NexoISP

Inspiration

Small, independent ISPs keep entire towns and rural regions connected — often with two or three technicians, no enterprise network operations center, and none of the monitoring tools large telcos take for granted. When a subscriber calls because their connection is down, someone has to manually log into the equipment, one request at a time.

My original plan was to solve this with an agent installed on a server inside each ISP's own network. Talking to real ISP operators changed that. Several told me the same thing: they don't run any local server infrastructure at all — everything they operate lives on the router itself or is fully outsourced. That single set of conversations reshaped the entire architecture, and it's the kind of correction that only happens when you build in contact with real customers instead of assumptions.

What It Does

NexoISP observes an ISP's network continuously and lets staff act on it through a guarded, auditable workflow — never autonomously on a customer's live equipment.

• Atlas pulls real telemetry (CPU, memory, uptime, connected devices) directly from ISP hardware every 1–5 minutes, automatically.
• The action pipeline lets an ISP collaborator request a common action — like a router reboot — on behalf of a named subscriber. Backend guardrails reject anything aimed at the ISP's own management infrastructure without an identified subscriber. Nothing executes until a human operator explicitly confirms it. Every request, approval, and outcome is written to an immutable audit log.
• Nova, powered by Gemini, gives ISP owners real financial and operational analysis grounded in their own account data.
• A Contract Lifecycle Management system gates dashboard access behind real legal agreements — each one summarized in plain language by Gemini and sealed with a cryptographic hash chain anyone can verify publicly.
• A fully audited Polar.sh billing integration handles real payments end to end, from checkout through webhook processing to access control.

How I Built It

I built NexoISP as a solo founder working with AI coding agents — one agent implementing changes directly in the codebase, and a second, independent AI system reviewing architecture, security, and evidence before anything was accepted as finished. The product itself is layered on top of Google Gemini, accessed via the Google AI Studio API: Nova's business reasoning, the contract summarizer, and the underlying orchestration patterns all run on it natively, with no Vertex AI infrastructure required.

The backend runs on a self-hosted Supabase instance with row-level security enforced per ISP, a Next.js frontend and admin dashboard, and a separate connectivity service that speaks directly to ISP hardware over RouterOS API, SNMP, and REST — the "Cloud Execution Node" that replaced the original local-agent design.

Challenges I Ran Into

Almost every real challenge in this build came from the gap between "the code compiles" and "the behavior is correct" — closing that gap took repeated, deliberate verification, not assumption:

• A production database was missing two foundational tables for over two weeks, silently breaking every subscription webhook, until I traced it with direct evidence instead of trusting an earlier report that it was working.
• A security audit found 41 database policies open to public read access across two servers, seven of which exposed tenant-specific data; each one was fixed individually and verified against real queries, not assumed safe because nothing had gone wrong yet.
• Days before submission, I found that internal documentation still described the pre-pivot architecture — a design already replaced based on real customer feedback — and had to rewrite it to match what the product actually does today.
• On the day of this very submission, my first real paying customer's router showed stale telemetry after a live reboot; the root cause was a persistence bug in the telemetry endpoint, found and fixed the same day, verified against the router's real uptime before trusting it again.

Accomplishments That I'm Proud Of

• A real subscriber-facing action — a router reboot — executed against live hardware, with full human confirmation and an immutable audit trail, not a demo.
• A real customer paying, in production, through a fully audited payment pipeline, on August 13, 2026.
• Catching and fixing real production security issues — open database policies, a stale credential, a pricing bug — before any customer was harmed by them.
• Building a product that discloses in-development features honestly in the interface instead of simulating a result that isn't real yet.
• A working Contract Lifecycle Management system with cryptographic integrity and AI-generated plain-language summaries, built to remove the legal friction small ISPs can't afford to navigate alone.
• Doing all of this as a single founder, with AI agents doing most of the implementation under direct, skeptical review.

What I Learned

The most consistent lesson of this build was that evidence beats narrative, every time. Working with AI coding agents makes it easy to accept a confident "done" without checking it — and more than once, a claim that sounded complete turned out to be missing a piece once I asked for proof: a database query, a log line, a reproduced test. I also learned to extend that same honesty to the product itself: where a capability isn't fully live yet, NexoISP says so directly, instead of quietly returning a plausible-looking but simulated result.

What's Next for NexoISP

• Deploying the Edge Execution Node — already built, not yet used in production — for ISPs whose network topology (NAT, no public IP) can't be reached by the default Cloud Execution Node.
• Finishing the write driver for WiFi-change requests, currently disabled in the UI pending that implementation.
• Migrating from today's self-contained Local Pilot capacity system to the full iAvanxemos Cognitive Kernel.
• Formalizing relationships with two additional ISPs in the Catatumbo region already in active conversation.
• Exploring a proactive AI co-pilot across the product, extending the same guardrail-before-access discipline already used for network actions and legal onboarding.

Built With

• ai-agents
• autonomous-systems
• docker
• google-ai-studio
• google-antigravity
• google-gemini-api
• mikrotik
• next.js
• node.js
• polar.sh
• postgresql
• react
• resend
• rest-api
• routeros-api
• server-sent-events
• snmp
• ssh
• supabase
• tailwind-css
• typescript
• upstash-redis
• vercel
• webhooks
• wireguard