Most founder–agency kickoffs fail the same way: the "MVP" quietly becomes a three-product roadmap with auth, billing, admin, five integrations, and a mobile app. Then everyone is surprised when the timeline slips and the cut list appears in week six as a crisis instead of week zero as a plan. This post is a practical cut list for founders hiring an agency to build a SaaS MVP — what must ship so a real customer can pay and complete one core job, what is nice-to-have, and how to brief scope without inventing vanity metrics.
What "must-have" actually means
Must-have is not "everything a competitor has." It is the minimum production-quality surface that lets a real user finish one workflow and pay you for it. Technical playbooks for SaaS MVPs in 2026 still put the same boring stack on the critical path: managed authentication, tenant/data isolation, subscription billing, critical transactional email, and a thin admin so you can unblock customers without a hotfix every Friday ( Zulbera SaaS MVP playbook ). Nice-to-have is everything that makes the second customer happier but does not prove the first one will pay. Integrations, polished analytics, SSO, marketplace hooks, and native mobile almost always belong there until revenue and support tickets say otherwise.
Must-haves for an agency-built SaaS MVP
Auth that you do not reinvent. Managed auth (Clerk, Auth0, or an equivalent you already trust) with email verification, password reset, session hygiene, and a clear tenant membership model. Rolling custom auth to "save two weeks" usually costs more than it saves and shows up in security questionnaires later. One core workflow, end to end. Name the noun (project, claim, campaign, patient chart stub — whatever your ICP pays for) and ship create → progress → done with empty states and failure paths. If a user cannot finish that loop without a Slack DM to you, it is not an MVP yet. Billing that validates money, not compliments. Stripe Billing (or your region’s equivalent) with Checkout or Payment Links, Customer Portal for plan/cancel/payment method, and webhooks for payment_succeeded / payment_failed / subscription deleted. A waitlist is research; a successful charge is a business experiment. Admin that is ugly but honest. Impersonation or safe "view as," ability to reset access, see subscription state, and mark accounts for manual review. You will run operations by hand at first — design for that instead of pretending automation exists. Email and observability for the moments that break trust. Signup, invite, password reset, failed payment. Plus basic error tracking (Sentry-class) and structured logs on auth and billing events. Founders rarely ask for these; agencies that skip them create silent support fires.
Nice-to-haves that burn budget early
Integrations before retention. Slack, HubSpot, Notion, Zapier, and "we’ll just MCP it" sound strategic. Until ten customers ask unprompted, treat each integration as a paid change order with a named owner and a test account. Team seats and complex roles. Two roles (owner / member) beat a permissions matrix. Multi-seat billing, SSO, and SCIM wait for an enterprise conversation that includes a contract date. Custom dashboards and reporting. Export CSV and one usage counter usually beat a BI project. Build charts when a buyer’s RFP names them. Native mobile. Responsive web (and optionally a lightweight PWA) covers desk-first B2B. Native is a distribution and capability decision, not a default MVP checkbox — more on that in a companion CodeFlamme Insight on native vs web-first. AI bolted on for the pitch deck. If AI is not the product, do not fund a chatbot demo from the MVP budget. If AI is the product, brief evals and human-in-the-loop — not a weekend wrapper around a model API.
How to run the cut list with your agency
Write three columns in the SOW: Must ship for paid pilot, Deferred until N paying users or named request, Explicitly out of scope. Attach acceptance tests in plain language ("owner can invite one teammate," "failed card shows banner and email within 15 minutes"). Time-box discovery to architecture decisions — multi-tenancy model, auth provider, billing objects, and deploy target — before feature tickets multiply. When something tries to sneak back in ("can we also…"), ask: does this change the core workflow acceptance test? If no, park it. Agencies that protect your cut list are cheaper than agencies that say yes to everything.
Budget and timeline language that keeps everyone honest
Ask for estimates as ranges tied to the Must column only, with a change-order path for Nice. Prefer a fixed-scope MVP milestone with a clear "done" checklist over an open backlog. Review week-two deliverables: login works in staging, Stripe test mode charges succeed, and the core workflow has a happy path — if those are missing, you are still scaffolding, not building product. Refuse invented velocity claims. What you want is dated owners, primary-source decisions (auth vendor docs, Stripe webhook list), and reversible choices. Keep a living "out of scope" appendix next to the SOW; when stakeholders resurrect a Nice-to-have, paste it there with the date and why it stays deferred. That discipline is how CodeFlamme scopes SaaS builds for founders who need a shippable first product, not a second pitch deck.
Related reading: if you are still sizing the budget, see how much an MVP costs in 2026 . Before you lock the auth line in your cut list, read build vs buy auth for B2B SaaS , and when you write the SOW, our guide to fixed-price vs milestone billing shows how to tie payment to the Must column. Want help drawing the line on your MVP? Talk to the CodeFlamme team .
