The AI SaaS Boilerplate Checklist for 2026 (12 Verifiable Items)

An AI-first starter in 2026 is a mature category with published buyer checklists. That is good news: you can evaluate one in an afternoon instead of trusting a landing page. Here are twelve items and how to verify each without taking a vendor's word for it.

Capability baseline (expect all of these)

1. Streaming output. Verify: the response is incremental text, not one JSON blob at the end.
2. Multiple model providers. Verify: swap the env key and the same route still works.
3. Usage metering and quotas. Verify: exhaust the quota and read the 429 headers, including a truthful Retry-After.
4. Retrieval with citations. Verify: ingest a document and see inline source markers, not just an answer.
5. Tool calling / MCP. Verify: an agent client can discover and call the tool endpoint.
6. Provider error honesty. Verify: an invalid API key produces a logged server error and a real failure, not a cheerful fake reply.

Production baseline (the items vendors skip)

1. Webhook signature verification. Verify: bad or missing signature returns 400, never 200.
2. Idempotency. Verify: replay one event id and confirm only one write.
3. Guardrails and rate limits. Verify: an unauthenticated or over-quota request is rejected at the server, not hidden in the UI.
4. Observability. Verify: structured logs, an error boundary, /api/health with a real DB probe, a local error_events table and an optional ERROR_REPORT_URL sink. Ask who configures the sink and who gets paged — the code cannot page anyone.
5. Agent-readable docs. Verify: AGENTS.md, a style-specific design document, scoped rules, llms.txt, an OpenAPI contract and an MCP endpoint are actually present in the download, not just on the marketing site.
6. Cost visibility. Verify: you can see what a user's AI usage costs, or at least the token counts behind the quota.

What is NOT on this checklist

Brand name, hero animation and the number of demo screens. Also not: claims like "save 480 hours" — vendor self-reports are not verifiable. And beware treating any single baseline item as a differentiator; by late 2026 they are the entry ticket.

The one question that still separates products

Ask: do I receive the same fixed repository as everyone else, or a build generated from my own configuration with unselected modules actually removed? If the answer is a fixed repository, budget time to delete code you did not ask for — and to check that deleting it does not leave dead links behind.