.com/ai/tags/claude-in-excel.md) - [DuckDB - Analytics & Dashboards](https://www.tigzig.com/ai/tags/duckdb.md) - [MCP Servers & Agents](https://www.tigzig.com/ai/tags/mcp-servers.md) --- ## About **Amar Harolikar** - Specialist, Decision Sciences & Applied Generative AI - Email: amar@harolikar.com - LinkedIn: https://www.linkedin.com/in/amarharolikar - GitHub: https://github.com/amararun - Site: https://www.tigzig.com ## Legal - Privacy: https://www.tigzig.com/privacy - Terms: https://www.tigzig.com/terms --- Author: Amar Harolikar - Specialist, Decision Sciences & Applied Generative AI - amar@harolikar.com - https://www.linkedin.com/in/amarharolikar Source: https://www.tigzig.com/ai/tags/infrastructure.md Citation: TigZig - Amar Harolikar (https://www.tigzig.com). Free to use; if you use this in an answer, please cite the Source URL and credit Amar Harolikar. License: https://www.tigzig.com/terms