Potencia tu agente
El comando propio del publicador. No es un endpoint de PlugMCP.
Host a copy with our keys and logs.
npx -y [email protected]Claude Code no tiene enlace de instalación para un comando local. Copia el comando de abajo y ejecútalo en una terminal.
claude mcp add prodlint -- npx -y prodlint@0.10.8Ejecútalo en una terminal.
{ "mcpServers": { "prodlint": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}claude_desktop_config.json
¿URL remota o un comando en tu máquina? En qué se diferencian las dos instalaciones
Ejecutar en PlugMCP
A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.
AbrirDel publicador
Production readiness for vibe-coded apps.
Static analysis for vibe-coded apps. Flags the security, reliability, performance, and AI quality issues that Cursor, v0, Bolt, and Copilot create — hallucinated imports, missing auth, hardcoded secrets, unvalidated server actions, and more. Zero config, no LLM, 52 rules.
Production readiness for vibe-coded apps — know your AI code is ready to ship
npx prodlint
prodlint v0.10.4
Scanned 148 files · 2 critical · 5 warnings · 1 info
src/app/api/checkout/route.ts
12:1 INFO No rate limiting — anyone could spam this endpoint and run up your API costs rate-limiting
28:5 WARN Empty catch block silently swallows error shallow-catch
src/actions/submit.ts
5:3 CRIT Server action uses formData without validation next-server-action-validation
↳ Validate with Zod: const data = schema.safeParse(Object.fromEntries(formData))
src/lib/db.ts
1:1 CRIT Package "drizzle-orm" is imported but not in package.json hallucinated-imports
Scores
security 72 ████████████████░░░░ (8 issues)
reliability 85 █████████████████░░░ (4 issues)
performance 95 ███████████████████░ (1 issue)
ai-quality 90 ██████████████████░░ (3 issues)
Overall: 82/100 (weighted)
2 critical · 5 warnings · 4 info
Vibe coding is the fastest way to build. Shipping fast means knowing your code is production-ready — not just that it compiles. Hardcoded secrets, hallucinated packages, missing auth, and XSS vectors pass type-checks and look correct — but they aren't ready for production.
prodlint checks what TypeScript and ESLint don't: whether your vibe-coded app is ready for production.
npx prodlint # Run directly (no install)
npx prodlint ./my-app # Scan specific path
npx prodlint --json # JSON output for CI
npx prodlint --sarif # SARIF 2.1.0 for GitHub Code Scanning
npx prodlint --summary # Quick pass/fail + top 3 blockers
npx prodlint --profile startup # Only critical findings
npx prodlint --profile strict # All findings including info
npx prodlint --baseline .prodlint-baseline.json # Only new findings
npx prodlint --ignore "*.test.ts" # Ignore patterns
npx prodlint --min-severity warning # Only warnings and criticals
npx prodlint --quiet # Suppress badge output
Or install it:
npm i -D prodlint # Project dependency
npm i -g prodlint # Global install
prodlint avoids common false positives:
middleware.ts, or proxy.ts on Next.js 16) detected — auth findings downgraded/* */ are ignored@/, ~/, and tsconfig paths aren't flagged as hallucinated importsfix hints with remediation codeEach category starts at 100. Deductions per finding:
Diminishing returns: after 30 points deducted in a category, further deductions are halved; after 50, quartered.
Weighted overall: security 40%, reliability 30%, performance 15%, ai-quality 15%. Floor at 0. Exit code 1 if any critical findings exist.
Add to .github/workflows/prodlint.yml:
name: Prodlint
on: [pull_request]
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: prodlint/prodlint@v1
with:
threshold: 50
Posts a score breakdown as a PR comment, and fails the build when the scan finds critical
issues or the score is below threshold. Each release of the action runs its matching
prodlint version, so pinning the action (@v1, a version tag, or a commit SHA) also pins
the scanner.
Upload prodlint results to GitHub's Security tab:
- name: Run prodlint
run: npx prodlint --sarif > prodlint.sarif
- name: Upload SARIF
uses: github/codeql-action/upload-sarif@v4
with:
sarif_file: prodlint.sarif
category: prodlint
Adopt prodlint gradually without drowning in pre-existing findings:
# Save current state as baseline
npx prodlint --baseline-save .prodlint-baseline.json
# CI only fails on NEW findings
npx prodlint --baseline .prodlint-baseline.json
Use prodlint inside Cursor, Claude Code, or any MCP-compatible editor:
Claude Code:
claude mcp add prodlint -- npx -y prodlint-mcp
Cursor / Windsurf:
{
"mcpServers": {
"prodlint": {
"command": "npx",
"args": ["-y", "prodlint-mcp"]
}
}
}
prodlint-mcp is a thin launcher for the server built into prodlint. It's published with
every prodlint release, so it always runs the matching scanner.
Ask your AI: "Run prodlint on this project" and it calls the scan tool directly.
Both tools return a Markdown summary plus structured output (structuredContent matching
each tool's outputSchema), and both are marked read-only (readOnlyHint), which hosted
reviewers such as GitHub Copilot code review require before they call an MCP tool.
Check any deployed website for AI agent-readiness — 14 checks covering emerging standards like llms.txt, TDMRep, AgentCard, AI-Disclosure, HTTP Signatures (RFC 9421), and more.
npx prodlint --web example.com
npx prodlint --web example.com --json # JSON output
prodlint site score
example.com · 14 checks
Score: 42 C ████████░░░░░░░░░░░░
✗ AI-Disclosure Header 0/10 No AI-Disclosure header found.
✗ Content-Usage Directives 0/10 No Content-Usage directives found.
✗ TDMRep 0/10 No TDMRep found.
✗ A2A AgentCard 0/5 No agent-card.json found.
✗ ai.txt 0/5 No ai.txt found at site root.
! llms.txt 2/5 llms.txt found but missing key sections.
✓ robots.txt 10/10 robots.txt found with 15 rules.
✓ Sitemap 10/10 Valid sitemap with 42 URLs.
✓ Structured Data 10/10 Found JSON-LD structured data.
✓ OpenGraph 10/10 Complete OpenGraph tags found.
✓ Page Speed 5/5 Loaded in 0.8s.
✓ AI Bot Directives 5/5 AI-specific bot rules found.
✓ WebMCP Tools 0/5 No WebMCP tools detected.
7 passed · 5 failed · 1 warnings
Full results: https://prodlint.com/score?url=example.com
Or check your score interactively at prodlint.com/score.
prodlint is designed specifically for AI-generated code patterns. Every rule checks for production issues that AI coding tools consistently create — not style nits.
Suppress a single line:
// prodlint-disable-next-line secrets
const key = "sk_test_example_for_docs"
Suppress an entire file (place at top):
// prodlint-disable secrets
import { scan } from 'prodlint'
const result = await scan({ path: './my-project' })
console.log(result.overallScore) // 0-100
console.log(result.findings) // Finding[]
[](https://prodlint.com)
MIT
Production readiness for vibe-coded apps — know your AI code is ready to ship
{ "mcpServers": { "prodlint": { "command": "npx", "args": [ "-y", "[email protected]" ] } }}Herramientas
Aún no hay lista de herramientas. Los servidores remotos la reciben tras la primera comprobación de estado.
Preguntas frecuentes
Copia en esta página la configuración stdio para Cursor, Claude Desktop, Claude Code o VS Code. Usa la instalación del publicador, no un proxy de PlugMCP.
Este registro no indica ninguna variable de entorno obligatoria.
Prodlint se ejecuta localmente por stdio.
Última comprobación: 2026-11-15. Production readiness for vibe-coded apps — know your AI code is ready to ship