Cursor and Claude Code are remarkable code generation tools. They can read a codebase, understand intent, write correct implementation code, refactor across files, and debug complex logic faster than most experienced developers. The benchmarks are not the question.
The question is: after the agent finishes generating, what's missing from the running application?
This checklist answers that question. Each item is a gap that AI coding tools don't fill on their own — not because they're bad at code, but because they generate code that runs against systems, and those systems have to exist before the code can run.
The Checklist
1. A Real Database
What AI coding tools do: Write database queries, generate migrations, produce ORMs, model schemas in code.
What they don't do: Run a database. The queries they write need a Postgres instance (or equivalent) to run against. The schema they generate needs to be applied to a running database. The connection string needs to point somewhere real.
What this means in practice: Every AI-generated app that touches data needs a running, hosted database. Without one, the generated queries are correct syntax pointing at nothing.
What fills this gap: A hosted database (Supabase, Railway, Neon, PlanetScale, or a visual backend like Momen that provisions Postgres automatically). For new projects building with AI coding tools, a visual backend like Momen that configures the schema without code is usually faster than provisioning and migrating a raw Postgres instance.
2. Persistent State Across Requests
What AI coding tools do: Generate stateful frontend logic (React state, Zustand stores, localStorage usage).
What they don't do: Persist that state across page reloads, different devices, or different users. Client-side state is ephemeral.
What this means in practice: An app that stores everything in useState or localStorage loses its data when the browser tab closes. Real persistence requires a database.
What fills this gap: The same real database from item 1. Every piece of data that needs to survive a refresh lives in the database, not in component state.
3. Authentication
What AI coding tools do: Generate login forms, password field validation, auth state management in React, protected route wrappers, token storage in localStorage.
What they don't do: Issue JWTs, verify credentials, hash passwords, manage session revocation, or provide the server-side auth endpoint that the generated login form calls.
What this means in practice: A generated login form without a real auth backend will call /api/auth/login and get a 404. Or the agent will stub the auth endpoint locally, which doesn't survive deployment.
What fills this gap: A real auth system — Supabase Auth, Auth0, Clerk, or the built-in auth in a visual backend like Momen. Momen's auth is configured visually and generates the auth GraphQL operations automatically, so the AI coding tool has real endpoints to call.
4. Permissions and Access Control
What AI coding tools do: Generate code that reads a user ID and conditionally renders UI elements (hiding an "admin" button from non-admins, filtering a list by the current user's ID).
What they don't do: Enforce those permissions at the server or database layer. If the generated code checks permissions in the frontend, a user who modifies their browser's JavaScript can bypass those checks. If the API returns all rows and the frontend filters them, a user who calls the API directly gets all rows.
What this means in practice: Frontend permission checks are UI conveniences, not security. They must be backed by server-side enforcement.
What fills this gap: Row-level security at the database layer, or server-side permission checks in a backend API layer. Momen enforces permissions at the Postgres layer with RLS — unauthorized rows never leave the server regardless of how the query was constructed.
5. Transactions and Data Consistency
What AI coding tools do: Generate multi-step operations — debit one account, credit another; check inventory, create order, send confirmation.
What they don't do: Ensure those steps succeed or fail together. If the agent generates three sequential API calls and the second one fails, the first has already run. You now have an inconsistent state.
What this means in practice: Any operation that involves more than one write needs transaction support. Generated code that makes sequential API calls doesn't have it unless the API itself provides it.
What fills this gap: ACID transactions on the backend. Momen's Actionflows run as single transactions — if any step fails, the whole flow rolls back. The generated frontend code calls one Actionflow endpoint instead of three sequential writes.
6. A Hosted API
What AI coding tools do: Generate REST API route handlers, GraphQL resolvers, Express or Fastify server code.
What they don't do: Host that server. Generated server code runs locally and stops when you close your laptop. It doesn't have a URL that other systems, mobile apps, or AI agents can call.
What this means in practice: An app that calls localhost:3000 is not an app anyone else can use.
What fills this gap: Deployment. For AI-generated server code, this usually means Vercel, Railway, or Fly.io. For a visual backend like Momen, the API is hosted automatically — the GraphQL endpoint is live when you sync the backend, no deployment step required.
7. Background Jobs and Async Processing
What AI coding tools do: Generate code that kicks off a long operation — "upload this file and process it," "generate this PDF," "import this CSV."
What they don't do: Run that operation asynchronously while keeping the user interface responsive. Generated synchronous code either blocks the UI until completion or fails on timeout.
What this means in practice: A button that triggers a 30-second PDF generation will freeze the UI for 30 seconds if the operation runs synchronously — or return a timeout error if the server gives up first.
What fills this gap: An async job queue on the backend. Momen's async Actionflows receive the trigger, return a job ID immediately, and process the work in the background. The frontend polls or subscribes for completion.
8. Real-Time Updates
What AI coding tools do: Generate polling logic, write subscription code using WebSocket libraries.
What they don't do: Provide the WebSocket server or subscription infrastructure that polling code calls.
What this means in practice: Generated subscription code calls a WebSocket endpoint that doesn't exist yet.
What fills this gap: Real-time infrastructure — Pusher, Ably, Supabase Realtime, or built-in subscriptions in a visual backend. Momen includes subscription support as part of the auto-generated API.
The Pattern Across All Eight Gaps
Every gap on this list follows the same pattern: AI coding tools generate code that uses a service, but they don't provide the service itself. They generate the query but not the database. The login form but not the auth endpoint. The API call but not the hosted server.
This isn't a limitation of the tools — it's the correct division of labor. Code generation is a different problem from infrastructure provisioning, security enforcement, and operational hosting.
The practical implication: every AI coding session that ends in a deployable app includes both the generated code and the backend services that code runs against.
For a complete checklist of what those backend services need to provide, and how a visual backend covers all eight gaps without requiring a separate backend developer:
- Momen's data model documentation covers items 1–2
- Auth (item 3) is handled by Momen's built-in auth system — see the Momen docs for setup details
- Permissions and deployment covers items 4 and 6
- Actionflow overview covers items 5 and 7
And for real examples of AI coding sessions that include all eight elements working together:
- How I Built a Legal Intake and Triage App with Claude Code and Momen Backend
- From Hackathon Challenge to Auditable AI Research — Claude Code + Momen Visual Backend
- Building a Full-Stack AI Trip Planner with Momen and Cursor
Summary
The checklist isn't a criticism of Cursor or Claude Code — it's a map of the ecosystem. AI coding tools generate the application logic. A backend provides the services that logic runs against: database, auth, permissions, transactions, hosting, async queues, and real-time infrastructure. Running through this checklist before starting a session tells you what you need to have in place for the generated code to work when the session ends.
Top comments (0)