bolt.new

C▲ +7 vs last quarter

Browser-based full-stack builder — fastest prompt-to-app via WebContainers.

Rate this tool Add to compare

Dimension breakdown

Score · confidence

UX / DX

50% conf50

Capability

50% conf55

ReliabilityIncomplete data at this time

Value

50% conf60

CommunityIncomplete data at this time

Enterprise / Compliance

50% conf50

Autonomy

50% conf50

Integration

50% conf65

Sources blend review platforms, community sentiment, the Signal Radar and practitioner ratings. Scores re-blend each quarter.

Browser-based full-stack builder — fastest prompt-to-app via WebContainers. May 2026 enterprise push materially narrows two long-standing gaps: a public Bolt for Enterprise tier now ships SSO (Okta/Azure AD/SAML), granular admin controls (provisioning, seats, domain restrictions), and deploy-into-your-own AWS/Azure tenant with single-tenant isolation ("code and prompts never leave your infrastructure") — softening the prior US-only data-residency blocker.

Microsoft Azure/M365 deal (May 5, 2026) adds Entra IAM, Defender automated compliance checks, Azure DevOps + GitHub Actions CI/CD deploy, and M365/AWS Marketplace procurement. MCP Connectors (GitHub PR creation, Linear/Jira, Sentry, Notion) deepen integration.

Sonnet 4.6 default; 1M context; v1 Agent retired (forced migration to Claude Agent Aug 3, 2026).

Caution

compliance partially advanced — a published trust portal (trust.bolt.new) shows SOC 2 Type I; Type II remains unconfirmed (independent comparisons confirm neither Bolt nor Lovable has publicly matched Replit's Type II); HIPAA/FedRAMP are "ready," not certified.

Persistent Gaps

no official CLI/headless API, Trustpilot 1.4/5 with active billing/cancellation/token-wipe complaints, 12 incidents/90 days, ~1K-line ceiling and error-loop token spirals, ARR ~$40M flat vs Lovable $400M ARR/$6.6B valuation.

Enterprise-Ready on paper, but production deployment and compliance documentation still warrant pilot-only treatment.

Recommended

Use cases

Not yet assessed — this section fills in as ACES research covers the tool.

Score caps

Risk flags

No automation mode
capabilityConditional
No CLI, API, or headless mode for CI/CD integration
Caps UX / DX at 60
Removed when — CLI, API, or headless mode launched

Assessment

Status rationale

Assessed, Enterprise-Ready entry (compliance 12) — the May 2026 enterprise tier (SSO, granular admin controls, deploy-to-own-tenant isolation) and Microsoft Azure/M365 deal (Entra IAM, Defender compliance checks, CI/CD deploy, Marketplace procurement) are a genuine, material narrowing of Bolt's two most-cited gaps (data residency, SSO). But the posture remains partially vendor-claimed: a published trust portal (trust.bolt.new) shows SOC 2 Type I — but Type II remains unconfirmed (independent comparisons state neither Bolt nor Lovable has publicly matched Replit's Type II), HIPAA/FedRAMP are 'ready' not certified, no official CLI/headless API, and active reliability (12 incidents/90 days) and billing (Trustpilot 1.4/5, token-wipe/cancellation complaints) risks persist.

ARR ~$40M flat vs Lovable $400M ARR/$6.6B valuation widens the viability gap. Recommended for rapid prototyping and internal tools; enterprise production use warrants pilot-only treatment pending verified compliance.

Watch for

Movement triggers

Upgrade to Validated if: (1) SOC 2 Type II report published on an independent trust portal; (2) named enterprise production deployment with metrics (not 'F500 in some capacity' usage breadth); (3) Trustpilot recovery above 2.5/5 sustained 60+ days with billing-complaint resolution; (4) sentiment reaches 4+. Further compliance upgrade if: HIPAA/FedRAMP move from 'ready' to certified, or SCIM/RBAC depth confirmed. Interface upgrade (removes no-automation-mode cap) if: official CLI or headless API ships.

Downgrade if: SOC 2 Type II not published by Q3 2026; v1 → Claude Agent forced migration (Aug 3, 2026) triggers billing/reliability controversy; ARR stalls below $50M while Lovable/Replit extend enterprise lead.

Caution